Bug 226621 - DFG should speculate on CompareStrictEq(@x, @x)
Summary: DFG should speculate on CompareStrictEq(@x, @x)
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: JavaScriptCore (show other bugs)
Version: Other
Hardware: All All
: P2 Normal
Assignee: Filip Pizlo
URL:
Keywords: InRadar
Depends on:
Blocks:
 
Reported: 2021-06-03 20:45 PDT by Filip Pizlo
Modified: 2021-06-04 14:22 PDT (History)
7 users (show)

See Also:

Attachments
the patch (10.80 KB, patch)
2021-06-03 20:48 PDT, Filip Pizlo 		mark.lam: review+
Details | Formatted Diff | Diff
View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Filip Pizlo 2021-06-03 20:45:00 PDT 
...
Comment 1 Filip Pizlo 2021-06-03 20:48:03 PDT 
Created attachment 430535 [details]
the patch

Not yet ready for review - still need to test it.
Comment 2 Mark Lam 2021-06-04 09:21:37 PDT 
Comment on attachment 430535 [details]
the patch

r=me
Comment 3 Filip Pizlo 2021-06-04 09:33:22 PDT 
Landed in https://trac.webkit.org/changeset/278465/webkit
Comment 4 Radar WebKit Bug Importer 2021-06-04 09:34:16 PDT 
<rdar://problem/78872738>
Comment 5 Saam Barati 2021-06-04 09:50:48 PDT 
Comment on attachment 430535 [details]
the patch

View in context: https://bugs.webkit.org/attachment.cgi?id=430535&action=review

LGTM too, one comment

> Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp:11387
> +    JITCompiler::Jump done = m_jit.branchIfInt32(regs);

nit: we always do this branch, even if we're proven not to be a double.

Maybe let's read AI state before doing this

> Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp:18287
> +        m_out.branch(isInt32(value, provenType(edge)), unsure(continuation), unsure(isNotInt32));

ditto
Comment 6 Filip Pizlo 2021-06-04 10:17:47 PDT 
(In reply to Saam Barati from comment #5)
> Comment on attachment 430535 [details]
> the patch
> 
> View in context:
> https://bugs.webkit.org/attachment.cgi?id=430535&action=review
> 
> LGTM too, one comment
> 
> > Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp:11387
> > +    JITCompiler::Jump done = m_jit.branchIfInt32(regs);
> 
> nit: we always do this branch, even if we're proven not to be a double.

If we're proven not to be a double then this entire check would have been eliminated.

> 
> Maybe let's read AI state before doing this
> 
> > Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp:18287
> > +        m_out.branch(isInt32(value, provenType(edge)), unsure(continuation), unsure(isNotInt32));
> 
> ditto

This actually reads AI state (that's the provenType(edge) thing).

I think I'll leave it as is for now.  We've got bigger fish to fry in this area.
Comment 7 Saam Barati 2021-06-04 14:22:13 PDT 
(In reply to Filip Pizlo from comment #6)
> (In reply to Saam Barati from comment #5)
> > Comment on attachment 430535 [details]
> > the patch
> > 
> > View in context:
> > https://bugs.webkit.org/attachment.cgi?id=430535&action=review
> > 
> > LGTM too, one comment
> > 
> > > Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp:11387
> > > +    JITCompiler::Jump done = m_jit.branchIfInt32(regs);
> > 
> > nit: we always do this branch, even if we're proven not to be a double.
> 
> If we're proven not to be a double then this entire check would have been
> eliminated.
> 
> > 
> > Maybe let's read AI state before doing this
> > 
> > > Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp:18287
> > > +        m_out.branch(isInt32(value, provenType(edge)), unsure(continuation), unsure(isNotInt32));
> > 
> > ditto
> 
> This actually reads AI state (that's the provenType(edge) thing).
> 
> I think I'll leave it as is for now.  We've got bigger fish to fry in this
> area.

We discussed over slack.

Phil landed this:
https://trac.webkit.org/changeset/278476/webkit