The DFG JIT sometimes wants to predict the type of a variable based on how it gets used. But it can only do this if the variable was assigned to by loading from the register file or from global variables. It should be able to also do this if the variable is the result of a heap load (GetById, GetByVal) or a call.
Created attachment 103306 [details] the patch
Comment on attachment 103306 [details] the patch All tests pass.
Comment on attachment 103306 [details] the patch View in context: https://bugs.webkit.org/attachment.cgi?id=103306&action=review Sorry to cq- for a typo, but I think there is a grammar error in the change log. :-) Otherwise all looks good. I think we might want a prediction for more (all) node types in the future, so may want to break this out as a separate field, but reuse of opInfo2 seems like a good call, at least for now. > Source/JavaScriptCore/ChangeLog:8 > + This introduces the capability to stored predictions on graph stored -> store ?
Created attachment 103423 [details] the patch (fix for review)
Comment on attachment 103423 [details] the patch (fix for review) Clearing flags on attachment: 103423 Committed r92734: <http://trac.webkit.org/changeset/92734>
All reviewed patches have been landed. Closing bug.
When combined with https://bugs.webkit.org/show_bug.cgi?id=65949, this produces a 20% slow-down in v8-crypto without any significant speed-ups anywhere. It should probably be disabled.