Bug 68763 - DFG JIT should not eagerly initialize integer tags in the register file
Summary: DFG JIT should not eagerly initialize integer tags in the register file
Alias: None
Product: WebKit
Classification: Unclassified
Component: JavaScriptCore (show other bugs)
Version: 528+ (Nightly build)
Hardware: All All
: P2 Normal
Assignee: Nobody
Depends on:
Blocks: 68593 68677
  Show dependency treegraph
Reported: 2011-09-24 13:39 PDT by Filip Pizlo
Modified: 2011-09-24 14:24 PDT (History)
2 users (show)

See Also:

the patch (7.47 KB, patch)
2011-09-24 13:42 PDT, Filip Pizlo
oliver: review+
Details | Formatted Diff | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Filip Pizlo 2011-09-24 13:39:44 PDT
Eagerly initializing integer tags has three outcomes:

1) We incur the cost of doing so even though neither the DFG nor the GC ever use integer tags for variables that are predicted integer.

2) It complicates the implementation of live range splitting.  Eager initialization of integer tags assumes that the variable will be an integer for the entire span of the function, but work is underway to enable a variable to have different predictions in different intervals (https://bugs.webkit.org/show_bug.cgi?id=68593).

3) It introduces an annoying bug: if we OSR entry does not initialize integer tags, so if we do OSR entry and then OSR exit, the old JIT may see integers that have not had their tags initialized.

The solution is to have the DFG initialize integer tags only on OSR exit, as that is the only point at which they need to be initialized.
Comment 1 Filip Pizlo 2011-09-24 13:42:15 PDT
Created attachment 108587 [details]
the patch
Comment 2 Filip Pizlo 2011-09-24 13:46:00 PDT
This bug mainly manifests itself as we increase the number of OSR's by implementing https://bugs.webkit.org/show_bug.cgi?id=68677
Comment 3 Filip Pizlo 2011-09-24 14:24:14 PDT
Landed in r95910.