We currently optimize the heck out of: arguments[i] arguments.length But we fail to do the same optimizations if we have: var x = arguments; x[i] x.length In particular, we will presently allocate (and tear off) an arguments object, and then optimize x[i] and x.length to be array-like accesses to that arguments object. While that is faster than what the baseline JIT and LLInt would do, it's still rather redundant, since the DFG has most of the machinery in place to realize that this aliased form of arguments access is equivalent to the non-aliased form.
Created attachment 142107 [details] work in progress Still need to implement the OSR side of this optimization. And check that the code even compiles. ;-)
Created attachment 142114 [details] more Wrote the 64-bit side of the OSR part of this optimization. Still haven't even tried compiling this.
Created attachment 142115 [details] fixed some issues Fixed some issues that I found through code inspection.
Created attachment 142158 [details] it's starting to do things Still more work to be done though.
Created attachment 142563 [details] the patch
Comment on attachment 142563 [details] the patch View in context: https://bugs.webkit.org/attachment.cgi?id=142563&action=review Test cases and 32bit, please. > Source/JavaScriptCore/dfg/DFGArgumentsSimplificationPhase.cpp:442 > + // we should remote the phantom reference, since: s/remote/remove/
Created attachment 142606 [details] almost ready I just need to turn some of my ad-hoc tests into LayoutTests.
Landed with a bunch of LayoutTests in http://trac.webkit.org/changeset/117542
> s/remote/remove/ Forgot to fix in the main commit. Fix landed in http://trac.webkit.org/changeset/117543
Merged in http://trac.webkit.org/changeset/118323