Bug 99261 - Baseline array profiling should be less accurate, and DFG OSR exit should update array profiles on CheckArray and CheckStructure failure
Summary: Baseline array profiling should be less accurate, and DFG OSR exit should upd...
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: JavaScriptCore (show other bugs)
Version: 528+ (Nightly build)
Hardware: All All
: P2 Normal
Assignee: Filip Pizlo
URL:
Keywords:
Depends on: 98997
Blocks: 98606
  Show dependency tree / graph
 
Reported: 2012-10-13 23:07 PDT by Filip Pizlo
Modified: 2012-10-19 12:47 PDT (History)
6 users (show)

See Also:

Attachments
the patch (22.97 KB, patch)
2012-10-18 15:15 PDT, Filip Pizlo 		oliver: review+
Details | Formatted Diff | Diff
View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Filip Pizlo 2012-10-13 23:07:46 PDT 
This would make our various mechanisms of array speculation work as well as all of our other speculation modes.
Comment 1 Filip Pizlo 2012-10-14 16:32:37 PDT 
It appears that this might just work already.  If we exit due to an invalid structure on an array access, then the baseline JIT will log *only* the invalid structure(s) in the array profile.  Subsequent recompiles will see only one of the invalid structures, and LUBing will conclude that the structure has gone polymorphic.

I will keep this open for now, but I suspect that this is not really a bug.  I mean, it could be good to unify how speculations work and make everything use OSR exit profiling, but this doesn't really smell like a bug right now.
Comment 2 Filip Pizlo 2012-10-18 14:29:30 PDT 
Actually.  Right now array profiles are too accurate.  They will catch *every* array type that flows through them, when what we really want is for them to catch the high probability array types.  Renaming the bug.
Comment 3 Filip Pizlo 2012-10-18 15:15:03 PDT 
Created attachment 169483 [details]
the patch
Comment 4 Filip Pizlo 2012-10-19 12:47:13 PDT 
Landed in http://trac.webkit.org/changeset/131868