[webkit-reviews] review granted: [Bug 67798] DFG JIT completely undoes speculative compilation even in the case of a partial static speculation failure : [Attachment 106799] the patch

[bugzilla-daemon at webkit.org]

Geoffrey Garen <ggaren at apple.com> has granted Filip Pizlo <fpizlo at apple.com>'s
request for review:
Bug 67798: DFG JIT completely undoes speculative compilation even in the case
of a partial static speculation failure
https://bugs.webkit.org/show_bug.cgi?id=67798

Attachment 106799: the patch
https://bugs.webkit.org/attachment.cgi?id=106799&action=review

------- Additional Comments from Geoffrey Garen <ggaren at apple.com>
View in context: https://bugs.webkit.org/attachment.cgi?id=106799&action=review


r=me

> Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp:1387
> +	   m_compileIndex = block.begin;
> +	   m_compileOkay = true;
> +	   clearGenerationInfo();

It confused me that a block could sometimes assume that generation info was in
an empty state, and sometimes not. Would be nice to clean this up in future,
possibly by giving each block its own generation info, or maybe just by calling
clearGenerationInfo() unconditionally at the head of SpeculativeJIT::compile,
if that's not too expensive.

> Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h:229
> +	   // under static speculation, it's more profitable to give up
entirely at this

Capital 'U', please.