[webkit-reviews] review denied: [Bug 226418] Optimize Function.prototype.toString : [Attachment 430096] Patch

[bugzilla-daemon at webkit.org]

Filip Pizlo <fpizlo at apple.com> has denied Tadeu Zagallo <tzagallo at apple.com>'s
request for review:
Bug 226418: Optimize Function.prototype.toString
https://bugs.webkit.org/show_bug.cgi?id=226418

Attachment 430096: Patch

https://bugs.webkit.org/attachment.cgi?id=430096&action=review




--- Comment #2 from Filip Pizlo <fpizlo at apple.com> ---
Comment on attachment 430096
  --> https://bugs.webkit.org/attachment.cgi?id=430096
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=430096&action=review

Looks good, but your OSR exit should really be a slow path.

> Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp:10522
> +    speculationCheck(BadType, JSValueSource::unboxedCell(result.gpr()),
node, m_jit.branchIfEmpty(result.gpr()));

This should be a slow path.

You don't want to OSR exit just because you got passed a function that was
stringified yet.  OSR exits are far too expensive to be part of the mechanism
by which functions get stringified for the first time.

> Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp:8233
> +	   speculate(
> +	       BadType, jsValueValue(asString), m_node,
> +	       m_out.isNull(asString));

Slow path please.