[Webkit-unassigned] [Bug 65290] DFG speculative JIT does not implement load elimination for GetById

Fri Jul 29 23:50:01 PDT 2011

https://bugs.webkit.org/show_bug.cgi?id=65290

--- Comment #12 from Filip Pizlo <fpizlo at apple.com>  2011-07-29 23:50:01 PST ---
> My point was that you're relying on _all_ code conforming to an invariant we can't enforce statically at compile time.  If you were okay with exceptions being thrown you'd need to ensure you always cleared the exception slot.

The latter part is easy, the former comes down to a question of risk/reward.  This patch wins us maybe 1%, and that's in an idealized fantasy world that involves the above-posted incorrect patch.  So my feeling is to table this and revisit later (or never), especially given that we have other, bigger things, to optimize.  Gavin, do you concur?

And yeah, I have thought about making this an opt-in rather than opt-out speculation, where for example we only rely on GetById on JSFinalObject being free of side effects.  This scares me as well because it would mean that any GetById on any non-JSFinalObject would currently knock us off the speculative path.  That's not good, given that this is only a 1% win *in the idealized case*, and the non-speculative path is known to be more than 1% slower than the speculative path.

> I also just realised that getOwnPropertySlot on a JSFunction can modify the object among other things -- it should not be observable that the change has happened, but it does modify the object.

Yeah, changes in general are OK - but changes that are observable with GetById are not OK.

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.