[Webkit-unassigned] [Bug 67826] New: JavaScriptCore does not have speculative->baseline OSR

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=67826

           Summary: JavaScriptCore does not have speculative->baseline OSR
           Product: WebKit
           Version: 528+ (Nightly build)
          Platform: All
        OS/Version: All
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: JavaScriptCore
        AssignedTo: webkit-unassigned at lists.webkit.org
        ReportedBy: fpizlo at apple.com


The DFG JIT handles speculation failures by always generating a non-speculative version of the same optimized code, and then emitting jumps and recoveries between the speculative and non-speculative path.  This has a number of issues:

1) It means that when doing tiered compilation, we have three copies of the same code: old JIT, DFG speculative, and DFG non-speculative.  Since the DFG non-speculative path ends up doing more-or-less the same things as the code emitted by the old JIT, it would be nice if we could skip emitting the non-speculative path.

2) It means maintaining two paths for the DFG JIT.  A lot of logic gets duplicated, and maintenance effort is increased, by the presence of two DFG back-ends.

3) It complicates the development of speculative optimizations that rely on mutating the DFG graph.  The speculative->non-speculative jump relies on both backends using the same graph.

All of these problems can be eliminated if the speculative JIT can bail out by performing OSR to the old JIT.

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.