[Webkit-unassigned] [Bug 67798] DFG JIT completely undoes speculative compilation even in the case of a partial static speculation failure

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=67798


Geoffrey Garen <ggaren at apple.com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
 Attachment #106799|review?                     |review+
               Flag|                            |




--- Comment #6 from Geoffrey Garen <ggaren at apple.com>  2011-09-09 15:36:23 PST ---
(From update of attachment 106799)
View in context: https://bugs.webkit.org/attachment.cgi?id=106799&action=review

r=me

> Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp:1387
> +        m_compileIndex = block.begin;
> +        m_compileOkay = true;
> +        clearGenerationInfo();

It confused me that a block could sometimes assume that generation info was in an empty state, and sometimes not. Would be nice to clean this up in future, possibly by giving each block its own generation info, or maybe just by calling clearGenerationInfo() unconditionally at the head of SpeculativeJIT::compile, if that's not too expensive.

> Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h:229
> +        // under static speculation, it's more profitable to give up entirely at this

Capital 'U', please.

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.