[Webkit-unassigned] [Bug 68335] New: DFG speculation failures should act as additional value profiles

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=68335

           Summary: DFG speculation failures should act as additional
                    value profiles
           Product: WebKit
           Version: 528+ (Nightly build)
          Platform: All
        OS/Version: All
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: JavaScriptCore
        AssignedTo: webkit-unassigned at lists.webkit.org
        ReportedBy: fpizlo at apple.com


We want to support reoptimizing code if speculation failures appear to be frequent.  But to do so, we need to track why code is failing speculation, so that we don't make the mistake of making the same incorrect speculation in the future.  Currently, the OSR exit code has no such tracking; it will promptly forget why code failed OSR.

This is particularly bad in the following code:

function foo(a,b) {
    for (var i = 0; i < 100000; ++i) {
        a += b;
    }
    return a;
}

print(foo(1,10000000));

foo() is always called with integer arguments.  But it will fail speculation on the addition "a += b" because of an overflow.  Even after OSR when running in the old JIT code, the value profiler won't catch this because the only value profiling sites in foo() are for the arguments.  In general, code that fails speculation on integer arithmetic will have no way of recovering: the old JIT will correctly reperform the arithmetic using doubles, but will never record that it had done so.

The solution is either to beef up the amount of value profiling that the old JIT performs - for example profiling the results of arithmetic ops - or to record where and why DFG code is failing speculation, and at what rate.

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.