[Webkit-unassigned] [Bug 88176] New: If the DFG bytecode parser detects that op_method_check has gone polymorphic, it shouldn't revert all the way to GetById/GetByIdFlush

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=88176

           Summary: If the DFG bytecode parser detects that
                    op_method_check has gone polymorphic, it shouldn't
                    revert all the way to GetById/GetByIdFlush
           Product: WebKit
           Version: 528+ (Nightly build)
          Platform: All
        OS/Version: All
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: JavaScriptCore
        AssignedTo: webkit-unassigned at lists.webkit.org
        ReportedBy: fpizlo at apple.com


The DFG is capable of four levels of get_by_id optimization:

Fastest: CheckStructure to check if the object still has the right structure, and then WeakJSConstant for the result, if the structure specializes that field.
Fast: CheckStructure to check if the object still has the right structure, and then a GetByOffset.
Slow: GetById, which gets patched and is slightly speculated in favor of the access not causing arbitrary side-effects, in that it doesn't pre flush registers and thus requires getters to go through the slow path
Slowest: GetByIdFlush, which flushes all registers first and allows for any arbitrarily crazy access to happen using the fastest possible dynamically generated stub

When parsing code, the DFG sees two distinct kinds of get_by_id's: those that are preceded by method_check and those that aren't.  Currently for those that have method_check, the DFG first tries to generate the Fastest code, but if that fails (say due to slow path profiling indicating that it's a bad idea) then it reverts to Slow or Slowest.  The Fast mode is thus only available to get_by_id's that don't have a method_check.

This is an unusual and unnecessary restriction that is largely caused by the intelligence necessary to emit the Fast form only being present in the 'case op_get_by_id' part of the parser.  The code should be refactored so that the op_method_check case can gracefully fall through to op_get_by_id and be able to emit all of the optimizations that op_get_by_id would do.

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.