[Webkit-unassigned] [Bug 157938] New: Math.pow with Object arguments get deoptimized

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=157938

            Bug ID: 157938
           Summary: Math.pow with Object arguments get deoptimized
    Classification: Unclassified
           Product: WebKit
           Version: WebKit Nightly Build
          Hardware: Unspecified
                OS: Unspecified
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: JavaScriptCore
          Assignee: webkit-unassigned at lists.webkit.org
          Reporter: joepeck at webkit.org
                CC: benjamin at webkit.org, fpizlo at apple.com,
                    ggaren at apple.com

* SUMMARY
Math.pow with Object arguments get deoptimized.

It seems the DFG doesn't reason about converting Object -> numbers via valueOf() here.

* TEST
var sum = 0;
for (var i = 0; i < 1e5; ++i) {
    sum += Math.pow(2, {valueOf() { return 3 }});
}

* NOTES
$ jsc test.js -p profile.json
$ display-profiler-output profile.json 
   CodeBlock    #Instr      Source Counts         Machine Counts    #Compil  Inlines  #Exits   Last Opts                         Source                      
                         Base/DFG/FTL/FTLOSR   Base/DFG/FTL/FTLOSR          Src/Total         Get/Put/Call
valueOf#BI9kVc    8       462/10073/89433/0     462/10073/89433/0      3       0/0       0       0/0/0     function () { return 3 }
<global>#D7oSjt  267        99506/20/0/0           99506/20/0/0        4       0/0      20       1/5/1     var sum = 0; for (var i = 0; i < 1e5; ++i) { sum +

> log <global>#D7oSjt
Compilation <global>#D7oSjt-1-Baseline:
    Total count: 3283261  Max count: 99506
Compilation <global>#D7oSjt-2-DFG:
    Total count: 120  Max count: 5
    EXIT: at bc#186 due to Uncountable, 5 times
    Jettisoned due to BaselineLoopReoptimizationTrigger
Compilation <global>#D7oSjt-3-DFG:
    Total count: 240  Max count: 10
    EXIT: at bc#186 due to Uncountable, 10 times
    Jettisoned due to BaselineLoopReoptimizationTrigger
Compilation <global>#D7oSjt-4-DFG:
    Total count: 120  Max count: 5
    EXIT: at bc#186 due to Uncountable, 5 times

> d <global>#D7oSjt-2-DFG
...
      5                     99486/20/0/0                     94:< 5:loc12>    NewObject(JS|UseAsOther, Final, %DY:Object, R:HeapObjectCount, W:HeapObjectCount, Exits, bc#99)
...
      5                     99486/20/0/0                    238:<!0:->    InvalidationPoint(MustGen, W:SideState, Exits, bc#177, exit: bc#186)
      5                     99506/20/0/0                    233:< 1:loc14>    DoubleConstant(Double|PureInt, Bytecodedouble, Double: 4611686018427387904, 2.000000, bc#186)
      5                     99506/20/0/0                    157:< 2:loc12>    ArithPow(DoubleRep:@233<Double>, Check:Int32:@94, Double|UseAsOther, Bytecodedouble, Exits, bc#186)
      5                     99506/20/0/0                         0x510434202461: mov $0x4000000000000000, %rax
      5                     99506/20/0/0                         0x51043420246b: movq %rax, %xmm0
      5                     99506/20/0/0                         0x510434202470: jmp 0x510434202725
    !!!!!                      !!!!!                                           EXIT: due to Uncountable, 5 times

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.webkit.org/pipermail/webkit-unassigned/attachments/20160520/1c588aa5/attachment.html>