<html>
<head>
<base href="https://bugs.webkit.org/" />
</head>
<body><table border="1" cellspacing="0" cellpadding="8">
<tr>
<th>Bug ID</th>
<td><a class="bz_bug_link
bz_status_NEW "
title="NEW - Introduce get_by_id like IC into get_by_val when the given name is Symbol"
href="https://bugs.webkit.org/show_bug.cgi?id=147480">147480</a>
</td>
</tr>
<tr>
<th>Summary</th>
<td>Introduce get_by_id like IC into get_by_val when the given name is Symbol
</td>
</tr>
<tr>
<th>Classification</th>
<td>Unclassified
</td>
</tr>
<tr>
<th>Product</th>
<td>WebKit
</td>
</tr>
<tr>
<th>Version</th>
<td>528+ (Nightly build)
</td>
</tr>
<tr>
<th>Hardware</th>
<td>Unspecified
</td>
</tr>
<tr>
<th>OS</th>
<td>Unspecified
</td>
</tr>
<tr>
<th>Status</th>
<td>NEW
</td>
</tr>
<tr>
<th>Severity</th>
<td>Normal
</td>
</tr>
<tr>
<th>Priority</th>
<td>P2
</td>
</tr>
<tr>
<th>Component</th>
<td>JavaScriptCore
</td>
</tr>
<tr>
<th>Assignee</th>
<td>webkit-unassigned@lists.webkit.org
</td>
</tr>
<tr>
<th>Reporter</th>
<td>utatane.tea@gmail.com
</td>
</tr></table>
<p>
<div>
<pre>Current get_by_val only considers the indexed keys, it profiles ArrayMode (or checks whether the base is String), and generates vector access code in baseline JIT.
And this profiled array mode information is leveraged in DFG layer to produce the faster code.
But after ES6 symbols are used, this IC miss the optimization chance since users will use the indexed access form `object[symbol]` with non-indexed (symbol) value.
Code generated by the IC will become the following,
if (subscript != seenSymbol)
bailout;
... normal load by IC code (checking Structures and load the value with the offset)</pre>
</div>
</p>
<hr>
<span>You are receiving this mail because:</span>
<ul>
<li>You are the assignee for the bug.</li>
</ul>
</body>
</html>