Status: Accepted
Owner: [email protected]
CC: [email protected]
Labels: Type-Bug Priority-Medium
New issue 2330 by [email protected]: HUnknownOSRValue hinting does not
work if hint is a phi
http://code.google.com/p/v8/issues/detail?id=2330
In the test case below OSR happens in the outer loop. Hint for the
HUnknownOSRValue corresponding to the variable result is HPhi (called phi1
below) from the inner loop but its representation is inferred after
representation for the HPhi (called phi2 below) merging HUnknownOSRValue
and initial result value (0) is inferred, so hinting does not kick in and
HPhi::RepresentationInference makes phi2 an integer because it sees integer
0 coming into it (see
http://code.google.com/p/v8/source/browse/trunk/src/hydrogen-instructions.cc?r=12394#2569
for details). Then phi1 is visited and inferred to be double. This leads to
repetitive immediate deopt during the OSR because we try to convert a
double value to an integer
var func = function(x,y){
return Math.sin(x*y)/(1+Math.sqrt(x*x+y*y))+2;
}
function integrateJS(x0,xN,y0,yN,iterations){
var result = 0;
var time = new Date().getTime();
for (var i = 0; i < iterations; i++){
for (var j = 0; j < iterations; j++){
var x = x0 + (xN - x0) / iterations * i;
var y = y0 + (yN - y0) / iterations * j;
var value = func(x, y);
result+=value*(xN-x0)*(yN-y0)/(iterations*iterations);
}
}
print("JS result = "+result);
print("JS time = "+(new Date().getTime() - time));
}
integrateJS(-4,4,-4,4,1024);
integrateJS(-4,4,-4,4,1024);
∮ out/ia32.release/d8 --trace-deopt --code-comments test.js
**** DEOPT: integrateJS at bailout #31, address 0x0, frame size 216
;;; Deferred code @82: tagged-to-i.
[deoptimizing: begin 0x46045e21 integrateJS @31]
translating integrateJS => node=48, height=28
0xffb59370: [top + 64] <- 0x46044029 ; [sp + 208] 0x46044029 <JS Global
Object>
0xffb5936c: [top + 60] <- 0xfffffff8 ; [sp + 204] -4
0xffb59368: [top + 56] <- 0x00000008 ; [sp + 200] 4
0xffb59364: [top + 52] <- 0xfffffff8 ; [sp + 196] -4
0xffb59360: [top + 48] <- 0x00000008 ; [sp + 192] 4
0xffb5935c: [top + 44] <- 0x00000800 ; [sp + 188] 1024
0xffb59358: [top + 40] <- 0x47f285d9 ; caller's pc
0xffb59354: [top + 36] <- 0xffb59380 ; caller's fp
0xffb59350: [top + 32] <- 0x4603895d ; context
0xffb5934c: [top + 28] <- 0x46045e21 ; function
0xffb59348: [top + 24] <- 0x44767a49 ; [sp + 180] 0x44767a49 <Number:
0.6249895645019005>
0xffb59344: [top + 20] <- 0x44718fc5 ; [sp + 176] 0x44718fc5 <Number:
1347368696094>
0xffb59340: [top + 16] <- 0x0000000a ; [sp + 172] 5
0xffb5933c: [top + 12] <- 0x00000800 ; [sp + 168] 1024
0xffb59338: [top + 8] <- 0x44767a19 ; [sp + 164] 0x44767a19 <Number:
-3.96875>
0xffb59334: [top + 4] <- 0x44767a25 ; [sp + 160] 0x44767a25 <Number:
3.9921875>
0xffb59330: [top + 0] <- 0x44767a3d ; [sp + 156] 0x44767a3d <Number:
2.020456549890595>
[deoptimizing: end 0x46045e21 integrateJS => node=48, pc=0x47f28bde,
state=NO_REGISTERS, alignment=with padding, took 0.412 ms]
I see two ways to address this problem: either we need to visit phis in
order from innermost loops to outermost or we need to use transitive
closure of reaching values instead of a single value for hinting on the
back-edge.
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
