Modified: trunk/Source/_javascript_Core/ChangeLog (252724 => 252725)
--- trunk/Source/_javascript_Core/ChangeLog 2019-11-21 01:48:28 UTC (rev 252724)
+++ trunk/Source/_javascript_Core/ChangeLog 2019-11-21 02:00:20 UTC (rev 252725)
@@ -1,3 +1,18 @@
+2019-11-20 Saam Barati <[email protected]>
+
+ Baseline JIT should fill in StructureStubInfo's propertyIsInt32 and the slow path should update the array profile more frequently
+ https://bugs.webkit.org/show_bug.cgi?id=204432
+
+ Reviewed by Tadeu Zagallo.
+
+ When I added inline caching for get by val, I removed code which updated the
+ ArrayProfile with some frequency. This patch adds code that does that back,
+ which recovers some of the JetStream2 regressions we are seeing.
+
+ * jit/JITOperations.cpp:
+ * jit/JITPropertyAccess.cpp:
+ (JSC::JIT::emit_op_get_by_val):
+
2019-11-20 Ross Kirsling <[email protected]>
Unreviewed, address Darin's feedback on r252683.
Modified: trunk/Source/_javascript_Core/jit/JITOperations.cpp (252724 => 252725)
--- trunk/Source/_javascript_Core/jit/JITOperations.cpp 2019-11-21 01:48:28 UTC (rev 252724)
+++ trunk/Source/_javascript_Core/jit/JITOperations.cpp 2019-11-21 02:00:20 UTC (rev 252725)
@@ -2007,9 +2007,17 @@
JSValue baseValue = JSValue::decode(encodedBase);
JSValue subscript = JSValue::decode(encodedSubscript);
+ CodeBlock* codeBlock = callFrame->codeBlock();
+
if (baseValue.isCell() && subscript.isInt32()) {
- if (stubInfo->considerCaching(vm, callFrame->codeBlock(), baseValue.structureOrNull()))
- repatchArrayGetByVal(globalObject, callFrame->codeBlock(), baseValue, subscript, *stubInfo);
+ Structure* structure = baseValue.asCell()->structure(vm);
+ if (stubInfo->considerCaching(vm, codeBlock, structure)) {
+ if (profile) {
+ ConcurrentJSLocker locker(codeBlock->m_lock);
+ profile->computeUpdatedPrediction(locker, codeBlock, structure);
+ }
+ repatchArrayGetByVal(globalObject, codeBlock, baseValue, subscript, *stubInfo);
+ }
}
if (baseValue.isCell() && isStringOrSymbol(subscript)) {
@@ -2020,7 +2028,6 @@
return JSValue::encode(baseValue.getPropertySlot(globalObject, propertyName, [&] (bool found, PropertySlot& slot) -> JSValue {
LOG_IC((ICEvent::OperationGetByValOptimize, baseValue.classInfoOrNull(vm), propertyName, baseValue == slot.slotBase()));
- CodeBlock* codeBlock = callFrame->codeBlock();
if (stubInfo->considerCaching(vm, codeBlock, baseValue.structureOrNull()))
repatchGetBy(globalObject, codeBlock, baseValue, propertyName, slot, *stubInfo, GetByKind::NormalByVal);
return found ? slot.getValue(globalObject, propertyName) : jsUndefined();
Modified: trunk/Source/_javascript_Core/jit/JITPropertyAccess.cpp (252724 => 252725)
--- trunk/Source/_javascript_Core/jit/JITPropertyAccess.cpp 2019-11-21 01:48:28 UTC (rev 252724)
+++ trunk/Source/_javascript_Core/jit/JITPropertyAccess.cpp 2019-11-21 02:00:20 UTC (rev 252725)
@@ -70,6 +70,8 @@
JITGetByValGenerator gen(
m_codeBlock, CodeOrigin(m_bytecodeIndex), CallSiteIndex(m_bytecodeIndex), RegisterSet::stubUnavailableRegisters(),
JSValueRegs(regT0), JSValueRegs(regT1), JSValueRegs(regT0));
+ if (isOperandConstantInt(property))
+ gen.stubInfo()->propertyIsInt32 = true;
gen.generateFastPath(*this);
addSlowCase(gen.slowPathJump());
m_getByVals.append(gen);
