RESOLVED FIXED 99261
Baseline array profiling should be less accurate, and DFG OSR exit should update array profiles on CheckArray and CheckStructure failure 
https://bugs.webkit.org/show_bug.cgi?id=99261
Summary Baseline array profiling should be less accurate, and DFG OSR exit should upd...
Filip Pizlo
Reported 2012-10-13 23:07:46 PDT
This would make our various mechanisms of array speculation work as well as all of our other speculation modes.
Attachments
the patch (22.97 KB, patch)
2012-10-18 15:15 PDT, Filip Pizlo 		oliver: review+
DetailsFormatted DiffDiff
View All Add attachment proposed patch, testcase, etc.
Filip Pizlo
Comment 1 2012-10-14 16:32:37 PDT
It appears that this might just work already. If we exit due to an invalid structure on an array access, then the baseline JIT will log *only* the invalid structure(s) in the array profile. Subsequent recompiles will see only one of the invalid structures, and LUBing will conclude that the structure has gone polymorphic. I will keep this open for now, but I suspect that this is not really a bug. I mean, it could be good to unify how speculations work and make everything use OSR exit profiling, but this doesn't really smell like a bug right now.
Filip Pizlo
Comment 2 2012-10-18 14:29:30 PDT
Actually. Right now array profiles are too accurate. They will catch *every* array type that flows through them, when what we really want is for them to catch the high probability array types. Renaming the bug.
Filip Pizlo
Comment 3 2012-10-18 15:15:03 PDT
Created attachment 169483 [details] the patch
Filip Pizlo
Comment 4 2012-10-19 12:47:13 PDT
Landed in http://trac.webkit.org/changeset/131868
Note You need to log in before you can comment on or make changes to this bug.