New issue
Advanced search Search tips

Issue 6969 link

Starred by 1 user

Issue metadata

Status: Fixed
Closed: Oct 2017
HW: All
NextAction: ----
OS: All
Priority: 1
Type: Bug

issue 6936

Sign in to add a comment

Constantly missing on KeyedLoadIC

Project Member Reported by, Oct 20 2017

Issue description

This is probably related to , likely the same underlying issue.

In the buble test case of the web-tooling-benchmark we see a lot of 1->1 misses on certain KeyedLoadICs, for example

KeyedLoadIC (1->1) at ~contains wtb-buble.js:39264:27 arguments (map 0x18f7f63860d1)

happens around 1316 times in a usual run, where we clearly don't learn in the IC. This seems to be related to ThinStrings and not handling them in the PolymorphicName case.

Since TurboFan relies on the IC feedback, we also unnecessarily optimize and deoptimize functions inlining contains quite often.
Project Member

Comment 1 by, Oct 20 2017

The following revision refers to this bug:

commit d5c19aa9fc536638b4d3831ba01cf0f1a6a05bbe
Author: Benedikt Meurer <>
Date: Fri Oct 20 12:16:10 2017

[ic] Ensure that we make progress on KeyedLoadIC polymorphic name.

In the special case of KeyedLoadIC, where the key that is passed in is a
Name that is always the same we only checked for identity in both the
stub and the TurboFan case, which works fine for symbols and internalized
strings, but doesn't really work with non-internalized strings, where
the identity check will fail, the runtime will internalize the string,
and the IC will then see the original internalized string again and not
progress in the feedback lattice. This leads to tricky deoptimization
loops in TurboFan and constantly missing ICs.

This adds fixes the stub to always try to internalize strings first
when the identity check fails and then doing the check again. If the
name is not found in the string table we miss, since in that case the
string cannot match the previously recorded feedback name (which is
always a unique name).

In TurboFan we represent this checks with new CheckEqualsSymbol and
CheckEqualsInternalizedString operators, which validate the previously
recorded feedback, and the CheckEqualsInternalizedString operator does
the attempt to internalize the input.

Bug: v8:6936,  v8:6948 ,  v8:6969 
Change-Id: I3f3b4a587c67f00f7c4b60d239eb98a9626fe04a
Reviewed-by: Toon Verwaest <>
Reviewed-by: Jaroslav Sevcik <>
Commit-Queue: Benedikt Meurer <>
Cr-Commit-Position: refs/heads/master@{#48784}

Status: Fixed (was: Started)

Sign in to add a comment