[MERGE #4727 @sigatrev] Array profile data usage optimzation

sigatrev · sigatrev · commit 5ed292cf060c · 2018-02-28T11:00:22.000-08:00
Merge pull request #4727 from sigatrev:arrayOpts This commit changes usage of array profile data in an attempt to better handle certain cases (such as inlined common functions) by using the most specialized (int>float>var) array type profiled when merging profile data, unless the instruction has previous bailed out on NotNativeArray, in which case it will use the least specialized type to avoid infinite bailouts. This also fixes an infinite bailout in Ares-6 ML benchmark which was introduced by #3169
diff --git a/lib/Backend/BailOut.cpp b/lib/Backend/BailOut.cpp
@@ -1464,6 +1464,11 @@ BailOutRecord::BailOutHelper(Js::JavascriptCallStackLayout * layout, Js::ScriptF
     {
         newInstance->OrFlags(Js::InterpreterStackFrameFlags_ProcessingBailOutOnArrayAccessHelperCall);
     }
+    else if (bailOutKind == IR::BailOutOnNotNativeArray)
+    {
+        newInstance->OrFlags(Js::InterpreterStackFrameFlags_ProcessingBailOutOnArraySpecialization);
+    }
+
     if (isInlinee)
     {
         newInstance->OrFlags(Js::InterpreterStackFrameFlags_FromBailOutInInlinee);
diff --git a/lib/Backend/GlobOpt.cpp b/lib/Backend/GlobOpt.cpp
@@ -3406,20 +3406,22 @@ GlobOpt::OptSrc(IR::Opnd *opnd, IR::Instr * *pInstr, Value **indirIndexValRef, I
     {
         ValueType valueType(val->GetValueInfo()->Type());
 
-        // This block uses local profiling data to optimize the case of a native array being passed to a function that fills it with other types. When the function is inlined
-        // into different call paths which use different types this can cause a perf hit by performing unnecessary array conversions, so only perform this optimization when
-        // the function is not inlined.
-        if (valueType.IsLikelyNativeArray() && !valueType.IsObject() && instr->IsProfiledInstr() && !instr->m_func->IsInlined())
+        // This block uses per-instruction profile information on array types to optimize using the best available profile
+        // information and to prevent infinite bailouts by ensuring array type information is updated on bailouts.
+        if (valueType.IsLikelyArray() && !valueType.IsObject() && instr->IsProfiledInstr())
         {
             // See if we have profile data for the array type
             IR::ProfiledInstr *const profiledInstr = instr->AsProfiledInstr();
             ValueType profiledArrayType;
+
+            bool useAggressiveSpecialization = true;
             switch(instr->m_opcode)
             {
                 case Js::OpCode::LdElemI_A:
                     if(instr->GetSrc1()->IsIndirOpnd() && opnd == instr->GetSrc1()->AsIndirOpnd()->GetBaseOpnd())
                     {
                         profiledArrayType = profiledInstr->u.ldElemInfo->GetArrayType();
+                        useAggressiveSpecialization = !profiledInstr->u.ldElemInfo->IsAggressiveSpecializationDisabled();
                     }
                     break;
 
@@ -3429,23 +3431,36 @@ GlobOpt::OptSrc(IR::Opnd *opnd, IR::Instr * *pInstr, Value **indirIndexValRef, I
                     if(instr->GetDst()->IsIndirOpnd() && opnd == instr->GetDst()->AsIndirOpnd()->GetBaseOpnd())
                     {
                         profiledArrayType = profiledInstr->u.stElemInfo->GetArrayType();
+                        useAggressiveSpecialization = !profiledInstr->u.stElemInfo->IsAggressiveSpecializationDisabled();
                     }
                     break;
 
                 case Js::OpCode::LdLen_A:
                     if(instr->GetSrc1()->IsRegOpnd() && opnd == instr->GetSrc1())
                     {
                         profiledArrayType = profiledInstr->u.LdLenInfo().GetArrayType();
+                        useAggressiveSpecialization = !profiledInstr->u.LdLenInfo().IsAggressiveSpecializationDisabled();
                     }
                     break;
             }
-            if(profiledArrayType.IsLikelyObject() &&
-                profiledArrayType.GetObjectType() == valueType.GetObjectType() &&
-                (profiledArrayType.HasVarElements() || (valueType.HasIntElements() && profiledArrayType.HasFloatElements())))
+
+            if (profiledArrayType.IsLikelyObject() && profiledArrayType.GetObjectType() == valueType.GetObjectType())
             {
-                // Merge array type we pulled from profile with type propagated by dataflow.
-                valueType = valueType.Merge(profiledArrayType).SetHasNoMissingValues(valueType.HasNoMissingValues());
-                ChangeValueType(this->currentBlock, CurrentBlockData()->FindValue(opnd->AsRegOpnd()->m_sym), valueType, false);
+                // Ideally we want to use the most specialized type seen by this path, but when that causes bailouts use the least specialized type instead.
+                if (useAggressiveSpecialization && !valueType.IsLikelyNativeIntArray() &&
+                    (profiledArrayType.HasIntElements() || (valueType.HasVarElements() && profiledArrayType.HasFloatElements())))
+                {
+                    // use the more specialized type profiled by the instruction.
+                    valueType = profiledArrayType.SetHasNoMissingValues(valueType.HasNoMissingValues());
+                    ChangeValueType(this->currentBlock, CurrentBlockData()->FindValue(opnd->AsRegOpnd()->m_sym), valueType, false);
+                }
+                else if (!useAggressiveSpecialization && valueType.IsLikelyNativeArray() &&
+                    (profiledArrayType.HasVarElements() || (valueType.HasIntElements() && profiledArrayType.HasFloatElements())))
+                {
+                    // Merge array type we pulled from profile with type propagated by dataflow.
+                    valueType = valueType.Merge(profiledArrayType).SetHasNoMissingValues(valueType.HasNoMissingValues());
+                    ChangeValueType(this->currentBlock, CurrentBlockData()->FindValue(opnd->AsRegOpnd()->m_sym), valueType, false);
+                }
             }
         }
 
@@ -13391,11 +13406,9 @@ GlobOpt::OptArraySrc(IR::Instr * *const instrRef)
                 if (!baseValueInLoopLandingPad->GetValueInfo()->CanMergeToSpecificObjectType())
                 {
                     ValueType landingPadValueType = baseValueInLoopLandingPad->GetValueInfo()->Type();
-                    Assert(landingPadValueType.IsSimilar(baseValueType) ||
-                        (
-                            landingPadValueType.IsLikelyNativeArray() &&
-                            landingPadValueType.Merge(baseValueType).IsSimilar(baseValueType)
-                        )
+                    Assert(landingPadValueType.IsSimilar(baseValueType) 
+                        || (landingPadValueType.IsLikelyNativeArray() && landingPadValueType.Merge(baseValueType).IsSimilar(baseValueType))
+                        || (baseValueType.IsLikelyNativeArray() && baseValueType.Merge(landingPadValueType).IsSimilar(landingPadValueType))
                     );
                 }
 #endif
diff --git a/lib/Backend/IRBuilder.cpp b/lib/Backend/IRBuilder.cpp
@@ -4482,9 +4482,10 @@ IRBuilder::BuildProfiledElementCP(Js::OpCode newOpcode, uint32 offset, Js::RegSl
 
     ValueType arrayType = ValueType::Uninitialized;
 
+    const Js::LdLenInfo * ldLenInfo = nullptr;
     if (m_func->HasProfileInfo())
     {
-        const Js::LdLenInfo * ldLenInfo = m_func->GetReadOnlyProfileInfo()->GetLdLenInfo(profileId);
+        ldLenInfo = m_func->GetReadOnlyProfileInfo()->GetLdLenInfo(profileId);
         arrayType = (ldLenInfo->GetArrayType());
         if (arrayType.IsLikelyNativeArray() &&
             (
@@ -4522,7 +4523,8 @@ IRBuilder::BuildProfiledElementCP(Js::OpCode newOpcode, uint32 offset, Js::RegSl
         IR::ProfiledInstr * profiledInstr = IR::ProfiledInstr::New(newOpcode, dstOpnd, fieldSymOpnd, m_func);
         instr = profiledInstr;
         profiledInstr->u.FldInfo() = *(m_func->GetReadOnlyProfileInfo()->GetFldInfo(inlineCacheIndex));
-        profiledInstr->u.LdLenInfo().GetArrayType() = arrayType;
+        profiledInstr->u.LdLenInfo() = *ldLenInfo;
+        profiledInstr->u.LdLenInfo().arrayType = arrayType;
         wasNotProfiled = !profiledInstr->u.FldInfo().WasLdFldProfiled();
         dstOpnd->SetValueType(instr->AsProfiledInstr()->u.FldInfo().valueType);
 #if ENABLE_DEBUG_CONFIG_OPTIONS
diff --git a/lib/Backend/JITTimeProfileInfo.cpp b/lib/Backend/JITTimeProfileInfo.cpp
@@ -25,6 +25,7 @@ JITTimeProfileInfo::InitializeJITProfileData(
         return;
     }
 
+    CompileAssert(sizeof(LdLenIDL) == sizeof(Js::LdLenInfo));
     CompileAssert(sizeof(LdElemIDL) == sizeof(Js::LdElemInfo));
     CompileAssert(sizeof(StElemIDL) == sizeof(Js::StElemInfo));
 
diff --git a/lib/Backend/Lower.cpp b/lib/Backend/Lower.cpp
@@ -8696,11 +8696,13 @@ void Lowerer::LowerProfiledLdElemI(IR::JitProfilingInstr *const instr)
             const Var varIndex,
             FunctionBody *const functionBody,
             const ProfileId profileId,
-            bool didArrayAccessHelperCall)
+            bool didArrayAccessHelperCall,
+            bool bailedOutOnArraySpecialization)
     */
 
     Func *const func = instr->m_func;
 
+    m_lowererMD.LoadHelperArgument(instr, IR::IntConstOpnd::New(false, TyInt8, func));
     m_lowererMD.LoadHelperArgument(instr, IR::IntConstOpnd::New(false, TyInt8, func));
     m_lowererMD.LoadHelperArgument(instr, IR::Opnd::CreateProfileIdOpnd(instr->profileId, func));
     m_lowererMD.LoadHelperArgument(instr, CreateFunctionBodyOpnd(func));
@@ -8731,7 +8733,8 @@ void Lowerer::LowerProfiledStElemI(IR::JitProfilingInstr *const instr, const Js:
             FunctionBody *const functionBody,
             const ProfileId profileId,
             const PropertyOperationFlags flags,
-            bool didArrayAccessHelperCall)
+            bool didArrayAccessHelperCall,
+            bool bailedOutOnArraySpecialization)
     */
 
     Func *const func = instr->m_func;
@@ -8745,6 +8748,7 @@ void Lowerer::LowerProfiledStElemI(IR::JitProfilingInstr *const instr, const Js:
     {
         helper = IR::HelperProfiledStElem;
         m_lowererMD.LoadHelperArgument(instr, IR::IntConstOpnd::New(false, TyInt8, func));
+        m_lowererMD.LoadHelperArgument(instr, IR::IntConstOpnd::New(false, TyInt8, func));
         m_lowererMD.LoadHelperArgument(instr, IR::IntConstOpnd::New(flags, TyInt32, func, true));
     }
     m_lowererMD.LoadHelperArgument(instr, IR::Opnd::CreateProfileIdOpnd(instr->profileId, func));
diff --git a/lib/JITIDL/JITTypes.h b/lib/JITIDL/JITTypes.h
@@ -243,6 +243,8 @@ typedef struct ArrayCallSiteIDL
 typedef struct LdLenIDL
 {
     unsigned short arrayType;
+    byte bits;
+    IDL_PAD1(0)
 } LdLenIDL;
 
 typedef struct LdElemIDL
diff --git a/lib/Runtime/Language/DynamicProfileInfo.h b/lib/Runtime/Language/DynamicProfileInfo.h
@@ -179,10 +179,23 @@ namespace Js
 
     struct LdLenInfo
     {
-        typedef struct { ValueType::TSize f1; } TSize;
+        typedef struct { ValueType::TSize f1; byte f2; } TSize;
 
         ValueType arrayType;
 
+        union
+        {
+            struct
+            {
+                bool disableAggressiveSpecialization : 1;
+            };
+            byte bits;
+        };
+
+        LdLenInfo() : bits(0)
+        {
+        }
+
         void Merge(const LdLenInfo & other)
         {
             arrayType = arrayType.Merge(other.arrayType);
@@ -192,6 +205,11 @@ namespace Js
         {
             return arrayType;
         }
+
+        bool IsAggressiveSpecializationDisabled() const
+        {
+            return disableAggressiveSpecialization;
+        }
     };
     CompileAssert(sizeof(LdLenInfo::TSize) == sizeof(LdLenInfo));
 
@@ -206,6 +224,7 @@ namespace Js
             {
                 bool wasProfiled : 1;
                 bool neededHelperCall : 1;
+                bool disableAggressiveSpecialization : 1;
             };
             byte bits;
         };
@@ -241,6 +260,11 @@ namespace Js
         {
             return neededHelperCall;
         }
+
+        bool IsAggressiveSpecializationDisabled() const
+        {
+            return disableAggressiveSpecialization;
+        }
     };
 
     struct StElemInfo
@@ -257,6 +281,7 @@ namespace Js
                 bool neededHelperCall : 1;
                 bool storedOutsideHeadSegmentBounds : 1;
                 bool storedOutsideArrayBounds : 1;
+                bool disableAggressiveSpecialization : 1;
             };
             byte bits;
         };
@@ -306,6 +331,11 @@ namespace Js
         {
             return storedOutsideArrayBounds;
         }
+
+        bool IsAggressiveSpecializationDisabled() const
+        {
+            return disableAggressiveSpecialization;
+        }
     };
 
     struct ArrayCallSiteInfo
diff --git a/lib/Runtime/Language/InterpreterStackFrame.cpp b/lib/Runtime/Language/InterpreterStackFrame.cpp
@@ -4977,9 +4977,10 @@ namespace Js
                 GetReg(playout->Element),
                 m_functionBody,
                 playout->profileId,
-                this->TestFlags(InterpreterStackFrameFlags_ProcessingBailOutOnArrayAccessHelperCall)));
+                this->TestFlags(InterpreterStackFrameFlags_ProcessingBailOutOnArrayAccessHelperCall),
+                this->TestFlags(InterpreterStackFrameFlags_ProcessingBailOutOnArraySpecialization)));
 
-        this->ClearFlags(InterpreterStackFrameFlags_ProcessingBailOutOnArrayAccessHelperCall);
+        this->ClearFlags(InterpreterStackFrameFlags_ProcessingBailOutOnArrayAccessHelperCall | InterpreterStackFrameFlags_ProcessingBailOutOnArraySpecialization);
 
         threadContext->CheckAndResetImplicitCallAccessorFlag();
         threadContext->AddImplicitCallFlags(savedImplicitCallFlags);
@@ -5077,9 +5078,10 @@ namespace Js
             m_functionBody,
             playout->profileId,
             flags,
-            this->TestFlags(InterpreterStackFrameFlags_ProcessingBailOutOnArrayAccessHelperCall));
+            this->TestFlags(InterpreterStackFrameFlags_ProcessingBailOutOnArrayAccessHelperCall),
+            this->TestFlags(InterpreterStackFrameFlags_ProcessingBailOutOnArraySpecialization));
 
-        this->ClearFlags(InterpreterStackFrameFlags_ProcessingBailOutOnArrayAccessHelperCall);
+        this->ClearFlags(InterpreterStackFrameFlags_ProcessingBailOutOnArrayAccessHelperCall | InterpreterStackFrameFlags_ProcessingBailOutOnArraySpecialization);
 
         threadContext->CheckAndResetImplicitCallAccessorFlag();
         threadContext->AddImplicitCallFlags(savedImplicitCallFlags);
@@ -8412,6 +8414,12 @@ const byte * InterpreterStackFrame::OP_ProfiledLoopBodyStart(uint loopId)
         ldLenInfo.arrayType = ValueType::Uninitialized.Merge(instance);
         profileData->RecordLengthLoad(functionBody, playout->profileId, ldLenInfo);
 
+        if (this->TestFlags(InterpreterStackFrameFlags_ProcessingBailOutOnArraySpecialization))
+        {
+            ldLenInfo.disableAggressiveSpecialization = true;
+            this->ClearFlags(InterpreterStackFrameFlags_ProcessingBailOutOnArraySpecialization);
+        }
+
         ThreadContext* threadContext = this->GetScriptContext()->GetThreadContext();
         ImplicitCallFlags savedImplicitCallFlags = threadContext->GetImplicitCallFlags();
         threadContext->ClearImplicitCallFlags();
diff --git a/lib/Runtime/Language/InterpreterStackFrame.h b/lib/Runtime/Language/InterpreterStackFrame.h
@@ -28,6 +28,7 @@ namespace Js
         InterpreterStackFrameFlags_ProcessingBailOutOnArrayAccessHelperCall = 0x10,
         InterpreterStackFrameFlags_ProcessingBailOutFromEHCode = 0x20,
         InterpreterStackFrameFlags_FromBailOutInInlinee = 0x40,
+        InterpreterStackFrameFlags_ProcessingBailOutOnArraySpecialization = 0x80,
         InterpreterStackFrameFlags_All = 0xFFFF,
     };
 
diff --git a/lib/Runtime/Language/ProfilingHelpers.cpp b/lib/Runtime/Language/ProfilingHelpers.cpp
@@ -12,7 +12,8 @@ namespace Js
         const Var varIndex,
         FunctionBody *const functionBody,
         const ProfileId profileId,
-        bool didArrayAccessHelperCall)
+        bool didArrayAccessHelperCall,
+        bool bailedOutOnArraySpecialization)
     {
         Assert(base);
         Assert(varIndex);
@@ -21,6 +22,11 @@ namespace Js
 
         LdElemInfo ldElemInfo;
 
+        if (bailedOutOnArraySpecialization)
+        {
+            ldElemInfo.disableAggressiveSpecialization = true;
+        }
+
         // Only enable fast path if the javascript array is not cross site
 #if ENABLE_COPYONACCESS_ARRAY
         JavascriptLibrary::CheckAndConvertCopyOnAccessNativeIntArray<Var>(base);
@@ -197,7 +203,7 @@ namespace Js
         FunctionBody *const functionBody,
         const ProfileId profileId)
     {
-        ProfiledStElem(base, varIndex, value, functionBody, profileId, PropertyOperation_None, false);
+        ProfiledStElem(base, varIndex, value, functionBody, profileId, PropertyOperation_None, false, false);
     }
 
     void ProfilingHelpers::ProfiledStElem(
@@ -207,7 +213,8 @@ namespace Js
         FunctionBody *const functionBody,
         const ProfileId profileId,
         const PropertyOperationFlags flags,
-        bool didArrayAccessHelperCall)
+        bool didArrayAccessHelperCall,
+        bool bailedOutOnArraySpecialization)
     {
         Assert(base);
         Assert(varIndex);
@@ -217,6 +224,11 @@ namespace Js
 
         StElemInfo stElemInfo;
 
+        if (bailedOutOnArraySpecialization)
+        {
+            stElemInfo.disableAggressiveSpecialization = true;
+        }
+
         // Only enable fast path if the javascript array is not cross site
         const bool isJsArray = !TaggedNumber::Is(base) && VirtualTableInfo<JavascriptArray>::HasVirtualTable(base);
         ScriptContext *const scriptContext = functionBody->GetScriptContext();
diff --git a/lib/Runtime/Language/ProfilingHelpers.h b/lib/Runtime/Language/ProfilingHelpers.h
@@ -10,12 +10,12 @@ namespace Js
     class ProfilingHelpers
     {
     public:
-        static Var ProfiledLdElem(const Var base, const Var varIndex, FunctionBody *const functionBody, const ProfileId profileId, bool didArrayAccessHelperCall);
+        static Var ProfiledLdElem(const Var base, const Var varIndex, FunctionBody *const functionBody, const ProfileId profileId, bool didArrayAccessHelperCall, bool bailedOutOnArraySpecialization);
         static Var ProfiledLdElem_FastPath(JavascriptArray *const array, const Var varIndex, ScriptContext *const scriptContext, LdElemInfo *const ldElemInfo = nullptr);
 
     public:
         static void ProfiledStElem_DefaultFlags(const Var base, const Var varIndex, const Var value, FunctionBody *const functionBody, const ProfileId profileId);
-        static void ProfiledStElem(const Var base, const Var varIndex, const Var value, FunctionBody *const functionBody, const ProfileId profileId, const PropertyOperationFlags flags, bool didArrayAccessHelperCall);
+        static void ProfiledStElem(const Var base, const Var varIndex, const Var value, FunctionBody *const functionBody, const ProfileId profileId, const PropertyOperationFlags flags, bool didArrayAccessHelperCall, bool bailedOutOnArraySpecialization);
         static void ProfiledStElem_FastPath(JavascriptArray *const array, const Var varIndex, const Var value, ScriptContext *const scriptContext, const PropertyOperationFlags flags, StElemInfo *const stElemInfo = nullptr);
 
     public:

Original file line number	Diff line number	Diff line change
`@@ -1464,6 +1464,11 @@ BailOutRecord::BailOutHelper(Js::JavascriptCallStackLayout * layout, Js::ScriptF`
`1464`	`1464`	`{`
`1465`	`1465`	`newInstance->OrFlags(Js::InterpreterStackFrameFlags_ProcessingBailOutOnArrayAccessHelperCall);`
`1466`	`1466`	`}`
	`1467`	`+ else if (bailOutKind == IR::BailOutOnNotNativeArray)`
	`1468`	`+ {`
	`1469`	`+ newInstance->OrFlags(Js::InterpreterStackFrameFlags_ProcessingBailOutOnArraySpecialization);`
	`1470`	`+ }`
	`1471`	`+`
`1467`	`1472`	`if (isInlinee)`
`1468`	`1473`	`{`
`1469`	`1474`	`newInstance->OrFlags(Js::InterpreterStackFrameFlags_FromBailOutInInlinee);`
Original file line number	Diff line number	Diff line change
`@@ -3406,20 +3406,22 @@ GlobOpt::OptSrc(IR::Opnd opnd, IR::Instr pInstr, Value *indirIndexValRef, I`
`3406`	`3406`	`{`
`3407`	`3407`	`ValueType valueType(val->GetValueInfo()->Type());`
`3408`	`3408`
`3409`		`- // This block uses local profiling data to optimize the case of a native array being passed to a function that fills it with other types. When the function is inlined`
`3410`		`- // into different call paths which use different types this can cause a perf hit by performing unnecessary array conversions, so only perform this optimization when`
`3411`		`- // the function is not inlined.`
`3412`		`- if (valueType.IsLikelyNativeArray() && !valueType.IsObject() && instr->IsProfiledInstr() && !instr->m_func->IsInlined())`
	`3409`	`+ // This block uses per-instruction profile information on array types to optimize using the best available profile`
	`3410`	`+ // information and to prevent infinite bailouts by ensuring array type information is updated on bailouts.`
	`3411`	`+ if (valueType.IsLikelyArray() && !valueType.IsObject() && instr->IsProfiledInstr())`
`3413`	`3412`	`{`
`3414`	`3413`	`// See if we have profile data for the array type`
`3415`	`3414`	`IR::ProfiledInstr *const profiledInstr = instr->AsProfiledInstr();`
`3416`	`3415`	`ValueType profiledArrayType;`
	`3416`	`+`
	`3417`	`+ bool useAggressiveSpecialization = true;`
`3417`	`3418`	`switch(instr->m_opcode)`
`3418`	`3419`	`{`
`3419`	`3420`	`case Js::OpCode::LdElemI_A:`
`3420`	`3421`	`if(instr->GetSrc1()->IsIndirOpnd() && opnd == instr->GetSrc1()->AsIndirOpnd()->GetBaseOpnd())`
`3421`	`3422`	`{`
`3422`	`3423`	`profiledArrayType = profiledInstr->u.ldElemInfo->GetArrayType();`
	`3424`	`+ useAggressiveSpecialization = !profiledInstr->u.ldElemInfo->IsAggressiveSpecializationDisabled();`
`3423`	`3425`	`}`
`3424`	`3426`	`break;`
`3425`	`3427`
`@@ -3429,23 +3431,36 @@ GlobOpt::OptSrc(IR::Opnd opnd, IR::Instr pInstr, Value *indirIndexValRef, I`
`3429`	`3431`	`if(instr->GetDst()->IsIndirOpnd() && opnd == instr->GetDst()->AsIndirOpnd()->GetBaseOpnd())`
`3430`	`3432`	`{`
`3431`	`3433`	`profiledArrayType = profiledInstr->u.stElemInfo->GetArrayType();`
	`3434`	`+ useAggressiveSpecialization = !profiledInstr->u.stElemInfo->IsAggressiveSpecializationDisabled();`
`3432`	`3435`	`}`
`3433`	`3436`	`break;`
`3434`	`3437`
`3435`	`3438`	`case Js::OpCode::LdLen_A:`
`3436`	`3439`	`if(instr->GetSrc1()->IsRegOpnd() && opnd == instr->GetSrc1())`
`3437`	`3440`	`{`
`3438`	`3441`	`profiledArrayType = profiledInstr->u.LdLenInfo().GetArrayType();`
	`3442`	`+ useAggressiveSpecialization = !profiledInstr->u.LdLenInfo().IsAggressiveSpecializationDisabled();`
`3439`	`3443`	`}`
`3440`	`3444`	`break;`
`3441`	`3445`	`}`
`3442`		`- if(profiledArrayType.IsLikelyObject() &&`
`3443`		`- profiledArrayType.GetObjectType() == valueType.GetObjectType() &&`
`3444`		`- (profiledArrayType.HasVarElements() \|\| (valueType.HasIntElements() && profiledArrayType.HasFloatElements())))`
	`3446`	`+`
	`3447`	`+ if (profiledArrayType.IsLikelyObject() && profiledArrayType.GetObjectType() == valueType.GetObjectType())`
`3445`	`3448`	`{`
`3446`		`- // Merge array type we pulled from profile with type propagated by dataflow.`
`3447`		`- valueType = valueType.Merge(profiledArrayType).SetHasNoMissingValues(valueType.HasNoMissingValues());`
`3448`		`- ChangeValueType(this->currentBlock, CurrentBlockData()->FindValue(opnd->AsRegOpnd()->m_sym), valueType, false);`
	`3449`	`+ // Ideally we want to use the most specialized type seen by this path, but when that causes bailouts use the least specialized type instead.`
	`3450`	`+ if (useAggressiveSpecialization && !valueType.IsLikelyNativeIntArray() &&`
	`3451`	`+ (profiledArrayType.HasIntElements() \|\| (valueType.HasVarElements() && profiledArrayType.HasFloatElements())))`
	`3452`	`+ {`
	`3453`	`+ // use the more specialized type profiled by the instruction.`
	`3454`	`+ valueType = profiledArrayType.SetHasNoMissingValues(valueType.HasNoMissingValues());`
	`3455`	`+ ChangeValueType(this->currentBlock, CurrentBlockData()->FindValue(opnd->AsRegOpnd()->m_sym), valueType, false);`
	`3456`	`+ }`
	`3457`	`+ else if (!useAggressiveSpecialization && valueType.IsLikelyNativeArray() &&`
	`3458`	`+ (profiledArrayType.HasVarElements() \|\| (valueType.HasIntElements() && profiledArrayType.HasFloatElements())))`
	`3459`	`+ {`
	`3460`	`+ // Merge array type we pulled from profile with type propagated by dataflow.`
	`3461`	`+ valueType = valueType.Merge(profiledArrayType).SetHasNoMissingValues(valueType.HasNoMissingValues());`
	`3462`	`+ ChangeValueType(this->currentBlock, CurrentBlockData()->FindValue(opnd->AsRegOpnd()->m_sym), valueType, false);`
	`3463`	`+ }`
`3449`	`3464`	`}`
`3450`	`3465`	`}`
`3451`	`3466`
`@@ -13391,11 +13406,9 @@ GlobOpt::OptArraySrc(IR::Instr * *const instrRef)`
`13391`	`13406`	`if (!baseValueInLoopLandingPad->GetValueInfo()->CanMergeToSpecificObjectType())`
`13392`	`13407`	`{`
`13393`	`13408`	`ValueType landingPadValueType = baseValueInLoopLandingPad->GetValueInfo()->Type();`
`13394`		`- Assert(landingPadValueType.IsSimilar(baseValueType) \|\|`
`13395`		`- (`
`13396`		`- landingPadValueType.IsLikelyNativeArray() &&`
`13397`		`- landingPadValueType.Merge(baseValueType).IsSimilar(baseValueType)`
`13398`		`- )`
	`13409`	`+ Assert(landingPadValueType.IsSimilar(baseValueType)`
	`13410`	`+ \|\| (landingPadValueType.IsLikelyNativeArray() && landingPadValueType.Merge(baseValueType).IsSimilar(baseValueType))`
	`13411`	`+ \|\| (baseValueType.IsLikelyNativeArray() && baseValueType.Merge(landingPadValueType).IsSimilar(landingPadValueType))`
`13399`	`13412`	`);`
`13400`	`13413`	`}`
`13401`	`13414`	`#endif`
Original file line number	Diff line number	Diff line change
`@@ -25,6 +25,7 @@ JITTimeProfileInfo::InitializeJITProfileData(`
`25`	`25`	`return;`
`26`	`26`	`}`
`27`	`27`
	`28`	`+ CompileAssert(sizeof(LdLenIDL) == sizeof(Js::LdLenInfo));`
`28`	`29`	`CompileAssert(sizeof(LdElemIDL) == sizeof(Js::LdElemInfo));`
`29`	`30`	`CompileAssert(sizeof(StElemIDL) == sizeof(Js::StElemInfo));`
`30`	`31`
Original file line number	Diff line number	Diff line change
`@@ -243,6 +243,8 @@ typedef struct ArrayCallSiteIDL`
`243`	`243`	`typedef struct LdLenIDL`
`244`	`244`	`{`
`245`	`245`	`unsigned short arrayType;`
	`246`	`+ byte bits;`
	`247`	`+ IDL_PAD1(0)`
`246`	`248`	`} LdLenIDL;`
`247`	`249`
`248`	`250`	`typedef struct LdElemIDL`