jit hacking

Benchmark created by naugtur on

Description

Is it possible to fool method jit to think a function is hot by calling it with an attribute that causes it to skip the hard working?

This will not fool the tracing jit in firefox for sure, but seems to work in chrome

Preparation HTML

<script>
  var payload=[123,123,123,123,12,312,312,31,231,23,12,312,312,31,23,123,12,312,31,231,23,123,123,12,312,31,23,123,12,312,31,231,23,123,12,312,31,23,123,123,12,31,231,23,12,312,31,23,12,31,231,23,123,12,31,23,123,12,31,231,23,12,31,231,23,123,12,31,23,12,312,31,23,12,312,31,23,12,312,31,23,1323,12,31,23,12,312,31,23,12,31,23,12,312,3,12,312,31,23,123,12,31,23,12,312,31,23,123,12,31,23,12,31,231,23,12,31,23,1]
  payload.concat(payload,payload,payload);
  
  function f1(skip){
  if(skip){ return }
  var a='';
  for(var i=0;i<payload.length;i+=1){
    a+=payload[i]*888;
    }
  }
  
  function f2(skip){
  if(skip){ return }
  var a='';
  for(var i=0;i<payload.length;i+=1){
    a+=payload[i]*888;
    }
  }
  
  function f3(skip){
  if(skip){ return }
  var a='';
  for(var i=0;i<payload.length;i+=1){
    a+=payload[i]*888;
    }
  }
  
  for(var q=0;q<50000;q+=1){
  f2(true);//fast way to heat up
  }
  for(var q=0;q<50000;q+=1){
  f3();//just like normal use
  }
</script>

Test runner

Ready to run.

Testing in
TestOps/sec
no hack
f1();
ready
with hack
f2();
ready
control if jit works as I guessed
f3();
ready

Revisions

You can edit these tests or add more tests to this page by appending /edit to the URL.

  • Revision 1: published by naugtur on