Perf: Too many bailouts/rejits for FailedTagCheck

[kunalspathak]

For below test case, we keep bailing out and rejitting for same reason.

function test(object) {
    var value = object.x;
    if (value && value.test) { // bailout happens here 
        value.test();
    }
    return value;
}

for (var i = 0; i < 40000; i++) {
    var obj = {};
    if (i == 0) {
        obj.x = {};
    } else {
        obj.x = 1;
    }
    test(obj);
}
print('done');

$ ch e:\temp\test.js -mic:1 -off:Simplejit -stats:rejit
done
Bailout Reason,                           Count
BailOutOnTaggedValue,                     39999
TOTAL,                                    39999


Rejit Reason,                             Count
FailedTagCheck,                             100
TOTAL,                                      100

[kunalspathak]

//cc - @rajatd , @satheeshravi , @LouisLaf , @pleath

[rajatd]

The problem here is that when we bailout to a LdFld, we only update the value type of the result of LdFld. In the case of BailOutOnTaggedValue, we are bailing out because the object from which we tried to load a property, is a tagged value. So, we bail out, execute LdFld in the interpreter but fail to update the bad profile data that caused the bailout in the first place.