Stats around the common cases of native function bail-out

[trueadm]

I did some analysis of our internal bundle in relation to CallExpression bail-out in pure scope to see the most common internal NativeFunctionValue bail-outs. This should point us in the direction of where we might add more internal abstract evaluation support.

RegExp.prototype.test 275
Array.prototype.indexOf 201  //  <-- handled with unknown arrays
parseInt 176
Math.abs 58
Array.prototype.concat 19  //  <-- handled with unknown arrays
Array.prototype.filter 15  //  <-- handled with unknown arrays
Math.log10 12
JSON.stringify 9
Math.floor 4
Boolean 3
Math.min 2
isNaN 2
String.prototype.replace 1

It's also interesting that none of the above functions mutate or have side-effects in almost all cases, yet we still havoc/leak the values passed to them, which very non-optimal.

[calebmer]

You can also look at some of the stacks I posted in #2297 for more ideas of what’s commonly executed against test262 (although that is less representative of user code). Like this one.

Two big ones:

__abstract().prop;
Object.defineProperty(o, __abstract(), {});