[JSC] Air does not appropriately propagate ConstFloatValue to stackmap
authorysuzuki@apple.com <ysuzuki@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Thu, 15 Aug 2019 06:39:28 +0000 (06:39 +0000)
committerysuzuki@apple.com <ysuzuki@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Thu, 15 Aug 2019 06:39:28 +0000 (06:39 +0000)
commit2c05692e93f71bb3a9f9057bec631d05a891050a
tree10211e6cf90b858fc7d0c74b09e2e95610f4f2fa
parentf43b1e47629e2fd643a45fbd34e4896b24ad7361
[JSC] Air does not appropriately propagate ConstFloatValue to stackmap
https://bugs.webkit.org/show_bug.cgi?id=200759

Reviewed by Saam Barati.

In B3MoveConstant phase, we convert ConstFloatValue and ConstDoubleValue to memory access to the table
to avoid large immediates *except for* stackmap argument case. This is because materializing constant doubles
and floats as memory-access before passing it to stackmap is wasteful: the stackmap may not use it actually, or
stackmap can do better job if it knows the parameter is constant.

Based on the above operation, B3LowerToAir phase strongly assumes that all ConstFloatValue and ConstDoubleValue
are removed except for the case used for parameter of stackmap. With r192377, B3LowerToAir catch this case, and
propagate constant double value as ValueRep in stackmap. While B3LowerToAir does this correctly for ConstDoubleValue,
we missed adding this support for ConstFloatValue.

This patch adds r192377's support for ConstFloatValue to propagate ConstFloatValue correctly to the stackmap.
This issue starts appearing since Wasm BBQ-B3 OSR starts putting ConstFloatValue to OSR-tier-up patchpoint.

* b3/B3LowerToAir.cpp:
* b3/B3ValueKey.h:
(JSC::B3::ValueKey::ValueKey):
(JSC::B3::ValueKey::floatValue const):
* b3/B3ValueRep.h:
(JSC::B3::ValueRep::constantFloat):
(JSC::B3::ValueRep::floatValue const):
* b3/testb3.h:
* b3/testb3_1.cpp:
(run):
* b3/testb3_5.cpp:
(testPatchpointManyWarmAnyImms):
(testPatchpointManyColdAnyImms):
(testPatchpointManyImms): Deleted.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@248710 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Source/JavaScriptCore/ChangeLog
Source/JavaScriptCore/b3/B3LowerToAir.cpp
Source/JavaScriptCore/b3/B3ValueKey.h
Source/JavaScriptCore/b3/B3ValueRep.h
Source/JavaScriptCore/b3/testb3.h
Source/JavaScriptCore/b3/testb3_1.cpp
Source/JavaScriptCore/b3/testb3_5.cpp