VarargsForwardingPhase should only consider MovHints that have the candidate as a...
authorfpizlo@apple.com <fpizlo@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Tue, 28 Apr 2015 18:04:10 +0000 (18:04 +0000)
committerfpizlo@apple.com <fpizlo@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Tue, 28 Apr 2015 18:04:10 +0000 (18:04 +0000)
commit3ef7aa91aec9768049530b2d1d8411fa9a4bfda7
treeb789b8164cc0ac771b56d9052f1fe1474c033320
parent0f29e067ebac6cd5c92310682983f3f82b646cab
VarargsForwardingPhase should only consider MovHints that have the candidate as a child
https://bugs.webkit.org/show_bug.cgi?id=144340

Reviewed by Michael Saboff and Mark Lam.

Since we were considering all MovHints, we'd assume that the CreateDirectArguments or
CreateClosedArguments node was live so long as any MovHinted bytecode variable was alive.
Basically, we'd keep it alive until the end of the block. This maximized the chances of
there being an interfering operation, which would prevent elimination.

The fix is to only consider MovHints that have the arguments candidate as a child. We only
care to track the liveness of those bytecode locals that would need an arguments object
recovery on OSR exit.

This is a speed-up on V8Spider/raytrace and Octane/raytrace because it undoes the regression
introduced in http://trac.webkit.org/changeset/183406.

* dfg/DFGVarargsForwardingPhase.cpp:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@183492 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Source/JavaScriptCore/ChangeLog
Source/JavaScriptCore/dfg/DFGVarargsForwardingPhase.cpp