Object allocation sinking phase shouldn't re-decorate previously sunken allocations...
authorfpizlo@apple.com <fpizlo@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Sat, 14 Mar 2015 02:50:36 +0000 (02:50 +0000)
committerfpizlo@apple.com <fpizlo@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Sat, 14 Mar 2015 02:50:36 +0000 (02:50 +0000)
commit58a63191059dcfcc6352d3f90c1c2290996f8e39
tree107973a7060726a088a3e935375fa713326cfb31
parentb96b8e71bfeabaedb5f5daa1ea2a10c269b5983c
Object allocation sinking phase shouldn't re-decorate previously sunken allocations on each fixpoint operation
https://bugs.webkit.org/show_bug.cgi?id=142686

Reviewed by Oliver Hunt.

Just because promoteHeapAccess() notifies us of an effect to a heap location in a node doesn't
mean that we should handle it as if it was for one of our sinking candidates. Instead we should
prune based on m_sinkCandidates.

This fixes a benign bug where we would generate a lot of repeated IR for some pathological
tests.

* dfg/DFGObjectAllocationSinkingPhase.cpp:
(JSC::DFG::ObjectAllocationSinkingPhase::promoteSunkenFields):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@181495 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Source/JavaScriptCore/ChangeLog
Source/JavaScriptCore/dfg/DFGObjectAllocationSinkingPhase.cpp