Allocation sinking SSA Defs are allowed to have replacements
authorsbarati@apple.com <sbarati@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Sun, 10 Apr 2016 00:26:25 +0000 (00:26 +0000)
committersbarati@apple.com <sbarati@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Sun, 10 Apr 2016 00:26:25 +0000 (00:26 +0000)
commit9c540641b8ff10b5b568422aa7f01082f0bd5bdf
tree4974fee620a9b6554db507e86e83570af3238db4
parent249db2985fc0c686c099d65b2b4cccfeaf89ee1c
Allocation sinking SSA Defs are allowed to have replacements
https://bugs.webkit.org/show_bug.cgi?id=156444

Reviewed by Filip Pizlo.

Consider the following program and the annotations that explain why
the SSA defs we create in allocation sinking can have replacements.

function foo(a1) {
    let o1 = {x: 20, y: 50};
    let o2 = {y: 40, o1: o1};
    let o3 = {};

    // We're Defing a new variable here, call it o3_field.
    // o3_field is defing the value that is the result of
    // a GetByOffset that gets eliminated through allocation sinking.
    o3.field = o1.y;

    dontCSE();

    // This control flow is here to not allow the phase to consult
    // its local SSA mapping (which properly handles replacements)
    // for the value of o3_field.
    if (a1) {
        a1 = true;
    } else {
        a1 = false;
    }

    // Here, we ask for the reaching def of o3_field, and assert
    // it doesn't have a replacement. It does have a replacement
    // though. The original Def was the GetByOffset. We replaced
    // that GetByOffset with the value of the o1_y variable.
    let value = o3.field;
    assert(value === 50);
}

* dfg/DFGObjectAllocationSinkingPhase.cpp:
* tests/stress/allocation-sinking-defs-may-have-replacements.js: Added.
(dontCSE):
(assert):
(foo):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@199277 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Source/JavaScriptCore/ChangeLog
Source/JavaScriptCore/dfg/DFGObjectAllocationSinkingPhase.cpp
Source/JavaScriptCore/tests/stress/allocation-sinking-defs-may-have-replacements.js [new file with mode: 0644]