Allocation sinking is prohibiting the creation of phis between a Phantom object and...
authorbasile_clement@apple.com <basile_clement@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Mon, 4 May 2015 20:11:58 +0000 (20:11 +0000)
committerbasile_clement@apple.com <basile_clement@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Mon, 4 May 2015 20:11:58 +0000 (20:11 +0000)
https://bugs.webkit.org/show_bug.cgi?id=144587

Rubber stamped by Filip Pizlo.

When sinking object allocations, we ensure in
determineMaterializationPoints that whenever an allocation is
materialized on a path to a block, it is materialized in all such
paths. Thus when running the SSA calculator to place Phis in
placeMaterializationPoints, we can't encounter a situation where some
Upsilons are referring to a materialization while others are referring
to the phantom object.

This replaces the code that was adding a materialization late in
placeMaterializationPoints to handle that case by an assertion that it
does not happen, which will make
https://bugs.webkit.org/show_bug.cgi?id=143073 easier to implement.

* dfg/DFGObjectAllocationSinkingPhase.cpp:
(JSC::DFG::ObjectAllocationSinkingPhase::placeMaterializationPoints):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@183763 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Source/JavaScriptCore/ChangeLog
Source/JavaScriptCore/dfg/DFGObjectAllocationSinkingPhase.cpp

index 0e7df93..7a06cb5 100644 (file)
@@ -1,3 +1,26 @@
+2015-05-04  Basile Clement  <basile_clement@apple.com>
+
+        Allocation sinking is prohibiting the creation of phis between a Phantom object and its materialization
+        https://bugs.webkit.org/show_bug.cgi?id=144587
+
+        Rubber stamped by Filip Pizlo.
+
+        When sinking object allocations, we ensure in
+        determineMaterializationPoints that whenever an allocation is
+        materialized on a path to a block, it is materialized in all such
+        paths. Thus when running the SSA calculator to place Phis in
+        placeMaterializationPoints, we can't encounter a situation where some
+        Upsilons are referring to a materialization while others are referring
+        to the phantom object.
+
+        This replaces the code that was adding a materialization late in
+        placeMaterializationPoints to handle that case by an assertion that it
+        does not happen, which will make
+        https://bugs.webkit.org/show_bug.cgi?id=143073 easier to implement.
+
+        * dfg/DFGObjectAllocationSinkingPhase.cpp:
+        (JSC::DFG::ObjectAllocationSinkingPhase::placeMaterializationPoints):
+
 2015-05-04  Ryosuke Niwa  <rniwa@webkit.org>
 
         Extending undefined in class syntax should throw a TypeError
index 6611236..339b7df 100644 (file)
@@ -471,19 +471,8 @@ private:
                     SSACalculator::Variable* variable = phiDef->variable();
                     Node* allocation = indexToNode[variable->index()];
                     
-                    Node* originalIncoming = mapping.get(allocation);
-                    Node* incoming;
-                    if (originalIncoming == allocation) {
-                        // If we have a Phi that combines materializations with the original
-                        // phantom object, then the path with the phantom object must materialize.
-                        
-                        incoming = createMaterialize(allocation, upsilonWhere);
-                        m_insertionSet.insert(upsilonInsertionPoint, incoming);
-                        insertOSRHintsForUpdate(
-                            m_insertionSet, upsilonInsertionPoint, upsilonOrigin,
-                            availabilityCalculator.m_availability, originalIncoming, incoming);
-                    } else
-                        incoming = originalIncoming;
+                    Node* incoming = mapping.get(allocation);
+                    DFG_ASSERT(m_graph, incoming, incoming != allocation);
                     
                     m_insertionSet.insertNode(
                         upsilonInsertionPoint, SpecNone, Upsilon, upsilonOrigin,