Object allocation sinking phase shouldn't re-decorate previously sunken allocations...
authorfpizlo@apple.com <fpizlo@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Sat, 14 Mar 2015 02:50:36 +0000 (02:50 +0000)
committerfpizlo@apple.com <fpizlo@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Sat, 14 Mar 2015 02:50:36 +0000 (02:50 +0000)
https://bugs.webkit.org/show_bug.cgi?id=142686

Reviewed by Oliver Hunt.

Just because promoteHeapAccess() notifies us of an effect to a heap location in a node doesn't
mean that we should handle it as if it was for one of our sinking candidates. Instead we should
prune based on m_sinkCandidates.

This fixes a benign bug where we would generate a lot of repeated IR for some pathological
tests.

* dfg/DFGObjectAllocationSinkingPhase.cpp:
(JSC::DFG::ObjectAllocationSinkingPhase::promoteSunkenFields):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@181495 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Source/JavaScriptCore/ChangeLog
Source/JavaScriptCore/dfg/DFGObjectAllocationSinkingPhase.cpp

index 37f1c2a..b9ccf2d 100644 (file)
@@ -1,3 +1,20 @@
+2015-03-13  Filip Pizlo  <fpizlo@apple.com>
+
+        Object allocation sinking phase shouldn't re-decorate previously sunken allocations on each fixpoint operation
+        https://bugs.webkit.org/show_bug.cgi?id=142686
+
+        Reviewed by Oliver Hunt.
+        
+        Just because promoteHeapAccess() notifies us of an effect to a heap location in a node doesn't
+        mean that we should handle it as if it was for one of our sinking candidates. Instead we should
+        prune based on m_sinkCandidates.
+        
+        This fixes a benign bug where we would generate a lot of repeated IR for some pathological
+        tests.
+
+        * dfg/DFGObjectAllocationSinkingPhase.cpp:
+        (JSC::DFG::ObjectAllocationSinkingPhase::promoteSunkenFields):
+
 2015-03-13  Eric Carlson  <eric.carlson@apple.com>
 
         [Mac] Enable WIRELESS_PLAYBACK_TARGET
index 18bc249..1b7b683 100644 (file)
@@ -581,10 +581,12 @@ private:
                 promoteHeapAccess(
                     node,
                     [&] (PromotedHeapLocation location, Edge) {
-                        locations.add(location);
+                        if (m_sinkCandidates.contains(location.base()))
+                            locations.add(location);
                     },
                     [&] (PromotedHeapLocation location) {
-                        locations.add(location);
+                        if (m_sinkCandidates.contains(location.base()))
+                            locations.add(location);
                     });
             }
         }
@@ -636,6 +638,8 @@ private:
                 promoteHeapAccess(
                     node,
                     [&] (PromotedHeapLocation location, Edge value) {
+                        if (!m_sinkCandidates.contains(location.base()))
+                            return;
                         SSACalculator::Variable* variable = m_locationToVariable.get(location);
                         m_ssaCalculator.newDef(variable, block, value.node());
                     },
@@ -687,10 +691,12 @@ private:
                 promoteHeapAccess(
                     node,
                     [&] (PromotedHeapLocation location, Edge value) {
-                        m_localMapping.set(location, value.node());
+                        if (m_sinkCandidates.contains(location.base()))
+                            m_localMapping.set(location, value.node());
                     },
                     [&] (PromotedHeapLocation location) {
-                        node->replaceWith(resolve(block, location));
+                        if (m_sinkCandidates.contains(location.base()))
+                            node->replaceWith(resolve(block, location));
                     });
             }