Changeset 173534 in webkit

Timestamp:

Sep 11, 2014, 1:04:38 PM (12 years ago)

Author:

fpizlo@apple.com

Message:

REGRESSION (r172129): Vine pages load as blank
​https://bugs.webkit.org/show_bug.cgi?id=136655
rdar://problem/18281215

Reviewed by Michael Saboff.

If lastNode is something that is subject to DCE, then removing the Phantom's reference to something
that lastNode references means that the thing being referenced may no longer be kept alive for OSR.
Teach PhantomRemovalPhase that it's only safe to do this if lastNode is a Phantom. That's probably too
conservative, but that's fine since this is mainly just an optimization to make the IR sane to read and
reasonably compact; it's OK if we miss cases here.

• dfg/DFGPhantomRemovalPhase.cpp:

(JSC::DFG::PhantomRemovalPhase::run):

• tests/stress/remove-phantom-after-setlocal.js: Added.

Location:

trunk/Source/JavaScriptCore

Files:

• ChangeLog (modified) (1 diff)
• dfg/DFGPhantomRemovalPhase.cpp (modified) (2 diffs)
• tests/stress/remove-phantom-after-setlocal.js (added)

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2014-09-11  Filip Pizlo  <fpizlo@apple.com>
+
+        REGRESSION (r172129): Vine pages load as blank
+        https://bugs.webkit.org/show_bug.cgi?id=136655
+        rdar://problem/18281215
+
+        Reviewed by Michael Saboff.
+        
+        If lastNode is something that is subject to DCE, then removing the Phantom's reference to something
+        that lastNode references means that the thing being referenced may no longer be kept alive for OSR.
+        Teach PhantomRemovalPhase that it's only safe to do this if lastNode is a Phantom. That's probably too
+        conservative, but that's fine since this is mainly just an optimization to make the IR sane to read and
+        reasonably compact; it's OK if we miss cases here.
+
+        * dfg/DFGPhantomRemovalPhase.cpp:
+        (JSC::DFG::PhantomRemovalPhase::run):
+        * tests/stress/remove-phantom-after-setlocal.js: Added.
+
 2014-09-11  Bear Travis  <betravis@adobe.com>
 

trunk/Source/JavaScriptCore/dfg/DFGPhantomRemovalPhase.cpp

@@ -94 +94 @@
             unsigned sourceIndex = 0;
             unsigned targetIndex = 0;
-            Node* lastNode = nullptr;
             while (sourceIndex < block->size()) {
                 Node* node = block->at(sourceIndex++);
                 switch (node->op()) {
                 case Phantom: {
-                    if (lastNode && (lastNode->origin.forExit != node->origin.forExit || (lastNode->flags() & NodeHasVarArgs)))
-                        lastNode = nullptr;
+                    Node* lastNode = nullptr;
+                    if (sourceIndex > 1) {
+                        lastNode = block->at(sourceIndex - 2);
+                        if (lastNode->op() != Phantom
+                            || lastNode->origin.forExit != node->origin.forExit)
+                            lastNode = nullptr;
+                    }
                     for (unsigned i = 0; i < AdjacencyList::Size; ++i) {
                         Edge edge = node->children.child(i);
@@ -162 +166 @@
                     break;
                 }
-                lastNode = node;
+                
                 block->at(targetIndex++) = node;
             }