⚠ Archived content — this site is no longer maintained.   Current WebKit documentation is at docs.webkit.org.

Changeset 235177 in webkit


Ignore:
Timestamp:
Aug 22, 2018, 9:55:19 AM (8 years ago)
Author:
mark.lam@apple.com
Message:

The DFG CFGSimplification phase shouldn’t jettison a block when it’s the target of both branch directions.
​https://bugs.webkit.org/show_bug.cgi?id=188298
<rdar://problem/42888427>

Reviewed by Saam Barati.

JSTests:

  • stress/bug-188298.js: Added.

Source/JavaScriptCore:

In the event that both targets of a Branch is the same block, then even if we'll
always take one path of the branch, the other target is not unreachable because
it is the same target as the one in the taken path. Hence, it should not be
jettisoned.

  • JavaScriptCore.xcodeproj/project.pbxproj:
  • Added DFGCFG.h which is in use and should have been added to the project.
  • dfg/DFGCFGSimplificationPhase.cpp:

(JSC::DFG::CFGSimplificationPhase::run):

Location:
trunk
Files:
1 added
4 edited

Legend:

Unmodified
Added
Removed

  • trunk/JSTests/ChangeLog

    r235106 r235177  
     12018-08-22  Mark Lam  <mark.lam@apple.com>
     2
     3        The DFG CFGSimplification phase shouldn’t jettison a block when it’s the target of both branch directions.
     4        https://bugs.webkit.org/show_bug.cgi?id=188298
     5        <rdar://problem/42888427>
     6
     7        Reviewed by Saam Barati.
     8
     9        * stress/bug-188298.js: Added.
     10
    1112018-08-20  Saam barati  <sbarati@apple.com>
    212

  • trunk/Source/JavaScriptCore/ChangeLog

    r235161 r235177  
     12018-08-22  Mark Lam  <mark.lam@apple.com>
     2
     3        The DFG CFGSimplification phase shouldn’t jettison a block when it’s the target of both branch directions.
     4        https://bugs.webkit.org/show_bug.cgi?id=188298
     5        <rdar://problem/42888427>
     6
     7        Reviewed by Saam Barati.
     8
     9        In the event that both targets of a Branch is the same block, then even if we'll
     10        always take one path of the branch, the other target is not unreachable because
     11        it is the same target as the one in the taken path.  Hence, it should not be
     12        jettisoned.
     13
     14        * JavaScriptCore.xcodeproj/project.pbxproj:
     15        - Added DFGCFG.h which is in use and should have been added to the project.
     16        * dfg/DFGCFGSimplificationPhase.cpp:
     17        (JSC::DFG::CFGSimplificationPhase::run):
     18
    1192018-08-20  Yusuke Suzuki  <yusukesuzuki@slowstart.org>
    220

  • trunk/Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj

    r234713 r235177  
    18011801                FEA08621182B7A0400F6D851 /* DebuggerPrimitives.h in Headers */ = {isa = PBXBuildFile; fileRef = FEA0861F182B7A0400F6D851 /* DebuggerPrimitives.h */; settings = {ATTRIBUTES = (Private, ); }; };
    18021802                FEA0C4031CDD7D1D00481991 /* FunctionWhitelist.h in Headers */ = {isa = PBXBuildFile; fileRef = FEA0C4011CDD7D0E00481991 /* FunctionWhitelist.h */; };
     1803                FEA3BBAC212C97CB00E93AD1 /* DFGCFG.h in Headers */ = {isa = PBXBuildFile; fileRef = FEA3BBAB212C97CB00E93AD1 /* DFGCFG.h */; };
    18031804                FEB51F6C1A97B688001F921C /* Regress141809.mm in Sources */ = {isa = PBXBuildFile; fileRef = FEB51F6B1A97B688001F921C /* Regress141809.mm */; };
    18041805                FEB58C15187B8B160098EF0B /* ErrorHandlingScope.h in Headers */ = {isa = PBXBuildFile; fileRef = FEB58C13187B8B160098EF0B /* ErrorHandlingScope.h */; settings = {ATTRIBUTES = (Private, ); }; };
    … …  
    47664767                FEA0C4001CDD7D0E00481991 /* FunctionWhitelist.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = FunctionWhitelist.cpp; sourceTree = "<group>"; };
    47674768                FEA0C4011CDD7D0E00481991 /* FunctionWhitelist.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = FunctionWhitelist.h; sourceTree = "<group>"; };
     4769                FEA3BBAB212C97CB00E93AD1 /* DFGCFG.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGCFG.h; path = dfg/DFGCFG.h; sourceTree = "<group>"; };
    47684770                FEB137561BB11EEE00CD5100 /* MacroAssemblerARM64.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = MacroAssemblerARM64.cpp; sourceTree = "<group>"; };
    47694771                FEB41CCB1F73284200C5481E /* ProbeFrame.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ProbeFrame.h; sourceTree = "<group>"; };
    … …  
    71997201                                0FFFC94B14EF909500C72532 /* DFGCFAPhase.cpp */,
    72007202                                0FFFC94C14EF909500C72532 /* DFGCFAPhase.h */,
     7203                                FEA3BBAB212C97CB00E93AD1 /* DFGCFG.h */,
    72017204                                0F3B3A241544C991003ED0FF /* DFGCFGSimplificationPhase.cpp */,
    72027205                                0F3B3A251544C991003ED0FF /* DFGCFGSimplificationPhase.h */,
    … …  
    84468449                                0F666EC0183566F900D017F1 /* BytecodeLivenessAnalysisInlines.h in Headers */,
    84478450                                E328DAEB1D38D005001A2529 /* BytecodeRewriter.h in Headers */,
     8451                                FEA3BBAC212C97CB00E93AD1 /* DFGCFG.h in Headers */,
    84488452                                6514F21918B3E1670098FF8B /* Bytecodes.h in Headers */,
    84498453                                0F885E111849A3BE00F1E3FA /* BytecodeUseDef.h in Headers */,

  • trunk/Source/JavaScriptCore/dfg/DFGCFGSimplificationPhase.cpp

    r232800 r235177  
    107107                                m_graph.dump();
    108108                            m_graph.dethread();
    109                             mergeBlocks(block, targetBlock, oneBlock(jettisonedBlock));
     109                            if (targetBlock == jettisonedBlock)
     110                                mergeBlocks(block, targetBlock, noBlocks());
     111                            else
     112                                mergeBlocks(block, targetBlock, oneBlock(jettisonedBlock));
    110113                        } else {
    111114                            if (extremeLogging)
    … …  
    117120                            NodeOrigin boundaryNodeOrigin = terminal->origin;
    118121
    119                             jettisonBlock(block, jettisonedBlock, boundaryNodeOrigin);
     122                            if (targetBlock != jettisonedBlock)
     123                                jettisonBlock(block, jettisonedBlock, boundaryNodeOrigin);
    120124
    121125                            block->replaceTerminal(
    … …  
    135139                        break;
    136140                    }
    137                    
     141
    138142                    // Branch to same destination -> jump.
    139143                    // FIXME: this will currently not be hit because of the lack of jump-only
Note: See TracChangeset for help on using the changeset viewer.