Changeset 183763 in webkit


Ignore:
Timestamp:
May 4, 2015 1:11:58 PM (9 years ago)
Author:
basile_clement@apple.com
Message:

Allocation sinking is prohibiting the creation of phis between a Phantom object and its materialization
https://bugs.webkit.org/show_bug.cgi?id=144587

Rubber stamped by Filip Pizlo.

When sinking object allocations, we ensure in
determineMaterializationPoints that whenever an allocation is
materialized on a path to a block, it is materialized in all such
paths. Thus when running the SSA calculator to place Phis in
placeMaterializationPoints, we can't encounter a situation where some
Upsilons are referring to a materialization while others are referring
to the phantom object.

This replaces the code that was adding a materialization late in
placeMaterializationPoints to handle that case by an assertion that it
does not happen, which will make
https://bugs.webkit.org/show_bug.cgi?id=143073 easier to implement.

  • dfg/DFGObjectAllocationSinkingPhase.cpp:

(JSC::DFG::ObjectAllocationSinkingPhase::placeMaterializationPoints):

Location:
trunk/Source/JavaScriptCore
Files:
2 edited

Legend:

Unmodified
Added
Removed
  • trunk/Source/JavaScriptCore/ChangeLog

    r183759 r183763  
     12015-05-04  Basile Clement  <basile_clement@apple.com>
     2
     3        Allocation sinking is prohibiting the creation of phis between a Phantom object and its materialization
     4        https://bugs.webkit.org/show_bug.cgi?id=144587
     5
     6        Rubber stamped by Filip Pizlo.
     7
     8        When sinking object allocations, we ensure in
     9        determineMaterializationPoints that whenever an allocation is
     10        materialized on a path to a block, it is materialized in all such
     11        paths. Thus when running the SSA calculator to place Phis in
     12        placeMaterializationPoints, we can't encounter a situation where some
     13        Upsilons are referring to a materialization while others are referring
     14        to the phantom object.
     15
     16        This replaces the code that was adding a materialization late in
     17        placeMaterializationPoints to handle that case by an assertion that it
     18        does not happen, which will make
     19        https://bugs.webkit.org/show_bug.cgi?id=143073 easier to implement.
     20
     21        * dfg/DFGObjectAllocationSinkingPhase.cpp:
     22        (JSC::DFG::ObjectAllocationSinkingPhase::placeMaterializationPoints):
     23
    1242015-05-04  Ryosuke Niwa  <rniwa@webkit.org>
    225
  • trunk/Source/JavaScriptCore/dfg/DFGObjectAllocationSinkingPhase.cpp

    r183752 r183763  
    472472                    Node* allocation = indexToNode[variable->index()];
    473473                   
    474                     Node* originalIncoming = mapping.get(allocation);
    475                     Node* incoming;
    476                     if (originalIncoming == allocation) {
    477                         // If we have a Phi that combines materializations with the original
    478                         // phantom object, then the path with the phantom object must materialize.
    479                        
    480                         incoming = createMaterialize(allocation, upsilonWhere);
    481                         m_insertionSet.insert(upsilonInsertionPoint, incoming);
    482                         insertOSRHintsForUpdate(
    483                             m_insertionSet, upsilonInsertionPoint, upsilonOrigin,
    484                             availabilityCalculator.m_availability, originalIncoming, incoming);
    485                     } else
    486                         incoming = originalIncoming;
     474                    Node* incoming = mapping.get(allocation);
     475                    DFG_ASSERT(m_graph, incoming, incoming != allocation);
    487476                   
    488477                    m_insertionSet.insertNode(
Note: See TracChangeset for help on using the changeset viewer.