Changeset 190749 in webkit

Timestamp:

Oct 8, 2015 3:18:49 PM (9 years ago)

Author:

fpizlo@apple.com

Message:

DFG SSA should remove unreachable code
​https://bugs.webkit.org/show_bug.cgi?id=149931

Reviewed by Geoffrey Garen.

• dfg/DFGConstantFoldingPhase.cpp:

(JSC::DFG::ConstantFoldingPhase::run): Remove unreachable code.

• dfg/DFGObjectAllocationSinkingPhase.cpp: Deal with the CFG changing.
• dfg/DFGPutStackSinkingPhase.cpp: Deal with the CFG changing.

Location:

trunk/Source/JavaScriptCore

Files:

• ChangeLog (modified) (1 diff)
• dfg/DFGConstantFoldingPhase.cpp (modified) (3 diffs)
• dfg/DFGObjectAllocationSinkingPhase.cpp (modified) (1 diff)
• dfg/DFGPutStackSinkingPhase.cpp (modified) (1 diff)

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2015-10-08  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG SSA should remove unreachable code
+        https://bugs.webkit.org/show_bug.cgi?id=149931
+
+        Reviewed by Geoffrey Garen.
+
+        * dfg/DFGConstantFoldingPhase.cpp:
+        (JSC::DFG::ConstantFoldingPhase::run): Remove unreachable code.
+        * dfg/DFGObjectAllocationSinkingPhase.cpp: Deal with the CFG changing.
+        * dfg/DFGPutStackSinkingPhase.cpp: Deal with the CFG changing.
+
 2015-10-08  Joseph Pecoraro  <pecoraro@apple.com>
 

trunk/Source/JavaScriptCore/dfg/DFGConstantFoldingPhase.cpp

@@ -31 +31 @@
 #include "DFGAbstractInterpreterInlines.h"
 #include "DFGArgumentsUtilities.h"
-#include "DFGBasicBlock.h"
+#include "DFGBasicBlockInlines.h"
 #include "DFGGraph.h"
 #include "DFGInPlaceAbstractState.h"
@@ -56 +56 @@
     {
         bool changed = false;
-        
-        for (BlockIndex blockIndex = 0; blockIndex < m_graph.numBlocks(); ++blockIndex) {
-            BasicBlock* block = m_graph.block(blockIndex);
-            if (!block)
-                continue;
+
+        for (BasicBlock* block : m_graph.blocksInNaturalOrder()) {
             if (block->cfaFoundConstants)
                 changed |= foldConstants(block);
@@ -67 +64 @@
         if (changed && m_graph.m_form == SSA) {
             // It's now possible that we have Upsilons pointed at JSConstants. Fix that.
-            for (BlockIndex blockIndex = m_graph.numBlocks(); blockIndex--;) {
-                BasicBlock* block = m_graph.block(blockIndex);
-                if (!block)
-                    continue;
+            for (BasicBlock* block : m_graph.blocksInNaturalOrder())
                 fixUpsilons(block);
+        }
+
+        if (m_graph.m_form == SSA) {
+            // It's now possible to simplify basic blocks by placing an Unreachable terminator right
+            // after anything that invalidates AI.
+            bool didClipBlock = false;
+            for (BasicBlock* block : m_graph.blocksInNaturalOrder()) {
+                m_state.beginBasicBlock(block);
+                for (unsigned nodeIndex = 0; nodeIndex < block->size(); ++nodeIndex) {
+                    if (block->at(nodeIndex)->isTerminal()) {
+                        // It's possible that we have something after the terminal. It could be a
+                        // no-op Check node, for example. We don't want the logic below to turn that
+                        // node into Unreachable, since then we'd have two terminators.
+                        break;
+                    }
+                    if (!m_state.isValid()) {
+                        NodeOrigin origin = block->at(nodeIndex)->origin;
+                        for (unsigned killIndex = nodeIndex; killIndex < block->size(); ++killIndex)
+                            m_graph.m_allocator.free(block->at(killIndex));
+                        block->resize(nodeIndex);
+                        block->appendNode(m_graph, SpecNone, Unreachable, origin);
+                        didClipBlock = true;
+                        break;
+                    }
+                    m_interpreter.execute(nodeIndex);
+                }
+            }
+
+            if (didClipBlock) {
+                changed = true;
+                m_graph.invalidateCFG();
+                m_graph.resetReachability();
+                m_graph.killUnreachableBlocks();
             }
         }

trunk/Source/JavaScriptCore/dfg/DFGObjectAllocationSinkingPhase.cpp

@@ -728 +728 @@
         m_graph.computeRefCounts();
         m_graph.initializeNodeOwners();
+        m_graph.m_dominators.computeIfNecessary(m_graph);
         performLivenessAnalysis(m_graph);
         performOSRAvailabilityAnalysis(m_graph);

trunk/Source/JavaScriptCore/dfg/DFGPutStackSinkingPhase.cpp

@@ -76 +76 @@
             m_graph.dump();
         }
+
+        m_graph.m_dominators.computeIfNecessary(m_graph);
         
         SSACalculator ssaCalculator(m_graph);