Changeset 247724 in webkit

Timestamp:

Jul 23, 2019 10:24:13 AM (5 years ago)

Author:

Justin Michaud

Message:

Sometimes we miss removable CheckInBounds
​https://bugs.webkit.org/show_bug.cgi?id=200018

Reviewed by Saam Barati.

JSTests:

• microbenchmarks/typed-array-sum.js: Added.

(doTest):

Source/JavaScriptCore:

We failed to remove the CheckInBounds bounds because we did not see that the index was nonnegative. This is because we do not see the relationship between the two
separate zero constants that appear in the IR for the given test case. This patch re-adds the hack to de-duplicate m_zero that was removed in
<​https://trac.webkit.org/changeset/241228/webkit>.

• dfg/DFGIntegerRangeOptimizationPhase.cpp:

Location:

trunk

Files:

• JSTests/ChangeLog (modified) (1 diff)
• JSTests/microbenchmarks/typed-array-sum.js (added)
• Source/JavaScriptCore/ChangeLog (modified) (1 diff)
• Source/JavaScriptCore/dfg/DFGIntegerRangeOptimizationPhase.cpp (modified) (2 diffs)

trunk/JSTests/ChangeLog

@@ +1 @@
+2019-07-23  Justin Michaud  <justin_michaud@apple.com>
+
+        Sometimes we miss removable CheckInBounds
+        https://bugs.webkit.org/show_bug.cgi?id=200018
+
+        Reviewed by Saam Barati.
+
+        * microbenchmarks/typed-array-sum.js: Added.
+        (doTest):
+
 2019-07-16  Mark Lam  <mark.lam@apple.com>
 

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2019-07-23  Justin Michaud  <justin_michaud@apple.com>
+
+        Sometimes we miss removable CheckInBounds
+        https://bugs.webkit.org/show_bug.cgi?id=200018
+
+        Reviewed by Saam Barati.
+
+        We failed to remove the CheckInBounds bounds because we did not see that the index was nonnegative. This is because we do not see the relationship between the two
+        separate zero constants that appear in the IR for the given test case. This patch re-adds the hack to de-duplicate m_zero that was removed in 
+        <https://trac.webkit.org/changeset/241228/webkit>.
+
+        * dfg/DFGIntegerRangeOptimizationPhase.cpp:
+
 2019-07-22  Yusuke Suzuki  <ysuzuki@apple.com>
 

trunk/Source/JavaScriptCore/dfg/DFGIntegerRangeOptimizationPhase.cpp

@@ -1011 +1011 @@
         
         // Before we do anything, make sure that we have a zero constant at the top.
-        m_zero = m_insertionSet.insertConstant(0, m_graph.block(0)->at(0)->origin, jsNumber(0));
-        m_insertionSet.execute(m_graph.block(0));
+        for (Node* node : *m_graph.block(0)) {
+            if (node->isInt32Constant() && !node->asInt32()) {
+                m_zero = node;
+                break;
+            }
+        }
+        if (!m_zero) {
+            m_zero = m_insertionSet.insertConstant(0, m_graph.block(0)->at(0)->origin, jsNumber(0));
+            m_insertionSet.execute(m_graph.block(0));
+        }
         
         if (DFGIntegerRangeOptimizationPhaseInternal::verbose) {
@@ -1322 +1330 @@
                     if (nonNegative && lessThanLength) {
                         executeNode(block->at(nodeIndex));
-                        node->convertToIdentityOn(m_zero);
+                        // We just need to make sure we are a value-producing node.
+                        node->convertToIdentityOn(node->child1().node());
                         changed = true;
                     }