Changeset 261595 in webkit

Timestamp:

May 12, 2020 8:04:58 PM (4 years ago)

Author:

sbarati@apple.com

Message:

handling of Check in VarargsForwardingPhase is too pessimistic
​https://bugs.webkit.org/show_bug.cgi?id=211810

Reviewed by Keith Miller and Filip Pizlo.

JSTests:

• microbenchmarks/forward-varargs-check-shouldnt-escape.js: Added.

(g):
(foo):

Source/JavaScriptCore:

We were treating a check, even if it wasn't on the sink candidate,
as if it could escape the candidate. That's wrong. Only checks on the
candidate have the escaping ability.

• dfg/DFGVarargsForwardingPhase.cpp:

Location:

trunk

Files:

• JSTests/ChangeLog (modified) (1 diff)
• JSTests/microbenchmarks/forward-varargs-check-shouldnt-escape.js (added)
• Source/JavaScriptCore/ChangeLog (modified) (1 diff)
• Source/JavaScriptCore/dfg/DFGVarargsForwardingPhase.cpp (modified) (1 diff)

trunk/JSTests/ChangeLog

@@ +1 @@
+2020-05-12  Saam Barati  <sbarati@apple.com>
+
+        handling of Check in VarargsForwardingPhase is too pessimistic
+        https://bugs.webkit.org/show_bug.cgi?id=211810
+
+        Reviewed by Keith Miller and Filip Pizlo.
+
+        * microbenchmarks/forward-varargs-check-shouldnt-escape.js: Added.
+        (g):
+        (foo):
+
 2020-05-12  Keith Miller  <keith_miller@apple.com>
 

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2020-05-12  Saam Barati  <sbarati@apple.com>
+
+        handling of Check in VarargsForwardingPhase is too pessimistic
+        https://bugs.webkit.org/show_bug.cgi?id=211810
+
+        Reviewed by Keith Miller and Filip Pizlo.
+
+        We were treating a check, even if it wasn't on the sink candidate,
+        as if it could escape the candidate. That's wrong. Only checks on the
+        candidate have the escaping ability.
+
+        * dfg/DFGVarargsForwardingPhase.cpp:
+
 2020-05-12  Keith Miller  <keith_miller@apple.com>
 

trunk/Source/JavaScriptCore/dfg/DFGVarargsForwardingPhase.cpp

@@ -128 +128 @@
                     node,
                     [&] (Edge edge) {
-                        if (edge == candidate)
+                        if (edge == candidate) {
                             lastUserIndex = nodeIndex;
-                        
-                        if (edge.willNotHaveCheck())
-                            return;
-                        
-                        if (alreadyChecked(edge.useKind(), SpecObject))
-                            return;
-                        
-                        sawEscape = true;
+
+                            if (edge.willNotHaveCheck())
+                                return;
+
+                            if (alreadyChecked(edge.useKind(), SpecObject))
+                                return;
+
+                            sawEscape = true;
+                        }
                     });
                 if (sawEscape) {