Changeset 261603 in webkit

Timestamp:

May 13, 2020 12:24:13 AM (4 years ago)

Author:

sbarati@apple.com

Message:

MovHint can see an arguments object be MovHinted to a Tmp
​https://bugs.webkit.org/show_bug.cgi?id=211820
<rdar://problem/62882158>

Reviewed by Keith Miller.

JSTests:

• stress/varargs-forwarding-can-see-arguments-mov-hint-to-for-of-tmp.js: Added.

(let.iter.Symbol.iterator.return.next):
(let.iter.Symbol.iterator):

Source/JavaScriptCore:

We had an assert that it wasn't possible to have a MovHint from an arguments
object to a Tmp. However, this is possible with for-of. There is nothing
about the current algorithm that is specific to only VirtualRegisters. The
algorithm also works over Tmps. So I've generalized the algorithm to just work
over Operand.

• dfg/DFGVarargsForwardingPhase.cpp:

Location:

trunk

Files:

• JSTests/ChangeLog (modified) (1 diff)
• JSTests/stress/varargs-forwarding-can-see-arguments-mov-hint-to-for-of-tmp.js (added)
• Source/JavaScriptCore/ChangeLog (modified) (1 diff)
• Source/JavaScriptCore/dfg/DFGVarargsForwardingPhase.cpp (modified) (3 diffs)

trunk/JSTests/ChangeLog

@@ +1 @@
+2020-05-13  Saam Barati  <sbarati@apple.com>
+
+        MovHint can see an arguments object be MovHinted to a Tmp
+        https://bugs.webkit.org/show_bug.cgi?id=211820
+        <rdar://problem/62882158>
+
+        Reviewed by Keith Miller.
+
+        * stress/varargs-forwarding-can-see-arguments-mov-hint-to-for-of-tmp.js: Added.
+        (let.iter.Symbol.iterator.return.next):
+        (let.iter.Symbol.iterator):
+
 2020-05-13  Alexey Shvayka  <shvaikalesh@gmail.com>
 

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2020-05-13  Saam Barati  <sbarati@apple.com>
+
+        MovHint can see an arguments object be MovHinted to a Tmp
+        https://bugs.webkit.org/show_bug.cgi?id=211820
+        <rdar://problem/62882158>
+
+        Reviewed by Keith Miller.
+
+        We had an assert that it wasn't possible to have a MovHint from an arguments
+        object to a Tmp. However, this is possible with for-of. There is nothing
+        about the current algorithm that is specific to only VirtualRegisters. The
+        algorithm also works over Tmps. So I've generalized the algorithm to just work
+        over Operand.
+
+        * dfg/DFGVarargsForwardingPhase.cpp:
+
 2020-05-13  Alexey Shvayka  <shvaikalesh@gmail.com>
 

trunk/Source/JavaScriptCore/dfg/DFGVarargsForwardingPhase.cpp

@@ -98 +98 @@
         // sites.
         unsigned lastUserIndex = candidateNodeIndex;
-        Vector<VirtualRegister, 2> relevantLocals; // This is a set. We expect it to be a small set.
+        Vector<Operand, 2> relevantLocals; // This is a set. We expect it to be a small set.
         for (unsigned nodeIndex = candidateNodeIndex + 1; nodeIndex < block->size(); ++nodeIndex) {
             Node* node = block->at(nodeIndex);
@@ -116 +116 @@
                 if (node->child1() != candidate)
                     break;
-                ASSERT_WITH_MESSAGE(!node->unlinkedOperand().isTmp(), "We don't currently support a tmp referring to an arguments object.");
                 lastUserIndex = nodeIndex;
-                if (!relevantLocals.contains(node->unlinkedOperand().virtualRegister()))
-                    relevantLocals.append(node->unlinkedOperand().virtualRegister());
+                if (!relevantLocals.contains(node->unlinkedOperand()))
+                    relevantLocals.append(node->unlinkedOperand());
                 break;
                 
@@ -246 +245 @@
                             relevantLocals.removeLast();
                             lastUserIndex = nodeIndex;
+                            ASSERT(!relevantLocals.contains(operand));
+                            break;
                         }
                     }