[webkit-changes] [WebKit/WebKit] ebb0ea: [JSC] Revive DFG MovHintRemoval phase

[Yusuke Suzuki]

  Branch: refs/heads/main
  Home:   https://github.com/WebKit/WebKit
  Commit: ebb0ea427eeea3ec7f8a376b85a016a994a15c44
      https://github.com/WebKit/WebKit/commit/ebb0ea427eeea3ec7f8a376b85a016a994a15c44
  Author: Yusuke Suzuki <ysuzuki at apple.com>
  Date:   2023-06-12 (Mon, 12 Jun 2023)

  Changed paths:
    A JSTests/stress/dead-bytecode-local-ftl.js
    A JSTests/stress/dead-bytecode-local.js
    M Source/JavaScriptCore/Sources.txt
    M Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h
    M Source/JavaScriptCore/dfg/DFGClobberize.h
    M Source/JavaScriptCore/dfg/DFGClobbersExitState.cpp
    M Source/JavaScriptCore/dfg/DFGDoesGC.cpp
    M Source/JavaScriptCore/dfg/DFGFixupPhase.cpp
    M Source/JavaScriptCore/dfg/DFGMayExit.cpp
    A Source/JavaScriptCore/dfg/DFGMovHintRemovalPhase.cpp
    A Source/JavaScriptCore/dfg/DFGMovHintRemovalPhase.h
    M Source/JavaScriptCore/dfg/DFGNode.h
    M Source/JavaScriptCore/dfg/DFGNodeType.h
    M Source/JavaScriptCore/dfg/DFGOSRAvailabilityAnalysisPhase.cpp
    M Source/JavaScriptCore/dfg/DFGPhantomInsertionPhase.cpp
    M Source/JavaScriptCore/dfg/DFGPlan.cpp
    M Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp
    M Source/JavaScriptCore/dfg/DFGSafeToExecute.h
    M Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp
    M Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp
    M Source/JavaScriptCore/dfg/DFGUseKind.h
    M Source/JavaScriptCore/dfg/DFGVarargsForwardingPhase.cpp
    M Source/JavaScriptCore/ftl/FTLCapabilities.cpp
    M Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp
    M Source/JavaScriptCore/runtime/OptionsList.h

  Log Message:
  -----------
  [JSC] Revive DFG MovHintRemoval phase
https://bugs.webkit.org/show_bug.cgi?id=257939
rdar://110583931

Reviewed by Keith Miller.

This patch revives MovHintRemoval phase in DFG. We found that unnecessary MovHint exists in many cases (it is already dead),
and preventing us from adding further optimizations based on that nobody is referring to the unused DFG nodes. So this patch
paves the way to implementing that kind of optimization.
The major difference from previous MovHintRemoval is that ZombieHint no longer kills availability. Instead it always says
bottom value is stored. This makes availability analysis much simpler (we no longer need to consider wrong dead case).
So, MovHint and ZombieHint are now exact same in terms of semantics: ZombieHint is using its op to represent this is assumed
to be unused. And ZombieHint always refers to bottom value.

* Source/JavaScriptCore/Sources.txt:
* Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h:
(JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
* Source/JavaScriptCore/dfg/DFGClobberize.h:
(JSC::DFG::clobberize):
* Source/JavaScriptCore/dfg/DFGClobbersExitState.cpp:
(JSC::DFG::clobbersExitState):
* Source/JavaScriptCore/dfg/DFGDoesGC.cpp:
(JSC::DFG::doesGC):
* Source/JavaScriptCore/dfg/DFGFixupPhase.cpp:
(JSC::DFG::FixupPhase::fixupNode):
* Source/JavaScriptCore/dfg/DFGMayExit.cpp:
* Source/JavaScriptCore/dfg/DFGMovHintRemovalPhase.cpp: Added.
(JSC::DFG::performMovHintRemoval):
* Source/JavaScriptCore/dfg/DFGMovHintRemovalPhase.h: Added.
* Source/JavaScriptCore/dfg/DFGNode.h:
(JSC::DFG::Node::containsMovHint):
(JSC::DFG::Node::hasUnlinkedOperand):
* Source/JavaScriptCore/dfg/DFGNodeType.h:
* Source/JavaScriptCore/dfg/DFGOSRAvailabilityAnalysisPhase.cpp:
(JSC::DFG::LocalOSRAvailabilityCalculator::executeNode):
* Source/JavaScriptCore/dfg/DFGPhantomInsertionPhase.cpp:
* Source/JavaScriptCore/dfg/DFGPlan.cpp:
(JSC::DFG::Plan::compileInThreadImpl):
* Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp:
* Source/JavaScriptCore/dfg/DFGSafeToExecute.h:
(JSC::DFG::safeToExecute):
* Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp:
(JSC::DFG::SpeculativeJIT::compile):
* Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp:
(JSC::DFG::SpeculativeJIT::compile):
* Source/JavaScriptCore/dfg/DFGVarargsForwardingPhase.cpp:
* Source/JavaScriptCore/ftl/FTLCapabilities.cpp:
(JSC::FTL::canCompile):
* Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp:
(JSC::FTL::DFG::LowerDFGToB3::validateAIState):
(JSC::FTL::DFG::LowerDFGToB3::compileNode):
* Source/JavaScriptCore/runtime/OptionsList.h:

Canonical link: https://commits.webkit.org/265098@main