<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"
"http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head><meta http-equiv="content-type" content="text/html; charset=utf-8" />
<title>[167182] trunk/Source/JavaScriptCore</title>
</head>
<body>
<style type="text/css"><!--
#msg dl.meta { border: 1px #006 solid; background: #369; padding: 6px; color: #fff; }
#msg dl.meta dt { float: left; width: 6em; font-weight: bold; }
#msg dt:after { content:':';}
#msg dl, #msg dt, #msg ul, #msg li, #header, #footer, #logmsg { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; }
#msg dl a { font-weight: bold}
#msg dl a:link { color:#fc3; }
#msg dl a:active { color:#ff0; }
#msg dl a:visited { color:#cc6; }
h3 { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; font-weight: bold; }
#msg pre { overflow: auto; background: #ffc; border: 1px #fa0 solid; padding: 6px; }
#logmsg { background: #ffc; border: 1px #fa0 solid; padding: 1em 1em 0 1em; }
#logmsg p, #logmsg pre, #logmsg blockquote { margin: 0 0 1em 0; }
#logmsg p, #logmsg li, #logmsg dt, #logmsg dd { line-height: 14pt; }
#logmsg h1, #logmsg h2, #logmsg h3, #logmsg h4, #logmsg h5, #logmsg h6 { margin: .5em 0; }
#logmsg h1:first-child, #logmsg h2:first-child, #logmsg h3:first-child, #logmsg h4:first-child, #logmsg h5:first-child, #logmsg h6:first-child { margin-top: 0; }
#logmsg ul, #logmsg ol { padding: 0; list-style-position: inside; margin: 0 0 0 1em; }
#logmsg ul { text-indent: -1em; padding-left: 1em; }#logmsg ol { text-indent: -1.5em; padding-left: 1.5em; }
#logmsg > ul, #logmsg > ol { margin: 0 0 1em 0; }
#logmsg pre { background: #eee; padding: 1em; }
#logmsg blockquote { border: 1px solid #fa0; border-left-width: 10px; padding: 1em 1em 0 1em; background: white;}
#logmsg dl { margin: 0; }
#logmsg dt { font-weight: bold; }
#logmsg dd { margin: 0; padding: 0 0 0.5em 0; }
#logmsg dd:before { content:'\00bb';}
#logmsg table { border-spacing: 0px; border-collapse: collapse; border-top: 4px solid #fa0; border-bottom: 1px solid #fa0; background: #fff; }
#logmsg table th { text-align: left; font-weight: normal; padding: 0.2em 0.5em; border-top: 1px dotted #fa0; }
#logmsg table td { text-align: right; border-top: 1px dotted #fa0; padding: 0.2em 0.5em; }
#logmsg table thead th { text-align: center; border-bottom: 1px solid #fa0; }
#logmsg table th.Corner { text-align: left; }
#logmsg hr { border: none 0; border-top: 2px dashed #fa0; height: 1px; }
#header, #footer { color: #fff; background: #636; border: 1px #300 solid; padding: 6px; }
#patch { width: 100%; }
#patch h4 {font-family: verdana,arial,helvetica,sans-serif;font-size:10pt;padding:8px;background:#369;color:#fff;margin:0;}
#patch .propset h4, #patch .binary h4 {margin:0;}
#patch pre {padding:0;line-height:1.2em;margin:0;}
#patch .diff {width:100%;background:#eee;padding: 0 0 10px 0;overflow:auto;}
#patch .propset .diff, #patch .binary .diff {padding:10px 0;}
#patch span {display:block;padding:0 10px;}
#patch .modfile, #patch .addfile, #patch .delfile, #patch .propset, #patch .binary, #patch .copfile {border:1px solid #ccc;margin:10px 0;}
#patch ins {background:#dfd;text-decoration:none;display:block;padding:0 10px;}
#patch del {background:#fdd;text-decoration:none;display:block;padding:0 10px;}
#patch .lines, .info {color:#888;background:#fff;}
--></style>
<div id="msg">
<dl class="meta">
<dt>Revision</dt> <dd><a href="http://trac.webkit.org/projects/webkit/changeset/167182">167182</a></dd>
<dt>Author</dt> <dd>fpizlo@apple.com</dd>
<dt>Date</dt> <dd>2014-04-12 11:22:27 -0700 (Sat, 12 Apr 2014)</dd>
</dl>
<h3>Log Message</h3>
<pre>DFG::FixupPhase should insert conversion nodes after the rest of fixup so that we know how the types settled
https://bugs.webkit.org/show_bug.cgi?id=131424
Reviewed by Geoffrey Garen.
This defers type conversion injection until we've decided on types. This makes the
process of deciding types a bit more flexible - for example we can naturally fixpoint
and change our minds. Only when things are settled do we actually insert conversions.
This is a necessary prerequisite for keeping double, int52, and JSValue data flow
separate. A SetLocal/GetLocal will appear to be JSValue until we fixpoint and realize
that there are typed uses. If we were eagerly inserting type conversions then we would
first insert a to/from-JSValue conversion in some cases only to then replace it by
the other conversions. It's probably trivial to remove those redundant conversions later
but I think it's better if we don't insert them to begin with.
* bytecode/CodeOrigin.h:
(JSC::CodeOrigin::operator!):
* dfg/DFGFixupPhase.cpp:
(JSC::DFG::FixupPhase::run):
(JSC::DFG::FixupPhase::fixupBlock):
(JSC::DFG::FixupPhase::fixupNode):
(JSC::DFG::FixupPhase::fixupSetLocalsInBlock):
(JSC::DFG::FixupPhase::fixEdge):
(JSC::DFG::FixupPhase::fixIntEdge):
(JSC::DFG::FixupPhase::injectTypeConversionsInBlock):
(JSC::DFG::FixupPhase::injectTypeConversionsForEdge):
(JSC::DFG::FixupPhase::addRequiredPhantom):
(JSC::DFG::FixupPhase::addPhantomsIfNecessary):
(JSC::DFG::FixupPhase::clearPhantomsAtEnd):
(JSC::DFG::FixupPhase::observeUntypedEdge): Deleted.
(JSC::DFG::FixupPhase::fixupUntypedSetLocalsInBlock): Deleted.
(JSC::DFG::FixupPhase::injectInt32ToDoubleNode): Deleted.</pre>
<h3>Modified Paths</h3>
<ul>
<li><a href="#trunkSourceJavaScriptCoreChangeLog">trunk/Source/JavaScriptCore/ChangeLog</a></li>
<li><a href="#trunkSourceJavaScriptCorebytecodeCodeOriginh">trunk/Source/JavaScriptCore/bytecode/CodeOrigin.h</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGFixupPhasecpp">trunk/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp</a></li>
</ul>
</div>
<div id="patch">
<h3>Diff</h3>
<a id="trunkSourceJavaScriptCoreChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/ChangeLog (167181 => 167182)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/ChangeLog 2014-04-12 05:59:34 UTC (rev 167181)
+++ trunk/Source/JavaScriptCore/ChangeLog 2014-04-12 18:22:27 UTC (rev 167182)
</span><span class="lines">@@ -1,3 +1,39 @@
</span><ins>+2014-04-11 Filip Pizlo <fpizlo@apple.com>
+
+ DFG::FixupPhase should insert conversion nodes after the rest of fixup so that we know how the types settled
+ https://bugs.webkit.org/show_bug.cgi?id=131424
+
+ Reviewed by Geoffrey Garen.
+
+ This defers type conversion injection until we've decided on types. This makes the
+ process of deciding types a bit more flexible - for example we can naturally fixpoint
+ and change our minds. Only when things are settled do we actually insert conversions.
+
+ This is a necessary prerequisite for keeping double, int52, and JSValue data flow
+ separate. A SetLocal/GetLocal will appear to be JSValue until we fixpoint and realize
+ that there are typed uses. If we were eagerly inserting type conversions then we would
+ first insert a to/from-JSValue conversion in some cases only to then replace it by
+ the other conversions. It's probably trivial to remove those redundant conversions later
+ but I think it's better if we don't insert them to begin with.
+
+ * bytecode/CodeOrigin.h:
+ (JSC::CodeOrigin::operator!):
+ * dfg/DFGFixupPhase.cpp:
+ (JSC::DFG::FixupPhase::run):
+ (JSC::DFG::FixupPhase::fixupBlock):
+ (JSC::DFG::FixupPhase::fixupNode):
+ (JSC::DFG::FixupPhase::fixupSetLocalsInBlock):
+ (JSC::DFG::FixupPhase::fixEdge):
+ (JSC::DFG::FixupPhase::fixIntEdge):
+ (JSC::DFG::FixupPhase::injectTypeConversionsInBlock):
+ (JSC::DFG::FixupPhase::injectTypeConversionsForEdge):
+ (JSC::DFG::FixupPhase::addRequiredPhantom):
+ (JSC::DFG::FixupPhase::addPhantomsIfNecessary):
+ (JSC::DFG::FixupPhase::clearPhantomsAtEnd):
+ (JSC::DFG::FixupPhase::observeUntypedEdge): Deleted.
+ (JSC::DFG::FixupPhase::fixupUntypedSetLocalsInBlock): Deleted.
+ (JSC::DFG::FixupPhase::injectInt32ToDoubleNode): Deleted.
+
</ins><span class="cx"> 2014-04-11 Brian J. Burg <burg@cs.washington.edu>
</span><span class="cx">
</span><span class="cx"> Web Replay: code generator should consider enclosing class when computing duplicate type names
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorebytecodeCodeOriginh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/bytecode/CodeOrigin.h (167181 => 167182)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/bytecode/CodeOrigin.h 2014-04-12 05:59:34 UTC (rev 167181)
+++ trunk/Source/JavaScriptCore/bytecode/CodeOrigin.h 2014-04-12 18:22:27 UTC (rev 167182)
</span><span class="lines">@@ -75,6 +75,7 @@
</span><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> bool isSet() const { return bytecodeIndex != invalidBytecodeIndex; }
</span><ins>+ bool operator!() const { return !isSet(); }
</ins><span class="cx">
</span><span class="cx"> bool isHashTableDeletedValue() const
</span><span class="cx"> {
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGFixupPhasecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp (167181 => 167182)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp 2014-04-12 05:59:34 UTC (rev 167181)
+++ trunk/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp 2014-04-12 18:22:27 UTC (rev 167182)
</span><span class="lines">@@ -65,7 +65,7 @@
</span><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> for (BlockIndex blockIndex = 0; blockIndex < m_graph.numBlocks(); ++blockIndex)
</span><del>- fixupUntypedSetLocalsInBlock(m_graph.block(blockIndex));
</del><ins>+ injectTypeConversionsInBlock(m_graph.block(blockIndex));
</ins><span class="cx">
</span><span class="cx"> return true;
</span><span class="cx"> }
</span><span class="lines">@@ -79,8 +79,10 @@
</span><span class="cx"> m_block = block;
</span><span class="cx"> for (m_indexInBlock = 0; m_indexInBlock < block->size(); ++m_indexInBlock) {
</span><span class="cx"> m_currentNode = block->at(m_indexInBlock);
</span><ins>+ addPhantomsIfNecessary();
</ins><span class="cx"> fixupNode(m_currentNode);
</span><span class="cx"> }
</span><ins>+ clearPhantomsAtEnd();
</ins><span class="cx"> m_insertionSet.execute(block);
</span><span class="cx"> }
</span><span class="cx">
</span><span class="lines">@@ -244,11 +246,8 @@
</span><span class="cx"> node->setArithMode(Arith::CheckOverflowAndNegativeZero);
</span><span class="cx"> break;
</span><span class="cx"> }
</span><del>- Edge child1 = node->child1();
- Edge child2 = node->child2();
-
- injectInt32ToDoubleNode(node->child1());
- injectInt32ToDoubleNode(node->child2());
</del><ins>+ fixEdge<NumberUse>(node->child1());
+ fixEdge<NumberUse>(node->child2());
</ins><span class="cx">
</span><span class="cx"> // We don't need to do ref'ing on the children because we're stealing them from
</span><span class="cx"> // the original division.
</span><span class="lines">@@ -261,8 +260,6 @@
</span><span class="cx"> node->setArithMode(Arith::CheckOverflow);
</span><span class="cx"> else
</span><span class="cx"> node->setArithMode(Arith::CheckOverflowAndNegativeZero);
</span><del>-
- m_insertionSet.insertNode(m_indexInBlock + 1, SpecNone, Phantom, node->origin, child1, child2);
</del><span class="cx"> break;
</span><span class="cx"> }
</span><span class="cx"> fixEdge<NumberUse>(node->child1());
</span><span class="lines">@@ -1070,36 +1067,8 @@
</span><span class="cx"> break;
</span><span class="cx"> #endif
</span><span class="cx"> }
</span><del>-
- if (!node->containsMovHint())
- DFG_NODE_DO_TO_CHILDREN(m_graph, node, observeUntypedEdge);
-
- if (node->isTerminal()) {
- // Terminal nodes don't need post-phantoms, and inserting them would violate
- // the current requirement that a terminal is the last thing in a block. We
- // should eventually change that requirement but even if we did, this would
- // still be a valid optimization. All terminals accept just one input, and
- // if that input is a conversion node then no further speculations will be
- // performed.
- // FIXME: Get rid of this by allowing Phantoms after terminals.
- // https://bugs.webkit.org/show_bug.cgi?id=126778
- m_requiredPhantoms.resize(0);
- // Since StoreBarriers are recursively fixed up so that their children look
- // identical to that of the node they're barrier-ing, we need to avoid adding
- // any Phantoms when processing them because this would invalidate the
- // InsertionSet's invariant of inserting things in a monotonically increasing
- // order. This should be okay anyways because StoreBarriers can't exit.
- } else
- addPhantomsIfNecessary();
</del><span class="cx"> }
</span><span class="cx">
</span><del>- void observeUntypedEdge(Node*, Edge& edge)
- {
- if (edge.useKind() != UntypedUse)
- return;
- fixEdge<UntypedUse>(edge);
- }
-
</del><span class="cx"> template<UseKind useKind>
</span><span class="cx"> void createToString(Node* node, Edge& edge)
</span><span class="cx"> {
</span><span class="lines">@@ -1376,30 +1345,10 @@
</span><span class="cx"> RELEASE_ASSERT_NOT_REACHED();
</span><span class="cx"> break;
</span><span class="cx"> }
</span><del>- addPhantomsIfNecessary();
</del><span class="cx"> }
</span><span class="cx"> m_insertionSet.execute(block);
</span><span class="cx"> }
</span><span class="cx">
</span><del>- void fixupUntypedSetLocalsInBlock(BasicBlock* block)
- {
- if (!block)
- return;
- ASSERT(block->isReachable);
- m_block = block;
- for (m_indexInBlock = 0; m_indexInBlock < block->size(); ++m_indexInBlock) {
- Node* node = m_currentNode = block->at(m_indexInBlock);
- if (node->op() != SetLocal)
- continue;
-
- if (node->child1().useKind() == UntypedUse) {
- fixEdge<UntypedUse>(node->child1());
- addPhantomsIfNecessary();
- }
- }
- m_insertionSet.execute(block);
- }
-
</del><span class="cx"> Node* checkArray(ArrayMode arrayMode, const NodeOrigin& origin, Node* array, Node* index, bool (*storageCheck)(const ArrayMode&) = canCSEStorage)
</span><span class="cx"> {
</span><span class="cx"> ASSERT(arrayMode.isSpecific());
</span><span class="lines">@@ -1546,92 +1495,10 @@
</span><span class="cx"> }
</span><span class="cx"> }
</span><span class="cx">
</span><del>- // Set the use kind of the edge and perform any actions that need to be done for
- // that use kind, like inserting intermediate conversion nodes. Never call this
- // with useKind = UntypedUse explicitly; edges have UntypedUse implicitly and any
- // edge that survives fixup and still has UntypedUse will have this method called
- // from observeUntypedEdge(). Also, make sure that if you do change the type of an
- // edge, you either call fixEdge() or perform the equivalent functionality
- // yourself. Obviously, you should have a really good reason if you do the latter.
</del><span class="cx"> template<UseKind useKind>
</span><span class="cx"> void fixEdge(Edge& edge)
</span><span class="cx"> {
</span><del>- if (isDouble(useKind)) {
- if (edge->shouldSpeculateInt32ForArithmetic()) {
- injectInt32ToDoubleNode(edge, useKind);
- return;
- }
-
- if (enableInt52() && edge->shouldSpeculateMachineInt()) {
- // Make all double uses of int52 values have an intermediate Int52ToDouble.
- // This is for the same reason as Int52ToValue (see below) except that
- // Int8ToDouble will convert int52's that fit in an int32 into a double
- // rather than trying to create a boxed int32 like Int52ToValue does.
-
- m_requiredPhantoms.append(edge.node());
- Node* result = m_insertionSet.insertNode(
- m_indexInBlock, SpecInt52AsDouble, Int52ToDouble,
- m_currentNode->origin, Edge(edge.node(), NumberUse));
- edge = Edge(result, useKind);
- return;
- }
- }
-
- if (enableInt52() && useKind != MachineIntUse
- && edge->shouldSpeculateMachineInt() && !edge->shouldSpeculateInt32()) {
- // We make all non-int52 uses of int52 values have an intermediate Int52ToValue
- // node to ensure that we handle this properly:
- //
- // a: SomeInt52
- // b: ArithAdd(@a, ...)
- // c: Call(..., @a)
- // d: ArithAdd(@a, ...)
- //
- // Without an intermediate node and just labeling the uses, we will get:
- //
- // a: SomeInt52
- // b: ArithAdd(Int52:@a, ...)
- // c: Call(..., Untyped:@a)
- // d: ArithAdd(Int52:@a, ...)
- //
- // And now the c->Untyped:@a edge will box the value of @a into a double. This
- // is bad, because now the d->Int52:@a edge will either have to do double-to-int
- // conversions, or will have to OSR exit unconditionally. Alternatively we could
- // have the c->Untyped:@a edge box the value by copying rather than in-place.
- // But these boxings are also costly so this wouldn't be great.
- //
- // The solution we use is to always have non-Int52 uses of predicted Int52's use
- // an intervening Int52ToValue node:
- //
- // a: SomeInt52
- // b: ArithAdd(Int52:@a, ...)
- // x: Int52ToValue(Int52:@a)
- // c: Call(..., Untyped:@x)
- // d: ArithAdd(Int52:@a, ...)
- //
- // Note that even if we had multiple non-int52 uses of @a, the multiple
- // Int52ToValue's would get CSE'd together. So the boxing would only happen once.
- // At the same time, @a would continue to be represented as a native int52.
- //
- // An alternative would have been to insert ToNativeInt52 nodes on int52 uses of
- // int52's. This would have handled the above example but would fall over for:
- //
- // a: SomeInt52
- // b: Call(..., @a)
- // c: ArithAdd(@a, ...)
- //
- // But the solution we use handles the above gracefully.
-
- m_requiredPhantoms.append(edge.node());
- Node* result = m_insertionSet.insertNode(
- m_indexInBlock, SpecInt52, Int52ToValue,
- m_currentNode->origin, Edge(edge.node(), UntypedUse));
- edge = Edge(result, useKind);
- return;
- }
-
</del><span class="cx"> observeUseKindOnNode<useKind>(edge.node());
</span><del>-
</del><span class="cx"> edge.setUseKind(useKind);
</span><span class="cx"> }
</span><span class="cx">
</span><span class="lines">@@ -1664,20 +1531,9 @@
</span><span class="cx"> observeUseKindOnNode(node, useKind);
</span><span class="cx">
</span><span class="cx"> edge = Edge(newNode, KnownInt32Use);
</span><del>- m_requiredPhantoms.append(node);
</del><ins>+ addRequiredPhantom(node);
</ins><span class="cx"> }
</span><span class="cx">
</span><del>- void injectInt32ToDoubleNode(Edge& edge, UseKind useKind = NumberUse)
- {
- m_requiredPhantoms.append(edge.node());
-
- Node* result = m_insertionSet.insertNode(
- m_indexInBlock, SpecInt52AsDouble, Int32ToDouble,
- m_currentNode->origin, Edge(edge.node(), NumberUse));
-
- edge = Edge(result, useKind);
- }
-
</del><span class="cx"> void truncateConstantToInt32(Edge& edge)
</span><span class="cx"> {
</span><span class="cx"> Node* oldNode = edge.node();
</span><span class="lines">@@ -1858,25 +1714,163 @@
</span><span class="cx"> return true;
</span><span class="cx"> }
</span><span class="cx">
</span><ins>+ void injectTypeConversionsInBlock(BasicBlock* block)
+ {
+ if (!block)
+ return;
+ ASSERT(block->isReachable);
+ m_block = block;
+ for (m_indexInBlock = 0; m_indexInBlock < block->size(); ++m_indexInBlock) {
+ m_currentNode = block->at(m_indexInBlock);
+ addPhantomsIfNecessary();
+ if (m_currentNode->containsMovHint())
+ continue;
+ DFG_NODE_DO_TO_CHILDREN(m_graph, m_currentNode, injectTypeConversionsForEdge);
+ }
+ clearPhantomsAtEnd();
+ m_insertionSet.execute(block);
+ }
+
+ void injectTypeConversionsForEdge(Node* node, Edge& edge)
+ {
+ ASSERT(node == m_currentNode);
+
+ if (isDouble(edge.useKind())) {
+ if (edge->shouldSpeculateInt32ForArithmetic()) {
+ addRequiredPhantom(edge.node());
+
+ Node* result = m_insertionSet.insertNode(
+ m_indexInBlock, SpecInt52AsDouble, Int32ToDouble,
+ node->origin, Edge(edge.node(), NumberUse));
+
+ edge.setNode(result);
+ return;
+ }
+
+ if (enableInt52() && edge->shouldSpeculateMachineInt()) {
+ // Make all double uses of int52 values have an intermediate Int52ToDouble.
+ // This is for the same reason as Int52ToValue (see below) except that
+ // Int8ToDouble will convert int52's that fit in an int32 into a double
+ // rather than trying to create a boxed int32 like Int52ToValue does.
+
+ addRequiredPhantom(edge.node());
+ Node* result = m_insertionSet.insertNode(
+ m_indexInBlock, SpecInt52AsDouble, Int52ToDouble,
+ node->origin, Edge(edge.node(), NumberUse));
+ edge.setNode(result);
+ return;
+ }
+ }
+
+ if (enableInt52() && edge.useKind() != MachineIntUse
+ && edge->shouldSpeculateMachineInt() && !edge->shouldSpeculateInt32()) {
+ // We make all non-int52 uses of int52 values have an intermediate Int52ToValue
+ // node to ensure that we handle this properly:
+ //
+ // a: SomeInt52
+ // b: ArithAdd(@a, ...)
+ // c: Call(..., @a)
+ // d: ArithAdd(@a, ...)
+ //
+ // Without an intermediate node and just labeling the uses, we will get:
+ //
+ // a: SomeInt52
+ // b: ArithAdd(Int52:@a, ...)
+ // c: Call(..., Untyped:@a)
+ // d: ArithAdd(Int52:@a, ...)
+ //
+ // And now the c->Untyped:@a edge will box the value of @a into a double. This
+ // is bad, because now the d->Int52:@a edge will either have to do double-to-int
+ // conversions, or will have to OSR exit unconditionally. Alternatively we could
+ // have the c->Untyped:@a edge box the value by copying rather than in-place.
+ // But these boxings are also costly so this wouldn't be great.
+ //
+ // The solution we use is to always have non-Int52 uses of predicted Int52's use
+ // an intervening Int52ToValue node:
+ //
+ // a: SomeInt52
+ // b: ArithAdd(Int52:@a, ...)
+ // x: Int52ToValue(Int52:@a)
+ // c: Call(..., Untyped:@x)
+ // d: ArithAdd(Int52:@a, ...)
+ //
+ // Note that even if we had multiple non-int52 uses of @a, the multiple
+ // Int52ToValue's would get CSE'd together. So the boxing would only happen once.
+ // At the same time, @a would continue to be represented as a native int52.
+ //
+ // An alternative would have been to insert ToNativeInt52 nodes on int52 uses of
+ // int52's. This would have handled the above example but would fall over for:
+ //
+ // a: SomeInt52
+ // b: Call(..., @a)
+ // c: ArithAdd(@a, ...)
+ //
+ // But the solution we use handles the above gracefully.
+
+ addRequiredPhantom(edge.node());
+ Node* result = m_insertionSet.insertNode(
+ m_indexInBlock, SpecInt52, Int52ToValue,
+ node->origin, Edge(edge.node(), UntypedUse));
+ edge.setNode(result);
+ return;
+ }
+ }
+
+ void addRequiredPhantom(Node* node)
+ {
+ if (!m_codeOriginOfPhantoms) {
+ ASSERT(m_requiredPhantoms.isEmpty());
+ m_codeOriginOfPhantoms = m_currentNode->origin.forExit;
+ } else {
+ ASSERT(!m_requiredPhantoms.isEmpty());
+ ASSERT(m_codeOriginOfPhantoms == m_currentNode->origin.forExit);
+ }
+
+ m_requiredPhantoms.append(node);
+ }
+
</ins><span class="cx"> void addPhantomsIfNecessary()
</span><span class="cx"> {
</span><span class="cx"> if (m_requiredPhantoms.isEmpty())
</span><span class="cx"> return;
</span><span class="cx">
</span><ins>+ RELEASE_ASSERT(!!m_codeOriginOfPhantoms);
+
+ if (m_currentNode->origin.forExit == m_codeOriginOfPhantoms)
+ return;
+
</ins><span class="cx"> for (unsigned i = m_requiredPhantoms.size(); i--;) {
</span><span class="cx"> m_insertionSet.insertNode(
</span><del>- m_indexInBlock + 1, SpecNone, Phantom, m_currentNode->origin,
</del><ins>+ m_indexInBlock, SpecNone, Phantom, NodeOrigin(m_codeOriginOfPhantoms),
</ins><span class="cx"> Edge(m_requiredPhantoms[i], UntypedUse));
</span><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> m_requiredPhantoms.resize(0);
</span><ins>+ m_codeOriginOfPhantoms = CodeOrigin();
</ins><span class="cx"> }
</span><del>-
</del><ins>+
+ void clearPhantomsAtEnd()
+ {
+ // Terminal nodes don't need post-phantoms, and inserting them would violate
+ // the current requirement that a terminal is the last thing in a block. We
+ // should eventually change that requirement but even if we did, this would
+ // still be a valid optimization. All terminals accept just one input, and
+ // if that input is a conversion node then no further speculations will be
+ // performed.
+
+ // FIXME: Get rid of this by allowing Phantoms after terminals.
+ // https://bugs.webkit.org/show_bug.cgi?id=126778
+
+ m_requiredPhantoms.resize(0);
+ m_codeOriginOfPhantoms = CodeOrigin();
+ }
+
</ins><span class="cx"> BasicBlock* m_block;
</span><span class="cx"> unsigned m_indexInBlock;
</span><span class="cx"> Node* m_currentNode;
</span><span class="cx"> InsertionSet m_insertionSet;
</span><span class="cx"> bool m_profitabilityChanged;
</span><ins>+ CodeOrigin m_codeOriginOfPhantoms;
</ins><span class="cx"> Vector<Node*, 3> m_requiredPhantoms;
</span><span class="cx"> };
</span><span class="cx">
</span></span></pre>
</div>
</div>
</body>
</html>