<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"
"http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head><meta http-equiv="content-type" content="text/html; charset=utf-8" />
<title>[183497] trunk/Source/JavaScriptCore</title>
</head>
<body>
<style type="text/css"><!--
#msg dl.meta { border: 1px #006 solid; background: #369; padding: 6px; color: #fff; }
#msg dl.meta dt { float: left; width: 6em; font-weight: bold; }
#msg dt:after { content:':';}
#msg dl, #msg dt, #msg ul, #msg li, #header, #footer, #logmsg { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; }
#msg dl a { font-weight: bold}
#msg dl a:link { color:#fc3; }
#msg dl a:active { color:#ff0; }
#msg dl a:visited { color:#cc6; }
h3 { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; font-weight: bold; }
#msg pre { overflow: auto; background: #ffc; border: 1px #fa0 solid; padding: 6px; }
#logmsg { background: #ffc; border: 1px #fa0 solid; padding: 1em 1em 0 1em; }
#logmsg p, #logmsg pre, #logmsg blockquote { margin: 0 0 1em 0; }
#logmsg p, #logmsg li, #logmsg dt, #logmsg dd { line-height: 14pt; }
#logmsg h1, #logmsg h2, #logmsg h3, #logmsg h4, #logmsg h5, #logmsg h6 { margin: .5em 0; }
#logmsg h1:first-child, #logmsg h2:first-child, #logmsg h3:first-child, #logmsg h4:first-child, #logmsg h5:first-child, #logmsg h6:first-child { margin-top: 0; }
#logmsg ul, #logmsg ol { padding: 0; list-style-position: inside; margin: 0 0 0 1em; }
#logmsg ul { text-indent: -1em; padding-left: 1em; }#logmsg ol { text-indent: -1.5em; padding-left: 1.5em; }
#logmsg > ul, #logmsg > ol { margin: 0 0 1em 0; }
#logmsg pre { background: #eee; padding: 1em; }
#logmsg blockquote { border: 1px solid #fa0; border-left-width: 10px; padding: 1em 1em 0 1em; background: white;}
#logmsg dl { margin: 0; }
#logmsg dt { font-weight: bold; }
#logmsg dd { margin: 0; padding: 0 0 0.5em 0; }
#logmsg dd:before { content:'\00bb';}
#logmsg table { border-spacing: 0px; border-collapse: collapse; border-top: 4px solid #fa0; border-bottom: 1px solid #fa0; background: #fff; }
#logmsg table th { text-align: left; font-weight: normal; padding: 0.2em 0.5em; border-top: 1px dotted #fa0; }
#logmsg table td { text-align: right; border-top: 1px dotted #fa0; padding: 0.2em 0.5em; }
#logmsg table thead th { text-align: center; border-bottom: 1px solid #fa0; }
#logmsg table th.Corner { text-align: left; }
#logmsg hr { border: none 0; border-top: 2px dashed #fa0; height: 1px; }
#header, #footer { color: #fff; background: #636; border: 1px #300 solid; padding: 6px; }
#patch { width: 100%; }
#patch h4 {font-family: verdana,arial,helvetica,sans-serif;font-size:10pt;padding:8px;background:#369;color:#fff;margin:0;}
#patch .propset h4, #patch .binary h4 {margin:0;}
#patch pre {padding:0;line-height:1.2em;margin:0;}
#patch .diff {width:100%;background:#eee;padding: 0 0 10px 0;overflow:auto;}
#patch .propset .diff, #patch .binary .diff {padding:10px 0;}
#patch span {display:block;padding:0 10px;}
#patch .modfile, #patch .addfile, #patch .delfile, #patch .propset, #patch .binary, #patch .copfile {border:1px solid #ccc;margin:10px 0;}
#patch ins {background:#dfd;text-decoration:none;display:block;padding:0 10px;}
#patch del {background:#fdd;text-decoration:none;display:block;padding:0 10px;}
#patch .lines, .info {color:#888;background:#fff;}
--></style>
<div id="msg">
<dl class="meta">
<dt>Revision</dt> <dd><a href="http://trac.webkit.org/projects/webkit/changeset/183497">183497</a></dd>
<dt>Author</dt> <dd>fpizlo@apple.com</dd>
<dt>Date</dt> <dd>2015-04-28 12:27:23 -0700 (Tue, 28 Apr 2015)</dd>
</dl>
<h3>Log Message</h3>
<pre>DFG should not use or preserve Phantoms during transformations
https://bugs.webkit.org/show_bug.cgi?id=143736
Reviewed by Geoffrey Garen.
Since http://trac.webkit.org/changeset/183207 and http://trac.webkit.org/changeset/183406, it is
no longer necessary to preserve Phantoms during transformations. They are still useful just
before FixupPhase to support backwards propagation analyses. They are still inserted late in the
game in the DFG backend. But transformations don't need to worry about them. Inside a basic
block, we can be sure that so long as the IR pinpoints the place where the value becomes
available in a bytecode register (using MovHint) and so long as there is a SetLocal anytime some
other block would need the value (either for OSR or for DFG execution), then we don't need any
liveness markers.
So, this removes any places where we inserted Phantoms just for liveness during transformation
and it replaces convertToPhantom() with remove(), which just converts the node to a Check. A
Check node only keeps its children so long as those children have checks.
The fact that we no longer convertToPhantom() means that we have to be more careful when
constant-folding GetLocal. Previously we would convertToPhantom() and use the fact that
Phantom(Phi) was a valid construct. It's not valid anymore. So, when constant folding encounters
a GetLocal it needs to insert a PhantomLocal directly. This allows us to simplify
Graph::convertToConstant() a bit. Luckily, none of the other users of this method would see
GetLocals.
The only Phantom-like cruft left over after this patch is:
- Phantoms before FixupPhase. I kind of like these. It means that before FixupPhase, we can do
backwards analyses and rely on the fact that the users of a node in DFG IR are a superset of
the users of the original local's live range in bytecode. This is essential for supporting our
BackwardsPropagationPhase, which is an important optimization for things like asm.js.
- PhantomLocals and GetLocals being NodeMustGenerate. See discussion in
https://bugs.webkit.org/show_bug.cgi?id=144086. It appears that this is not as evil as the
alternatives. The best long-term plan is to simply ditch the ThreadedCPS IR entirely and have
the DFG use SSA. For now, so long as any new DFG optimizations we add are block-local and
treat GetLocal/SetLocal conservatively, this should all be sound.
This change should be perf-neutral although it does reduce the total work that the compiler
does.
* CMakeLists.txt:
* JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
* JavaScriptCore.xcodeproj/project.pbxproj:
* dfg/DFGAdjacencyList.h:
(JSC::DFG::AdjacencyList::justChecks):
* dfg/DFGArgumentsEliminationPhase.cpp:
* dfg/DFGBasicBlock.cpp:
(JSC::DFG::BasicBlock::replaceTerminal):
* dfg/DFGBasicBlock.h:
(JSC::DFG::BasicBlock::findTerminal):
* dfg/DFGCFGSimplificationPhase.cpp:
(JSC::DFG::CFGSimplificationPhase::keepOperandAlive):
(JSC::DFG::CFGSimplificationPhase::mergeBlocks):
* dfg/DFGCPSRethreadingPhase.cpp:
(JSC::DFG::CPSRethreadingPhase::CPSRethreadingPhase):
(JSC::DFG::CPSRethreadingPhase::clearVariables):
(JSC::DFG::CPSRethreadingPhase::canonicalizeFlushOrPhantomLocalFor):
(JSC::DFG::CPSRethreadingPhase::canonicalizeLocalsInBlock):
* dfg/DFGCSEPhase.cpp:
* dfg/DFGCleanUpPhase.cpp: Copied from Source/JavaScriptCore/dfg/DFGPhantomRemovalPhase.cpp.
(JSC::DFG::CleanUpPhase::CleanUpPhase):
(JSC::DFG::CleanUpPhase::run):
(JSC::DFG::performCleanUp):
(JSC::DFG::PhantomRemovalPhase::PhantomRemovalPhase): Deleted.
(JSC::DFG::PhantomRemovalPhase::run): Deleted.
(JSC::DFG::performPhantomRemoval): Deleted.
* dfg/DFGCleanUpPhase.h: Copied from Source/JavaScriptCore/dfg/DFGPhantomRemovalPhase.h.
* dfg/DFGConstantFoldingPhase.cpp:
(JSC::DFG::ConstantFoldingPhase::foldConstants):
(JSC::DFG::ConstantFoldingPhase::addBaseCheck):
(JSC::DFG::ConstantFoldingPhase::fixUpsilons):
* dfg/DFGDCEPhase.cpp:
(JSC::DFG::DCEPhase::run):
(JSC::DFG::DCEPhase::fixupBlock):
(JSC::DFG::DCEPhase::cleanVariables):
* dfg/DFGFixupPhase.cpp:
(JSC::DFG::FixupPhase::fixupBlock):
(JSC::DFG::FixupPhase::fixupNode):
(JSC::DFG::FixupPhase::convertStringAddUse):
(JSC::DFG::FixupPhase::attemptToMakeFastStringAdd):
(JSC::DFG::FixupPhase::checkArray):
(JSC::DFG::FixupPhase::fixIntConvertingEdge):
(JSC::DFG::FixupPhase::fixIntOrBooleanEdge):
(JSC::DFG::FixupPhase::fixDoubleOrBooleanEdge):
(JSC::DFG::FixupPhase::injectTypeConversionsInBlock):
(JSC::DFG::FixupPhase::tryToRelaxRepresentation):
(JSC::DFG::FixupPhase::injectTypeConversionsForEdge):
(JSC::DFG::FixupPhase::addRequiredPhantom): Deleted.
(JSC::DFG::FixupPhase::addPhantomsIfNecessary): Deleted.
* dfg/DFGGraph.cpp:
(JSC::DFG::Graph::convertToConstant):
(JSC::DFG::Graph::mergeRelevantToOSR): Deleted.
* dfg/DFGGraph.h:
* dfg/DFGInsertionSet.h:
(JSC::DFG::InsertionSet::insertCheck):
* dfg/DFGIntegerCheckCombiningPhase.cpp:
(JSC::DFG::IntegerCheckCombiningPhase::handleBlock):
* dfg/DFGLICMPhase.cpp:
(JSC::DFG::LICMPhase::attemptHoist):
* dfg/DFGNode.cpp:
(JSC::DFG::Node::remove):
* dfg/DFGNode.h:
(JSC::DFG::Node::replaceWith):
(JSC::DFG::Node::convertToPhantom): Deleted.
(JSC::DFG::Node::convertToCheck): Deleted.
(JSC::DFG::Node::willHaveCodeGenOrOSR): Deleted.
* dfg/DFGNodeFlags.h:
* dfg/DFGNodeType.h:
* dfg/DFGObjectAllocationSinkingPhase.cpp:
(JSC::DFG::ObjectAllocationSinkingPhase::lowerNonReadingOperationsOnPhantomAllocations):
(JSC::DFG::ObjectAllocationSinkingPhase::handleNode):
* dfg/DFGPhantomCanonicalizationPhase.cpp: Removed.
* dfg/DFGPhantomCanonicalizationPhase.h: Removed.
* dfg/DFGPhantomRemovalPhase.cpp: Removed.
* dfg/DFGPhantomRemovalPhase.h: Removed.
* dfg/DFGPlan.cpp:
(JSC::DFG::Plan::compileInThreadImpl):
* dfg/DFGPutStackSinkingPhase.cpp:
* dfg/DFGResurrectionForValidationPhase.cpp: Removed.
* dfg/DFGResurrectionForValidationPhase.h: Removed.
* dfg/DFGSSAConversionPhase.cpp:
(JSC::DFG::SSAConversionPhase::run):
* dfg/DFGSpeculativeJIT64.cpp:
(JSC::DFG::SpeculativeJIT::fillSpeculateDouble):
* dfg/DFGStoreBarrierElisionPhase.cpp:
(JSC::DFG::StoreBarrierElisionPhase::elideBarrier):
* dfg/DFGStrengthReductionPhase.cpp:
(JSC::DFG::StrengthReductionPhase::handleNode):
(JSC::DFG::StrengthReductionPhase::convertToIdentityOverChild):
* dfg/DFGValidate.cpp:
(JSC::DFG::Validate::validate):
(JSC::DFG::Validate::validateCPS):
(JSC::DFG::Validate::validateSSA):
* dfg/DFGVarargsForwardingPhase.cpp:
* ftl/FTLLink.cpp:
(JSC::FTL::link):
* ftl/FTLLowerDFGToLLVM.cpp:
(JSC::FTL::LowerDFGToLLVM::compileNode):
(JSC::FTL::LowerDFGToLLVM::compileNoOp):
(JSC::FTL::LowerDFGToLLVM::compilePhantom): Deleted.</pre>
<h3>Modified Paths</h3>
<ul>
<li><a href="#trunkSourceJavaScriptCoreCMakeListstxt">trunk/Source/JavaScriptCore/CMakeLists.txt</a></li>
<li><a href="#trunkSourceJavaScriptCoreChangeLog">trunk/Source/JavaScriptCore/ChangeLog</a></li>
<li><a href="#trunkSourceJavaScriptCoreJavaScriptCorevcxprojJavaScriptCorevcxproj">trunk/Source/JavaScriptCore/JavaScriptCore.vcxproj/JavaScriptCore.vcxproj</a></li>
<li><a href="#trunkSourceJavaScriptCoreJavaScriptCorexcodeprojprojectpbxproj">trunk/Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGAdjacencyListh">trunk/Source/JavaScriptCore/dfg/DFGAdjacencyList.h</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGArgumentsEliminationPhasecpp">trunk/Source/JavaScriptCore/dfg/DFGArgumentsEliminationPhase.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGBasicBlockcpp">trunk/Source/JavaScriptCore/dfg/DFGBasicBlock.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGBasicBlockh">trunk/Source/JavaScriptCore/dfg/DFGBasicBlock.h</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGCFGSimplificationPhasecpp">trunk/Source/JavaScriptCore/dfg/DFGCFGSimplificationPhase.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGCPSRethreadingPhasecpp">trunk/Source/JavaScriptCore/dfg/DFGCPSRethreadingPhase.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGCSEPhasecpp">trunk/Source/JavaScriptCore/dfg/DFGCSEPhase.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGConstantFoldingPhasecpp">trunk/Source/JavaScriptCore/dfg/DFGConstantFoldingPhase.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGDCEPhasecpp">trunk/Source/JavaScriptCore/dfg/DFGDCEPhase.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGFixupPhasecpp">trunk/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGGraphcpp">trunk/Source/JavaScriptCore/dfg/DFGGraph.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGGraphh">trunk/Source/JavaScriptCore/dfg/DFGGraph.h</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGInsertionSeth">trunk/Source/JavaScriptCore/dfg/DFGInsertionSet.h</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGIntegerCheckCombiningPhasecpp">trunk/Source/JavaScriptCore/dfg/DFGIntegerCheckCombiningPhase.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGLICMPhasecpp">trunk/Source/JavaScriptCore/dfg/DFGLICMPhase.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGNodecpp">trunk/Source/JavaScriptCore/dfg/DFGNode.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGNodeh">trunk/Source/JavaScriptCore/dfg/DFGNode.h</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGNodeFlagsh">trunk/Source/JavaScriptCore/dfg/DFGNodeFlags.h</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGNodeTypeh">trunk/Source/JavaScriptCore/dfg/DFGNodeType.h</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGObjectAllocationSinkingPhasecpp">trunk/Source/JavaScriptCore/dfg/DFGObjectAllocationSinkingPhase.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGPlancpp">trunk/Source/JavaScriptCore/dfg/DFGPlan.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGPutStackSinkingPhasecpp">trunk/Source/JavaScriptCore/dfg/DFGPutStackSinkingPhase.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGSSAConversionPhasecpp">trunk/Source/JavaScriptCore/dfg/DFGSSAConversionPhase.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGSpeculativeJIT64cpp">trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGStoreBarrierElisionPhasecpp">trunk/Source/JavaScriptCore/dfg/DFGStoreBarrierElisionPhase.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGStrengthReductionPhasecpp">trunk/Source/JavaScriptCore/dfg/DFGStrengthReductionPhase.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGValidatecpp">trunk/Source/JavaScriptCore/dfg/DFGValidate.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGVarargsForwardingPhasecpp">trunk/Source/JavaScriptCore/dfg/DFGVarargsForwardingPhase.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreftlFTLLinkcpp">trunk/Source/JavaScriptCore/ftl/FTLLink.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreftlFTLLowerDFGToLLVMcpp">trunk/Source/JavaScriptCore/ftl/FTLLowerDFGToLLVM.cpp</a></li>
</ul>
<h3>Added Paths</h3>
<ul>
<li><a href="#trunkSourceJavaScriptCoredfgDFGCleanUpPhasecpp">trunk/Source/JavaScriptCore/dfg/DFGCleanUpPhase.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGCleanUpPhaseh">trunk/Source/JavaScriptCore/dfg/DFGCleanUpPhase.h</a></li>
</ul>
<h3>Removed Paths</h3>
<ul>
<li><a href="#trunkSourceJavaScriptCoredfgDFGPhantomCanonicalizationPhasecpp">trunk/Source/JavaScriptCore/dfg/DFGPhantomCanonicalizationPhase.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGPhantomCanonicalizationPhaseh">trunk/Source/JavaScriptCore/dfg/DFGPhantomCanonicalizationPhase.h</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGPhantomRemovalPhasecpp">trunk/Source/JavaScriptCore/dfg/DFGPhantomRemovalPhase.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGPhantomRemovalPhaseh">trunk/Source/JavaScriptCore/dfg/DFGPhantomRemovalPhase.h</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGResurrectionForValidationPhasecpp">trunk/Source/JavaScriptCore/dfg/DFGResurrectionForValidationPhase.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGResurrectionForValidationPhaseh">trunk/Source/JavaScriptCore/dfg/DFGResurrectionForValidationPhase.h</a></li>
</ul>
</div>
<div id="patch">
<h3>Diff</h3>
<a id="trunkSourceJavaScriptCoreCMakeListstxt"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/CMakeLists.txt (183496 => 183497)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/CMakeLists.txt 2015-04-28 18:56:51 UTC (rev 183496)
+++ trunk/Source/JavaScriptCore/CMakeLists.txt 2015-04-28 19:27:23 UTC (rev 183497)
</span><span class="lines">@@ -138,6 +138,7 @@
</span><span class="cx"> dfg/DFGCPSRethreadingPhase.cpp
</span><span class="cx"> dfg/DFGCSEPhase.cpp
</span><span class="cx"> dfg/DFGCapabilities.cpp
</span><ins>+ dfg/DFGCleanUpPhase.cpp
</ins><span class="cx"> dfg/DFGClobberSet.cpp
</span><span class="cx"> dfg/DFGClobberize.cpp
</span><span class="cx"> dfg/DFGCommon.cpp
</span><span class="lines">@@ -202,9 +203,7 @@
</span><span class="cx"> dfg/DFGObjectAllocationSinkingPhase.cpp
</span><span class="cx"> dfg/DFGObjectMaterializationData.cpp
</span><span class="cx"> dfg/DFGOperations.cpp
</span><del>- dfg/DFGPhantomCanonicalizationPhase.cpp
</del><span class="cx"> dfg/DFGPhantomInsertionPhase.cpp
</span><del>- dfg/DFGPhantomRemovalPhase.cpp
</del><span class="cx"> dfg/DFGPhase.cpp
</span><span class="cx"> dfg/DFGPhiChildren.cpp
</span><span class="cx"> dfg/DFGPlan.cpp
</span><span class="lines">@@ -214,7 +213,6 @@
</span><span class="cx"> dfg/DFGPromotedHeapLocation.cpp
</span><span class="cx"> dfg/DFGPureValue.cpp
</span><span class="cx"> dfg/DFGPutStackSinkingPhase.cpp
</span><del>- dfg/DFGResurrectionForValidationPhase.cpp
</del><span class="cx"> dfg/DFGSSACalculator.cpp
</span><span class="cx"> dfg/DFGSSAConversionPhase.cpp
</span><span class="cx"> dfg/DFGSSALoweringPhase.cpp
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/ChangeLog (183496 => 183497)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/ChangeLog 2015-04-28 18:56:51 UTC (rev 183496)
+++ trunk/Source/JavaScriptCore/ChangeLog 2015-04-28 19:27:23 UTC (rev 183497)
</span><span class="lines">@@ -1,3 +1,147 @@
</span><ins>+2015-04-28 Filip Pizlo <fpizlo@apple.com>
+
+ DFG should not use or preserve Phantoms during transformations
+ https://bugs.webkit.org/show_bug.cgi?id=143736
+
+ Reviewed by Geoffrey Garen.
+
+ Since http://trac.webkit.org/changeset/183207 and http://trac.webkit.org/changeset/183406, it is
+ no longer necessary to preserve Phantoms during transformations. They are still useful just
+ before FixupPhase to support backwards propagation analyses. They are still inserted late in the
+ game in the DFG backend. But transformations don't need to worry about them. Inside a basic
+ block, we can be sure that so long as the IR pinpoints the place where the value becomes
+ available in a bytecode register (using MovHint) and so long as there is a SetLocal anytime some
+ other block would need the value (either for OSR or for DFG execution), then we don't need any
+ liveness markers.
+
+ So, this removes any places where we inserted Phantoms just for liveness during transformation
+ and it replaces convertToPhantom() with remove(), which just converts the node to a Check. A
+ Check node only keeps its children so long as those children have checks.
+
+ The fact that we no longer convertToPhantom() means that we have to be more careful when
+ constant-folding GetLocal. Previously we would convertToPhantom() and use the fact that
+ Phantom(Phi) was a valid construct. It's not valid anymore. So, when constant folding encounters
+ a GetLocal it needs to insert a PhantomLocal directly. This allows us to simplify
+ Graph::convertToConstant() a bit. Luckily, none of the other users of this method would see
+ GetLocals.
+
+ The only Phantom-like cruft left over after this patch is:
+
+ - Phantoms before FixupPhase. I kind of like these. It means that before FixupPhase, we can do
+ backwards analyses and rely on the fact that the users of a node in DFG IR are a superset of
+ the users of the original local's live range in bytecode. This is essential for supporting our
+ BackwardsPropagationPhase, which is an important optimization for things like asm.js.
+
+ - PhantomLocals and GetLocals being NodeMustGenerate. See discussion in
+ https://bugs.webkit.org/show_bug.cgi?id=144086. It appears that this is not as evil as the
+ alternatives. The best long-term plan is to simply ditch the ThreadedCPS IR entirely and have
+ the DFG use SSA. For now, so long as any new DFG optimizations we add are block-local and
+ treat GetLocal/SetLocal conservatively, this should all be sound.
+
+ This change should be perf-neutral although it does reduce the total work that the compiler
+ does.
+
+ * CMakeLists.txt:
+ * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+ * JavaScriptCore.xcodeproj/project.pbxproj:
+ * dfg/DFGAdjacencyList.h:
+ (JSC::DFG::AdjacencyList::justChecks):
+ * dfg/DFGArgumentsEliminationPhase.cpp:
+ * dfg/DFGBasicBlock.cpp:
+ (JSC::DFG::BasicBlock::replaceTerminal):
+ * dfg/DFGBasicBlock.h:
+ (JSC::DFG::BasicBlock::findTerminal):
+ * dfg/DFGCFGSimplificationPhase.cpp:
+ (JSC::DFG::CFGSimplificationPhase::keepOperandAlive):
+ (JSC::DFG::CFGSimplificationPhase::mergeBlocks):
+ * dfg/DFGCPSRethreadingPhase.cpp:
+ (JSC::DFG::CPSRethreadingPhase::CPSRethreadingPhase):
+ (JSC::DFG::CPSRethreadingPhase::clearVariables):
+ (JSC::DFG::CPSRethreadingPhase::canonicalizeFlushOrPhantomLocalFor):
+ (JSC::DFG::CPSRethreadingPhase::canonicalizeLocalsInBlock):
+ * dfg/DFGCSEPhase.cpp:
+ * dfg/DFGCleanUpPhase.cpp: Copied from Source/JavaScriptCore/dfg/DFGPhantomRemovalPhase.cpp.
+ (JSC::DFG::CleanUpPhase::CleanUpPhase):
+ (JSC::DFG::CleanUpPhase::run):
+ (JSC::DFG::performCleanUp):
+ (JSC::DFG::PhantomRemovalPhase::PhantomRemovalPhase): Deleted.
+ (JSC::DFG::PhantomRemovalPhase::run): Deleted.
+ (JSC::DFG::performPhantomRemoval): Deleted.
+ * dfg/DFGCleanUpPhase.h: Copied from Source/JavaScriptCore/dfg/DFGPhantomRemovalPhase.h.
+ * dfg/DFGConstantFoldingPhase.cpp:
+ (JSC::DFG::ConstantFoldingPhase::foldConstants):
+ (JSC::DFG::ConstantFoldingPhase::addBaseCheck):
+ (JSC::DFG::ConstantFoldingPhase::fixUpsilons):
+ * dfg/DFGDCEPhase.cpp:
+ (JSC::DFG::DCEPhase::run):
+ (JSC::DFG::DCEPhase::fixupBlock):
+ (JSC::DFG::DCEPhase::cleanVariables):
+ * dfg/DFGFixupPhase.cpp:
+ (JSC::DFG::FixupPhase::fixupBlock):
+ (JSC::DFG::FixupPhase::fixupNode):
+ (JSC::DFG::FixupPhase::convertStringAddUse):
+ (JSC::DFG::FixupPhase::attemptToMakeFastStringAdd):
+ (JSC::DFG::FixupPhase::checkArray):
+ (JSC::DFG::FixupPhase::fixIntConvertingEdge):
+ (JSC::DFG::FixupPhase::fixIntOrBooleanEdge):
+ (JSC::DFG::FixupPhase::fixDoubleOrBooleanEdge):
+ (JSC::DFG::FixupPhase::injectTypeConversionsInBlock):
+ (JSC::DFG::FixupPhase::tryToRelaxRepresentation):
+ (JSC::DFG::FixupPhase::injectTypeConversionsForEdge):
+ (JSC::DFG::FixupPhase::addRequiredPhantom): Deleted.
+ (JSC::DFG::FixupPhase::addPhantomsIfNecessary): Deleted.
+ * dfg/DFGGraph.cpp:
+ (JSC::DFG::Graph::convertToConstant):
+ (JSC::DFG::Graph::mergeRelevantToOSR): Deleted.
+ * dfg/DFGGraph.h:
+ * dfg/DFGInsertionSet.h:
+ (JSC::DFG::InsertionSet::insertCheck):
+ * dfg/DFGIntegerCheckCombiningPhase.cpp:
+ (JSC::DFG::IntegerCheckCombiningPhase::handleBlock):
+ * dfg/DFGLICMPhase.cpp:
+ (JSC::DFG::LICMPhase::attemptHoist):
+ * dfg/DFGNode.cpp:
+ (JSC::DFG::Node::remove):
+ * dfg/DFGNode.h:
+ (JSC::DFG::Node::replaceWith):
+ (JSC::DFG::Node::convertToPhantom): Deleted.
+ (JSC::DFG::Node::convertToCheck): Deleted.
+ (JSC::DFG::Node::willHaveCodeGenOrOSR): Deleted.
+ * dfg/DFGNodeFlags.h:
+ * dfg/DFGNodeType.h:
+ * dfg/DFGObjectAllocationSinkingPhase.cpp:
+ (JSC::DFG::ObjectAllocationSinkingPhase::lowerNonReadingOperationsOnPhantomAllocations):
+ (JSC::DFG::ObjectAllocationSinkingPhase::handleNode):
+ * dfg/DFGPhantomCanonicalizationPhase.cpp: Removed.
+ * dfg/DFGPhantomCanonicalizationPhase.h: Removed.
+ * dfg/DFGPhantomRemovalPhase.cpp: Removed.
+ * dfg/DFGPhantomRemovalPhase.h: Removed.
+ * dfg/DFGPlan.cpp:
+ (JSC::DFG::Plan::compileInThreadImpl):
+ * dfg/DFGPutStackSinkingPhase.cpp:
+ * dfg/DFGResurrectionForValidationPhase.cpp: Removed.
+ * dfg/DFGResurrectionForValidationPhase.h: Removed.
+ * dfg/DFGSSAConversionPhase.cpp:
+ (JSC::DFG::SSAConversionPhase::run):
+ * dfg/DFGSpeculativeJIT64.cpp:
+ (JSC::DFG::SpeculativeJIT::fillSpeculateDouble):
+ * dfg/DFGStoreBarrierElisionPhase.cpp:
+ (JSC::DFG::StoreBarrierElisionPhase::elideBarrier):
+ * dfg/DFGStrengthReductionPhase.cpp:
+ (JSC::DFG::StrengthReductionPhase::handleNode):
+ (JSC::DFG::StrengthReductionPhase::convertToIdentityOverChild):
+ * dfg/DFGValidate.cpp:
+ (JSC::DFG::Validate::validate):
+ (JSC::DFG::Validate::validateCPS):
+ (JSC::DFG::Validate::validateSSA):
+ * dfg/DFGVarargsForwardingPhase.cpp:
+ * ftl/FTLLink.cpp:
+ (JSC::FTL::link):
+ * ftl/FTLLowerDFGToLLVM.cpp:
+ (JSC::FTL::LowerDFGToLLVM::compileNode):
+ (JSC::FTL::LowerDFGToLLVM::compileNoOp):
+ (JSC::FTL::LowerDFGToLLVM::compilePhantom): Deleted.
+
</ins><span class="cx"> 2015-04-28 Andreas Kling <akling@apple.com>
</span><span class="cx">
</span><span class="cx"> DFG+FTL should generate efficient code for branching on a string's boolean value.
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreJavaScriptCorevcxprojJavaScriptCorevcxproj"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/JavaScriptCore.vcxproj/JavaScriptCore.vcxproj (183496 => 183497)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/JavaScriptCore.vcxproj/JavaScriptCore.vcxproj 2015-04-28 18:56:51 UTC (rev 183496)
+++ trunk/Source/JavaScriptCore/JavaScriptCore.vcxproj/JavaScriptCore.vcxproj 2015-04-28 19:27:23 UTC (rev 183497)
</span><span class="lines">@@ -380,6 +380,7 @@
</span><span class="cx"> <ClCompile Include="..\dfg\DFGCapabilities.cpp" />
</span><span class="cx"> <ClCompile Include="..\dfg\DFGCFAPhase.cpp" />
</span><span class="cx"> <ClCompile Include="..\dfg\DFGCFGSimplificationPhase.cpp" />
</span><ins>+ <ClCompile Include="..\dfg\DFGCleanUpPhase.cpp" />
</ins><span class="cx"> <ClCompile Include="..\dfg\DFGClobberize.cpp" />
</span><span class="cx"> <ClCompile Include="..\dfg\DFGClobberSet.cpp" />
</span><span class="cx"> <ClCompile Include="..\dfg\DFGCommon.cpp" />
</span><span class="lines">@@ -446,9 +447,7 @@
</span><span class="cx"> <ClCompile Include="..\dfg\DFGOSRExitPreparation.cpp" />
</span><span class="cx"> <ClCompile Include="..\dfg\DFGObjectAllocationSinkingPhase.cpp" />
</span><span class="cx"> <ClCompile Include="..\dfg\DFGObjectMaterializationData.cpp" />
</span><del>- <ClCompile Include="..\dfg\DFGPhantomCanonicalizationPhase.cpp" />
</del><span class="cx"> <ClCompile Include="..\dfg\DFGPhantomInsertionPhase.cpp" />
</span><del>- <ClCompile Include="..\dfg\DFGPhantomRemovalPhase.cpp" />
</del><span class="cx"> <ClCompile Include="..\dfg\DFGPhase.cpp" />
</span><span class="cx"> <ClCompile Include="..\dfg\DFGPhiChildren.cpp" />
</span><span class="cx"> <ClCompile Include="..\dfg\DFGPlan.cpp" />
</span><span class="lines">@@ -458,7 +457,6 @@
</span><span class="cx"> <ClCompile Include="..\dfg\DFGPromotedHeapLocation.cpp" />
</span><span class="cx"> <ClCompile Include="..\dfg\DFGPureValue.cpp" />
</span><span class="cx"> <ClCompile Include="..\dfg\DFGPutStackSinkingPhase.cpp" />
</span><del>- <ClCompile Include="..\dfg\DFGResurrectionForValidationPhase.cpp" />
</del><span class="cx"> <ClCompile Include="..\dfg\DFGSafepoint.cpp" />
</span><span class="cx"> <ClCompile Include="..\dfg\DFGSpeculativeJIT.cpp" />
</span><span class="cx"> <ClCompile Include="..\dfg\DFGSpeculativeJIT32_64.cpp" />
</span><span class="lines">@@ -1062,6 +1060,7 @@
</span><span class="cx"> <ClInclude Include="..\dfg\DFGCCallHelpers.h" />
</span><span class="cx"> <ClInclude Include="..\dfg\DFGCFAPhase.h" />
</span><span class="cx"> <ClInclude Include="..\dfg\DFGCFGSimplificationPhase.h" />
</span><ins>+ <ClInclude Include="..\dfg\DFGCleanUpPhase.h" />
</ins><span class="cx"> <ClInclude Include="..\dfg\DFGClobberize.h" />
</span><span class="cx"> <ClInclude Include="..\dfg\DFGClobberSet.h" />
</span><span class="cx"> <ClInclude Include="..\dfg\DFGCommon.h" />
</span><span class="lines">@@ -1142,9 +1141,7 @@
</span><span class="cx"> <ClInclude Include="..\dfg\DFGOSRExitCompilerCommon.h" />
</span><span class="cx"> <ClInclude Include="..\dfg\DFGOSRExitJumpPlaceholder.h" />
</span><span class="cx"> <ClInclude Include="..\dfg\DFGOSRExitPreparation.h" />
</span><del>- <ClInclude Include="..\dfg\DFGPhantomCanonicalizationPhase.h" />
</del><span class="cx"> <ClInclude Include="..\dfg\DFGPhantomInsertionPhase.h" />
</span><del>- <ClInclude Include="..\dfg\DFGPhantomRemovalPhase.h" />
</del><span class="cx"> <ClInclude Include="..\dfg\DFGPhase.h" />
</span><span class="cx"> <ClInclude Include="..\dfg\DFGPhiChildren.h" />
</span><span class="cx"> <ClInclude Include="..\dfg\DFGPlan.h" />
</span><span class="lines">@@ -1158,7 +1155,6 @@
</span><span class="cx"> <ClInclude Include="..\dfg\DFGPutStackSinkingPhase.h" />
</span><span class="cx"> <ClInclude Include="..\dfg\DFGRegisterBank.h" />
</span><span class="cx"> <ClInclude Include="..\dfg\DFGRegisterSet.h" />
</span><del>- <ClInclude Include="..\dfg\DFGResurrectionForValidationPhase.h" />
</del><span class="cx"> <ClInclude Include="..\dfg\DFGSafeToExecute.h" />
</span><span class="cx"> <ClInclude Include="..\dfg\DFGSafepoint.h" />
</span><span class="cx"> <ClInclude Include="..\dfg\DFGSaneStringGetByValSlowPathGenerator.h" />
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreJavaScriptCorexcodeprojprojectpbxproj"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj (183496 => 183497)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj 2015-04-28 18:56:51 UTC (rev 183496)
+++ trunk/Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj 2015-04-28 19:27:23 UTC (rev 183497)
</span><span class="lines">@@ -365,8 +365,6 @@
</span><span class="cx"> 0F666EC1183566F900D017F1 /* FullBytecodeLiveness.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F666EBF183566F900D017F1 /* FullBytecodeLiveness.h */; settings = {ATTRIBUTES = (Private, ); }; };
</span><span class="cx"> 0F666EC61835672B00D017F1 /* DFGAvailability.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F666EC21835672B00D017F1 /* DFGAvailability.cpp */; };
</span><span class="cx"> 0F666EC71835672B00D017F1 /* DFGAvailability.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F666EC31835672B00D017F1 /* DFGAvailability.h */; settings = {ATTRIBUTES = (Private, ); }; };
</span><del>- 0F666ECC1836B37E00D017F1 /* DFGResurrectionForValidationPhase.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F666ECA1836B37E00D017F1 /* DFGResurrectionForValidationPhase.cpp */; };
- 0F666ECD1836B37E00D017F1 /* DFGResurrectionForValidationPhase.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F666ECB1836B37E00D017F1 /* DFGResurrectionForValidationPhase.h */; settings = {ATTRIBUTES = (Private, ); }; };
</del><span class="cx"> 0F66E16B14DF3F1600B7B2E4 /* DFGAdjacencyList.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F66E16814DF3F1300B7B2E4 /* DFGAdjacencyList.h */; settings = {ATTRIBUTES = (Private, ); }; };
</span><span class="cx"> 0F66E16C14DF3F1600B7B2E4 /* DFGEdge.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F66E16914DF3F1300B7B2E4 /* DFGEdge.h */; settings = {ATTRIBUTES = (Private, ); }; };
</span><span class="cx"> 0F682FB219BCB36400FA3BAD /* DFGSSACalculator.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F682FB019BCB36400FA3BAD /* DFGSSACalculator.cpp */; };
</span><span class="lines">@@ -410,8 +408,6 @@
</span><span class="cx"> 0F79085619A290B200F6310C /* DFGStructureRegistrationPhase.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F79085419A290B200F6310C /* DFGStructureRegistrationPhase.h */; settings = {ATTRIBUTES = (Private, ); }; };
</span><span class="cx"> 0F7B294B14C3CD2F007C3DB1 /* DFGCapabilities.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FD82E1F14172C2F00179C94 /* DFGCapabilities.h */; settings = {ATTRIBUTES = (Private, ); }; };
</span><span class="cx"> 0F7B294D14C3CD4C007C3DB1 /* DFGCommon.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FC0977E1469EBC400CF2442 /* DFGCommon.h */; settings = {ATTRIBUTES = (Private, ); }; };
</span><del>- 0F7B3661197C525C00ED1DDC /* DFGPhantomCanonicalizationPhase.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F7B365F197C525C00ED1DDC /* DFGPhantomCanonicalizationPhase.cpp */; };
- 0F7B3662197C525C00ED1DDC /* DFGPhantomCanonicalizationPhase.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F7B3660197C525C00ED1DDC /* DFGPhantomCanonicalizationPhase.h */; settings = {ATTRIBUTES = (Private, ); }; };
</del><span class="cx"> 0F8023EA1613832B00A0BA45 /* ByValInfo.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F8023E91613832300A0BA45 /* ByValInfo.h */; settings = {ATTRIBUTES = (Private, ); }; };
</span><span class="cx"> 0F8335B71639C1E6001443B5 /* ArrayAllocationProfile.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F8335B41639C1E3001443B5 /* ArrayAllocationProfile.cpp */; };
</span><span class="cx"> 0F8335B81639C1EA001443B5 /* ArrayAllocationProfile.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F8335B51639C1E3001443B5 /* ArrayAllocationProfile.h */; settings = {ATTRIBUTES = (Private, ); }; };
</span><span class="lines">@@ -462,6 +458,8 @@
</span><span class="cx"> 0F9D339717FFC4E60073C2BC /* DFGFlushedAt.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F9D339517FFC4E60073C2BC /* DFGFlushedAt.h */; settings = {ATTRIBUTES = (Private, ); }; };
</span><span class="cx"> 0F9D339A1803ADB70073C2BC /* FTLStackMaps.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F9D33981803ADB70073C2BC /* FTLStackMaps.cpp */; };
</span><span class="cx"> 0F9D339B1803ADB70073C2BC /* FTLStackMaps.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F9D33991803ADB70073C2BC /* FTLStackMaps.h */; settings = {ATTRIBUTES = (Private, ); }; };
</span><ins>+ 0F9D36941AE9CC33000D4DFB /* DFGCleanUpPhase.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F9D36921AE9CC33000D4DFB /* DFGCleanUpPhase.cpp */; };
+ 0F9D36951AE9CC33000D4DFB /* DFGCleanUpPhase.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F9D36931AE9CC33000D4DFB /* DFGCleanUpPhase.h */; settings = {ATTRIBUTES = (Private, ); }; };
</ins><span class="cx"> 0F9FB4F417FCB91700CB67F8 /* DFGStackLayoutPhase.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F9FB4F217FCB91700CB67F8 /* DFGStackLayoutPhase.cpp */; };
</span><span class="cx"> 0F9FB4F517FCB91700CB67F8 /* DFGStackLayoutPhase.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F9FB4F317FCB91700CB67F8 /* DFGStackLayoutPhase.h */; settings = {ATTRIBUTES = (Private, ); }; };
</span><span class="cx"> 0F9FC8C314E1B5FE00D52AE0 /* PolymorphicPutByIdList.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F9FC8BF14E1B5FB00D52AE0 /* PolymorphicPutByIdList.cpp */; };
</span><span class="lines">@@ -519,8 +517,6 @@
</span><span class="cx"> 0FBE0F7716C1DB120082C5E8 /* DFGUnificationPhase.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FBE0F7016C1DB010082C5E8 /* DFGUnificationPhase.h */; settings = {ATTRIBUTES = (Private, ); }; };
</span><span class="cx"> 0FBF158C19B7A53100695DD0 /* DFGBlockSet.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FBF158A19B7A53100695DD0 /* DFGBlockSet.cpp */; };
</span><span class="cx"> 0FBF158D19B7A53100695DD0 /* DFGBlockSetInlines.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FBF158B19B7A53100695DD0 /* DFGBlockSetInlines.h */; settings = {ATTRIBUTES = (Private, ); }; };
</span><del>- 0FBFDD04196C92BF007A5BFA /* DFGPhantomRemovalPhase.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FBFDD02196C92BF007A5BFA /* DFGPhantomRemovalPhase.cpp */; };
- 0FBFDD05196C92BF007A5BFA /* DFGPhantomRemovalPhase.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FBFDD03196C92BF007A5BFA /* DFGPhantomRemovalPhase.h */; settings = {ATTRIBUTES = (Private, ); }; };
</del><span class="cx"> 0FC0976A1468A6F700CF2442 /* DFGOSRExit.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FC097681468A6EF00CF2442 /* DFGOSRExit.h */; settings = {ATTRIBUTES = (Private, ); }; };
</span><span class="cx"> 0FC0977114693AF500CF2442 /* DFGOSRExitCompiler.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FC0976F14693AEF00CF2442 /* DFGOSRExitCompiler.h */; settings = {ATTRIBUTES = (Private, ); }; };
</span><span class="cx"> 0FC0977214693AF900CF2442 /* DFGOSRExitCompiler64.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FC0977014693AEF00CF2442 /* DFGOSRExitCompiler64.cpp */; };
</span><span class="lines">@@ -2102,8 +2098,6 @@
</span><span class="cx"> 0F666EBF183566F900D017F1 /* FullBytecodeLiveness.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = FullBytecodeLiveness.h; sourceTree = "<group>"; };
</span><span class="cx"> 0F666EC21835672B00D017F1 /* DFGAvailability.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGAvailability.cpp; path = dfg/DFGAvailability.cpp; sourceTree = "<group>"; };
</span><span class="cx"> 0F666EC31835672B00D017F1 /* DFGAvailability.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGAvailability.h; path = dfg/DFGAvailability.h; sourceTree = "<group>"; };
</span><del>- 0F666ECA1836B37E00D017F1 /* DFGResurrectionForValidationPhase.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGResurrectionForValidationPhase.cpp; path = dfg/DFGResurrectionForValidationPhase.cpp; sourceTree = "<group>"; };
- 0F666ECB1836B37E00D017F1 /* DFGResurrectionForValidationPhase.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGResurrectionForValidationPhase.h; path = dfg/DFGResurrectionForValidationPhase.h; sourceTree = "<group>"; };
</del><span class="cx"> 0F66E16814DF3F1300B7B2E4 /* DFGAdjacencyList.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGAdjacencyList.h; path = dfg/DFGAdjacencyList.h; sourceTree = "<group>"; };
</span><span class="cx"> 0F66E16914DF3F1300B7B2E4 /* DFGEdge.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGEdge.h; path = dfg/DFGEdge.h; sourceTree = "<group>"; };
</span><span class="cx"> 0F682FB019BCB36400FA3BAD /* DFGSSACalculator.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGSSACalculator.cpp; path = dfg/DFGSSACalculator.cpp; sourceTree = "<group>"; };
</span><span class="lines">@@ -2145,8 +2139,6 @@
</span><span class="cx"> 0F7700911402FF280078EB39 /* SamplingCounter.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = SamplingCounter.cpp; sourceTree = "<group>"; };
</span><span class="cx"> 0F79085319A290B200F6310C /* DFGStructureRegistrationPhase.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGStructureRegistrationPhase.cpp; path = dfg/DFGStructureRegistrationPhase.cpp; sourceTree = "<group>"; };
</span><span class="cx"> 0F79085419A290B200F6310C /* DFGStructureRegistrationPhase.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGStructureRegistrationPhase.h; path = dfg/DFGStructureRegistrationPhase.h; sourceTree = "<group>"; };
</span><del>- 0F7B365F197C525C00ED1DDC /* DFGPhantomCanonicalizationPhase.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGPhantomCanonicalizationPhase.cpp; path = dfg/DFGPhantomCanonicalizationPhase.cpp; sourceTree = "<group>"; };
- 0F7B3660197C525C00ED1DDC /* DFGPhantomCanonicalizationPhase.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGPhantomCanonicalizationPhase.h; path = dfg/DFGPhantomCanonicalizationPhase.h; sourceTree = "<group>"; };
</del><span class="cx"> 0F8023E91613832300A0BA45 /* ByValInfo.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ByValInfo.h; sourceTree = "<group>"; };
</span><span class="cx"> 0F8335B41639C1E3001443B5 /* ArrayAllocationProfile.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ArrayAllocationProfile.cpp; sourceTree = "<group>"; };
</span><span class="cx"> 0F8335B51639C1E3001443B5 /* ArrayAllocationProfile.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ArrayAllocationProfile.h; sourceTree = "<group>"; };
</span><span class="lines">@@ -2197,6 +2189,8 @@
</span><span class="cx"> 0F9D339517FFC4E60073C2BC /* DFGFlushedAt.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGFlushedAt.h; path = dfg/DFGFlushedAt.h; sourceTree = "<group>"; };
</span><span class="cx"> 0F9D33981803ADB70073C2BC /* FTLStackMaps.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = FTLStackMaps.cpp; path = ftl/FTLStackMaps.cpp; sourceTree = "<group>"; };
</span><span class="cx"> 0F9D33991803ADB70073C2BC /* FTLStackMaps.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = FTLStackMaps.h; path = ftl/FTLStackMaps.h; sourceTree = "<group>"; };
</span><ins>+ 0F9D36921AE9CC33000D4DFB /* DFGCleanUpPhase.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGCleanUpPhase.cpp; path = dfg/DFGCleanUpPhase.cpp; sourceTree = "<group>"; };
+ 0F9D36931AE9CC33000D4DFB /* DFGCleanUpPhase.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGCleanUpPhase.h; path = dfg/DFGCleanUpPhase.h; sourceTree = "<group>"; };
</ins><span class="cx"> 0F9FB4F217FCB91700CB67F8 /* DFGStackLayoutPhase.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGStackLayoutPhase.cpp; path = dfg/DFGStackLayoutPhase.cpp; sourceTree = "<group>"; };
</span><span class="cx"> 0F9FB4F317FCB91700CB67F8 /* DFGStackLayoutPhase.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGStackLayoutPhase.h; path = dfg/DFGStackLayoutPhase.h; sourceTree = "<group>"; };
</span><span class="cx"> 0F9FC8BF14E1B5FB00D52AE0 /* PolymorphicPutByIdList.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = PolymorphicPutByIdList.cpp; sourceTree = "<group>"; };
</span><span class="lines">@@ -2264,8 +2258,6 @@
</span><span class="cx"> 0FBE0F7016C1DB010082C5E8 /* DFGUnificationPhase.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGUnificationPhase.h; path = dfg/DFGUnificationPhase.h; sourceTree = "<group>"; };
</span><span class="cx"> 0FBF158A19B7A53100695DD0 /* DFGBlockSet.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGBlockSet.cpp; path = dfg/DFGBlockSet.cpp; sourceTree = "<group>"; };
</span><span class="cx"> 0FBF158B19B7A53100695DD0 /* DFGBlockSetInlines.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGBlockSetInlines.h; path = dfg/DFGBlockSetInlines.h; sourceTree = "<group>"; };
</span><del>- 0FBFDD02196C92BF007A5BFA /* DFGPhantomRemovalPhase.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGPhantomRemovalPhase.cpp; path = dfg/DFGPhantomRemovalPhase.cpp; sourceTree = "<group>"; };
- 0FBFDD03196C92BF007A5BFA /* DFGPhantomRemovalPhase.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGPhantomRemovalPhase.h; path = dfg/DFGPhantomRemovalPhase.h; sourceTree = "<group>"; };
</del><span class="cx"> 0FC097681468A6EF00CF2442 /* DFGOSRExit.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGOSRExit.h; path = dfg/DFGOSRExit.h; sourceTree = "<group>"; };
</span><span class="cx"> 0FC0976F14693AEF00CF2442 /* DFGOSRExitCompiler.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGOSRExitCompiler.h; path = dfg/DFGOSRExitCompiler.h; sourceTree = "<group>"; };
</span><span class="cx"> 0FC0977014693AEF00CF2442 /* DFGOSRExitCompiler64.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGOSRExitCompiler64.cpp; path = dfg/DFGOSRExitCompiler64.cpp; sourceTree = "<group>"; };
</span><span class="lines">@@ -4880,6 +4872,8 @@
</span><span class="cx"> 0FFFC94C14EF909500C72532 /* DFGCFAPhase.h */,
</span><span class="cx"> 0F3B3A241544C991003ED0FF /* DFGCFGSimplificationPhase.cpp */,
</span><span class="cx"> 0F3B3A251544C991003ED0FF /* DFGCFGSimplificationPhase.h */,
</span><ins>+ 0F9D36921AE9CC33000D4DFB /* DFGCleanUpPhase.cpp */,
+ 0F9D36931AE9CC33000D4DFB /* DFGCleanUpPhase.h */,
</ins><span class="cx"> A77A423817A0BBFD00A8DB81 /* DFGClobberize.cpp */,
</span><span class="cx"> A77A423917A0BBFD00A8DB81 /* DFGClobberize.h */,
</span><span class="cx"> A77A423A17A0BBFD00A8DB81 /* DFGClobberSet.cpp */,
</span><span class="lines">@@ -5026,12 +5020,8 @@
</span><span class="cx"> 0FEFC9A81681A3B000567F53 /* DFGOSRExitJumpPlaceholder.h */,
</span><span class="cx"> 0F235BE917178E7300690C7F /* DFGOSRExitPreparation.cpp */,
</span><span class="cx"> 0F235BEA17178E7300690C7F /* DFGOSRExitPreparation.h */,
</span><del>- 0F7B365F197C525C00ED1DDC /* DFGPhantomCanonicalizationPhase.cpp */,
- 0F7B3660197C525C00ED1DDC /* DFGPhantomCanonicalizationPhase.h */,
</del><span class="cx"> 0F6237951AE45CA700D402EA /* DFGPhantomInsertionPhase.cpp */,
</span><span class="cx"> 0F6237961AE45CA700D402EA /* DFGPhantomInsertionPhase.h */,
</span><del>- 0FBFDD02196C92BF007A5BFA /* DFGPhantomRemovalPhase.cpp */,
- 0FBFDD03196C92BF007A5BFA /* DFGPhantomRemovalPhase.h */,
</del><span class="cx"> 0FFFC94F14EF909500C72532 /* DFGPhase.cpp */,
</span><span class="cx"> 0FFFC95014EF909500C72532 /* DFGPhase.h */,
</span><span class="cx"> 0F2B9CDE19D0BA7D00B1D1B5 /* DFGPhiChildren.cpp */,
</span><span class="lines">@@ -5053,8 +5043,6 @@
</span><span class="cx"> 0F3A1BF71A9ECB7D000DE01A /* DFGPutStackSinkingPhase.cpp */,
</span><span class="cx"> 0F3A1BF81A9ECB7D000DE01A /* DFGPutStackSinkingPhase.h */,
</span><span class="cx"> 86EC9DC11328DF82002B2AD7 /* DFGRegisterBank.h */,
</span><del>- 0F666ECA1836B37E00D017F1 /* DFGResurrectionForValidationPhase.cpp */,
- 0F666ECB1836B37E00D017F1 /* DFGResurrectionForValidationPhase.h */,
</del><span class="cx"> 0F2FCCF418A60070001A27F8 /* DFGSafepoint.cpp */,
</span><span class="cx"> 0F2FCCF518A60070001A27F8 /* DFGSafepoint.h */,
</span><span class="cx"> A77A423C17A0BBFD00A8DB81 /* DFGSafeToExecute.h */,
</span><span class="lines">@@ -5868,7 +5856,6 @@
</span><span class="cx"> 0FBE0F7516C1DB0B0082C5E8 /* DFGPredictionInjectionPhase.h in Headers */,
</span><span class="cx"> 0FFFC95E14EF90B700C72532 /* DFGPredictionPropagationPhase.h in Headers */,
</span><span class="cx"> 86EC9DD11328DF82002B2AD7 /* DFGRegisterBank.h in Headers */,
</span><del>- 0F666ECD1836B37E00D017F1 /* DFGResurrectionForValidationPhase.h in Headers */,
</del><span class="cx"> 0F2FCCFC18A60070001A27F8 /* DFGSafepoint.h in Headers */,
</span><span class="cx"> A77A424317A0BBFD00A8DB81 /* DFGSafeToExecute.h in Headers */,
</span><span class="cx"> A741017F179DAF80002EB8BA /* DFGSaneStringGetByValSlowPathGenerator.h in Headers */,
</span><span class="lines">@@ -5943,6 +5930,7 @@
</span><span class="cx"> 0F235BD617178E1C00690C7F /* FTLExitArgumentForOperand.h in Headers */,
</span><span class="cx"> 0F235BD717178E1C00690C7F /* FTLExitArgumentList.h in Headers */,
</span><span class="cx"> 0F235BD917178E1C00690C7F /* FTLExitThunkGenerator.h in Headers */,
</span><ins>+ 0F9D36951AE9CC33000D4DFB /* DFGCleanUpPhase.h in Headers */,
</ins><span class="cx"> 0F235BDB17178E1C00690C7F /* FTLExitValue.h in Headers */,
</span><span class="cx"> A53CE08618BC1A5600BEDF76 /* ConsolePrototype.h in Headers */,
</span><span class="cx"> A7F2996C17A0BB670010417A /* FTLFail.h in Headers */,
</span><span class="lines">@@ -6053,7 +6041,6 @@
</span><span class="cx"> 8606DDEA18DA44AB00A383D0 /* IdentifierInlines.h in Headers */,
</span><span class="cx"> A532438C18568335002ED692 /* InspectorProtocolObjects.h in Headers */,
</span><span class="cx"> A50E4B6218809DD50068A46D /* InspectorRuntimeAgent.h in Headers */,
</span><del>- 0FBFDD05196C92BF007A5BFA /* DFGPhantomRemovalPhase.h in Headers */,
</del><span class="cx"> A55D93AC18514F7900400DED /* InspectorProtocolTypes.h in Headers */,
</span><span class="cx"> A593CF831840377100BFCE27 /* InspectorValues.h in Headers */,
</span><span class="cx"> 969A07990ED1D3AE00F1F681 /* Instruction.h in Headers */,
</span><span class="lines">@@ -6142,7 +6129,6 @@
</span><span class="cx"> 0F2B66F217B6B5AB00A7AE3F /* JSGenericTypedArrayViewConstructor.h in Headers */,
</span><span class="cx"> 0F2B66F317B6B5AB00A7AE3F /* JSGenericTypedArrayViewConstructorInlines.h in Headers */,
</span><span class="cx"> 0F2B66F417B6B5AB00A7AE3F /* JSGenericTypedArrayViewInlines.h in Headers */,
</span><del>- 0F7B3662197C525C00ED1DDC /* DFGPhantomCanonicalizationPhase.h in Headers */,
</del><span class="cx"> 0F5A1274192D9FDF008764A3 /* DFGDoesGC.h in Headers */,
</span><span class="cx"> 0F2B66F517B6B5AB00A7AE3F /* JSGenericTypedArrayViewPrototype.h in Headers */,
</span><span class="cx"> 0F2B66F617B6B5AB00A7AE3F /* JSGenericTypedArrayViewPrototypeInlines.h in Headers */,
</span><span class="lines">@@ -7110,6 +7096,7 @@
</span><span class="cx"> 0F2BDC15151C5D4D00CD8910 /* DFGFixupPhase.cpp in Sources */,
</span><span class="cx"> 0FD120331A8C85BD000F5280 /* FTLJSCallVarargs.cpp in Sources */,
</span><span class="cx"> 0F9D339617FFC4E60073C2BC /* DFGFlushedAt.cpp in Sources */,
</span><ins>+ 0F9D36941AE9CC33000D4DFB /* DFGCleanUpPhase.cpp in Sources */,
</ins><span class="cx"> A7D89CF717A0B8CC00773AD8 /* DFGFlushFormat.cpp in Sources */,
</span><span class="cx"> 0F3A1BF91A9ECB7D000DE01A /* DFGPutStackSinkingPhase.cpp in Sources */,
</span><span class="cx"> 86EC9DC71328DF82002B2AD7 /* DFGGraph.cpp in Sources */,
</span><span class="lines">@@ -7152,7 +7139,6 @@
</span><span class="cx"> A78A977A179738B8009DF744 /* DFGPlan.cpp in Sources */,
</span><span class="cx"> 0FBE0F7416C1DB090082C5E8 /* DFGPredictionInjectionPhase.cpp in Sources */,
</span><span class="cx"> 0FFFC95D14EF90B300C72532 /* DFGPredictionPropagationPhase.cpp in Sources */,
</span><del>- 0F666ECC1836B37E00D017F1 /* DFGResurrectionForValidationPhase.cpp in Sources */,
</del><span class="cx"> 0F2FCCFB18A60070001A27F8 /* DFGSafepoint.cpp in Sources */,
</span><span class="cx"> 86EC9DD21328DF82002B2AD7 /* DFGSpeculativeJIT.cpp in Sources */,
</span><span class="cx"> 86880F1F14328BB900B08D42 /* DFGSpeculativeJIT32_64.cpp in Sources */,
</span><span class="lines">@@ -7367,7 +7353,6 @@
</span><span class="cx"> A503FA1D188E0FB000110F14 /* JSJavaScriptCallFramePrototype.cpp in Sources */,
</span><span class="cx"> 14280875107EC13E0013E7B2 /* JSLock.cpp in Sources */,
</span><span class="cx"> 0F3D0BBC194A414300FC9CF9 /* ConstantStructureCheck.cpp in Sources */,
</span><del>- 0F7B3661197C525C00ED1DDC /* DFGPhantomCanonicalizationPhase.cpp in Sources */,
</del><span class="cx"> C25D709B16DE99F400FCA6BC /* JSManagedValue.mm in Sources */,
</span><span class="cx"> A700874117CBE8EB00C3E643 /* JSMap.cpp in Sources */,
</span><span class="cx"> A74DEF95182D991400522C22 /* JSMapIterator.cpp in Sources */,
</span><span class="lines">@@ -7540,7 +7525,6 @@
</span><span class="cx"> C225494315F7DBAA0065E898 /* SlotVisitor.cpp in Sources */,
</span><span class="cx"> 9330402C0E6A764000786E6A /* SmallStrings.cpp in Sources */,
</span><span class="cx"> 0F8F2B9E17306C8D007DBDA5 /* SourceCode.cpp in Sources */,
</span><del>- 0FBFDD04196C92BF007A5BFA /* DFGPhantomRemovalPhase.cpp in Sources */,
</del><span class="cx"> 0F493AFA16D0CAD30084508B /* SourceProvider.cpp in Sources */,
</span><span class="cx"> E49DC16B12EF293E00184A1F /* SourceProviderCache.cpp in Sources */,
</span><span class="cx"> 0F0CD4C415F6B6BB0032F1C0 /* SparseArrayValueMap.cpp in Sources */,
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGAdjacencyListh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGAdjacencyList.h (183496 => 183497)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGAdjacencyList.h 2015-04-28 18:56:51 UTC (rev 183496)
+++ trunk/Source/JavaScriptCore/dfg/DFGAdjacencyList.h 2015-04-28 19:27:23 UTC (rev 183497)
</span><span class="lines">@@ -1,5 +1,5 @@
</span><span class="cx"> /*
</span><del>- * Copyright (C) 2011, 2013 Apple Inc. All rights reserved.
</del><ins>+ * Copyright (C) 2011, 2013, 2015 Apple Inc. All rights reserved.
</ins><span class="cx"> *
</span><span class="cx"> * Redistribution and use in source and binary forms, with or without
</span><span class="cx"> * modification, are permitted provided that the following conditions
</span><span class="lines">@@ -156,6 +156,21 @@
</span><span class="cx"> return AdjacencyList(Fixed, child1().sanitized(), child2().sanitized(), child3().sanitized());
</span><span class="cx"> }
</span><span class="cx">
</span><ins>+ AdjacencyList justChecks() const
+ {
+ AdjacencyList result(Fixed);
+ unsigned sourceIndex = 0;
+ unsigned targetIndex = 0;
+ while (sourceIndex < AdjacencyList::Size) {
+ Edge edge = child(sourceIndex++);
+ if (!edge)
+ break;
+ if (edge.willHaveCheck())
+ result.child(targetIndex++) = edge;
+ }
+ return result;
+ }
+
</ins><span class="cx"> unsigned hash() const
</span><span class="cx"> {
</span><span class="cx"> unsigned result = 0;
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGArgumentsEliminationPhasecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGArgumentsEliminationPhase.cpp (183496 => 183497)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGArgumentsEliminationPhase.cpp 2015-04-28 18:56:51 UTC (rev 183496)
+++ trunk/Source/JavaScriptCore/dfg/DFGArgumentsEliminationPhase.cpp 2015-04-28 19:27:23 UTC (rev 183497)
</span><span class="lines">@@ -159,7 +159,6 @@
</span><span class="cx"> escape(node->child3());
</span><span class="cx"> break;
</span><span class="cx">
</span><del>- case Phantom:
</del><span class="cx"> case Check:
</span><span class="cx"> case MovHint:
</span><span class="cx"> case PutHint:
</span><span class="lines">@@ -353,7 +352,6 @@
</span><span class="cx"> break;
</span><span class="cx">
</span><span class="cx"> node->setOpAndDefaultFlags(PhantomDirectArguments);
</span><del>- insertionSet.insertNode(nodeIndex + 1, SpecNone, Phantom, node->origin, Edge(node));
</del><span class="cx"> break;
</span><span class="cx">
</span><span class="cx"> case CreateClonedArguments:
</span><span class="lines">@@ -361,7 +359,6 @@
</span><span class="cx"> break;
</span><span class="cx">
</span><span class="cx"> node->setOpAndDefaultFlags(PhantomClonedArguments);
</span><del>- insertionSet.insertNode(nodeIndex + 1, SpecNone, Phantom, node->origin, Edge(node));
</del><span class="cx"> break;
</span><span class="cx">
</span><span class="cx"> case GetFromArguments: {
</span><span class="lines">@@ -485,7 +482,7 @@
</span><span class="cx"> nodeIndex, SpecNone, PutStack, node->origin, OpInfo(data), Edge(value));
</span><span class="cx"> }
</span><span class="cx">
</span><del>- node->convertToPhantom();
</del><ins>+ node->remove();
</ins><span class="cx"> break;
</span><span class="cx"> }
</span><span class="cx">
</span><span class="lines">@@ -536,7 +533,7 @@
</span><span class="cx"> case GetButterfly: {
</span><span class="cx"> if (!m_candidates.contains(node->child1().node()))
</span><span class="cx"> break;
</span><del>- node->convertToPhantom();
</del><ins>+ node->remove();
</ins><span class="cx"> break;
</span><span class="cx"> }
</span><span class="cx">
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGBasicBlockcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGBasicBlock.cpp (183496 => 183497)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGBasicBlock.cpp 2015-04-28 18:56:51 UTC (rev 183496)
+++ trunk/Source/JavaScriptCore/dfg/DFGBasicBlock.cpp 2015-04-28 19:27:23 UTC (rev 183497)
</span><span class="lines">@@ -78,7 +78,7 @@
</span><span class="cx"> append(node);
</span><span class="cx"> else {
</span><span class="cx"> m_nodes.insert(result.index + 1, node);
</span><del>- result.node->convertToPhantom();
</del><ins>+ result.node->remove();
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> ASSERT(terminal());
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGBasicBlockh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGBasicBlock.h (183496 => 183497)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGBasicBlock.h 2015-04-28 18:56:51 UTC (rev 183496)
+++ trunk/Source/JavaScriptCore/dfg/DFGBasicBlock.h 2015-04-28 19:27:23 UTC (rev 183497)
</span><span class="lines">@@ -94,7 +94,8 @@
</span><span class="cx"> case Return:
</span><span class="cx"> case Unreachable:
</span><span class="cx"> return NodeAndIndex(node, i);
</span><del>- // The bitter end can contain Phantoms and the like. There will probably only be one or two nodes after the terminal.
</del><ins>+ // The bitter end can contain Phantoms and the like. There will probably only be one or two nodes after the terminal. They are all no-ops and will not have any checked children.
+ case Check: // This is here because it's our universal no-op.
</ins><span class="cx"> case Phantom:
</span><span class="cx"> case PhantomLocal:
</span><span class="cx"> case Flush:
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGCFGSimplificationPhasecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGCFGSimplificationPhase.cpp (183496 => 183497)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGCFGSimplificationPhase.cpp 2015-04-28 18:56:51 UTC (rev 183496)
+++ trunk/Source/JavaScriptCore/dfg/DFGCFGSimplificationPhase.cpp 2015-04-28 19:27:23 UTC (rev 183497)
</span><span class="lines">@@ -272,8 +272,13 @@
</span><span class="cx"> NodeType nodeType;
</span><span class="cx"> if (livenessNode->flags() & NodeIsFlushed)
</span><span class="cx"> nodeType = Flush;
</span><del>- else
</del><ins>+ else {
+ // This seems like it shouldn't be necessary because we could just rematerialize
+ // PhantomLocals or something similar using bytecode liveness. However, in ThreadedCPS, it's
+ // worth the sanity to maintain this eagerly. See
+ // https://bugs.webkit.org/show_bug.cgi?id=144086
</ins><span class="cx"> nodeType = PhantomLocal;
</span><ins>+ }
</ins><span class="cx"> block->appendNode(
</span><span class="cx"> m_graph, SpecNone, nodeType, nodeOrigin,
</span><span class="cx"> OpInfo(livenessNode->variableAccessData()));
</span><span class="lines">@@ -317,11 +322,11 @@
</span><span class="cx"> // kept alive.
</span><span class="cx">
</span><span class="cx"> // Remove the terminal of firstBlock since we don't need it anymore. Well, we don't
</span><del>- // really remove it; we actually turn it into a Phantom.
</del><ins>+ // really remove it; we actually turn it into a check.
</ins><span class="cx"> Node* terminal = firstBlock->terminal();
</span><span class="cx"> ASSERT(terminal->isTerminal());
</span><span class="cx"> NodeOrigin boundaryNodeOrigin = terminal->origin;
</span><del>- terminal->convertToPhantom();
</del><ins>+ terminal->remove();
</ins><span class="cx"> ASSERT(terminal->refCount() == 1);
</span><span class="cx">
</span><span class="cx"> for (unsigned i = jettisonedBlocks.size(); i--;) {
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGCPSRethreadingPhasecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGCPSRethreadingPhase.cpp (183496 => 183497)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGCPSRethreadingPhase.cpp 2015-04-28 18:56:51 UTC (rev 183496)
+++ trunk/Source/JavaScriptCore/dfg/DFGCPSRethreadingPhase.cpp 2015-04-28 19:27:23 UTC (rev 183497)
</span><span class="lines">@@ -39,7 +39,6 @@
</span><span class="cx"> public:
</span><span class="cx"> CPSRethreadingPhase(Graph& graph)
</span><span class="cx"> : Phase(graph, "CPS rethreading")
</span><del>- , m_availableForOSR(OperandsLike, graph.block(0)->variablesAtHead)
</del><span class="cx"> {
</span><span class="cx"> }
</span><span class="cx">
</span><span class="lines">@@ -126,14 +125,10 @@
</span><span class="cx"> ASSERT(
</span><span class="cx"> m_block->variablesAtHead.sizeFor<operandKind>()
</span><span class="cx"> == m_block->variablesAtTail.sizeFor<operandKind>());
</span><del>- ASSERT(
- m_block->variablesAtHead.sizeFor<operandKind>()
- == m_availableForOSR.sizeFor<operandKind>());
</del><span class="cx">
</span><span class="cx"> for (unsigned i = m_block->variablesAtHead.sizeFor<operandKind>(); i--;) {
</span><span class="cx"> m_block->variablesAtHead.atFor<operandKind>(i) = nullptr;
</span><span class="cx"> m_block->variablesAtTail.atFor<operandKind>(i) = nullptr;
</span><del>- m_availableForOSR.atFor<operandKind>(i) = Edge();
</del><span class="cx"> }
</span><span class="cx"> }
</span><span class="cx">
</span><span class="lines">@@ -247,8 +242,7 @@
</span><span class="cx"> // redundant and inefficient, since really it just means that we want to
</span><span class="cx"> // keep the last MovHinted value of that local alive.
</span><span class="cx">
</span><del>- node->children.setChild1(m_availableForOSR.atFor<operandKind>(idx));
- node->convertToPhantom();
</del><ins>+ node->remove();
</ins><span class="cx"> return;
</span><span class="cx"> }
</span><span class="cx">
</span><span class="lines">@@ -359,14 +353,6 @@
</span><span class="cx"> canonicalizeSet(node);
</span><span class="cx"> break;
</span><span class="cx">
</span><del>- case MovHint:
- m_availableForOSR.operand(node->unlinkedLocal()) = node->child1();
- break;
-
- case ZombieHint:
- m_availableForOSR.operand(node->unlinkedLocal()) = Edge();
- break;
-
</del><span class="cx"> default:
</span><span class="cx"> break;
</span><span class="cx"> }
</span><span class="lines">@@ -517,7 +503,6 @@
</span><span class="cx"> Vector<PhiStackEntry, 128> m_argumentPhiStack;
</span><span class="cx"> Vector<PhiStackEntry, 128> m_localPhiStack;
</span><span class="cx"> Vector<Node*, 128> m_flushedLocalOpWorklist;
</span><del>- Operands<Edge> m_availableForOSR;
</del><span class="cx"> };
</span><span class="cx">
</span><span class="cx"> bool performCPSRethreading(Graph& graph)
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGCSEPhasecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGCSEPhase.cpp (183496 => 183497)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGCSEPhase.cpp 2015-04-28 18:56:51 UTC (rev 183496)
+++ trunk/Source/JavaScriptCore/dfg/DFGCSEPhase.cpp 2015-04-28 19:27:23 UTC (rev 183497)
</span><span class="lines">@@ -234,8 +234,7 @@
</span><span class="cx"> m_graph.performSubstitution(m_node);
</span><span class="cx">
</span><span class="cx"> if (m_node->op() == Identity) {
</span><del>- m_node->convertToCheck();
- m_node->setReplacement(m_node->child1().node());
</del><ins>+ m_node->replaceWith(m_node->child1().node());
</ins><span class="cx"> m_changed = true;
</span><span class="cx"> } else {
</span><span class="cx"> // This rule only makes sense for local CSE, since in SSA form we have already
</span><span class="lines">@@ -437,8 +436,7 @@
</span><span class="cx"> m_graph.performSubstitution(m_node);
</span><span class="cx">
</span><span class="cx"> if (m_node->op() == Identity) {
</span><del>- m_node->convertToCheck();
- m_node->setReplacement(m_node->child1().node());
</del><ins>+ m_node->replaceWith(m_node->child1().node());
</ins><span class="cx"> m_changed = true;
</span><span class="cx"> } else
</span><span class="cx"> clobberize(m_graph, m_node, *this);
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGCleanUpPhasecpp"></a>
<div class="addfile"><h4>Added: trunk/Source/JavaScriptCore/dfg/DFGCleanUpPhase.cpp (0 => 183497)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGCleanUpPhase.cpp (rev 0)
+++ trunk/Source/JavaScriptCore/dfg/DFGCleanUpPhase.cpp 2015-04-28 19:27:23 UTC (rev 183497)
</span><span class="lines">@@ -0,0 +1,92 @@
</span><ins>+/*
+ * Copyright (C) 2014, 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ * notice, this list of conditions and the following disclaimer in the
+ * documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "DFGCleanUpPhase.h"
+
+#if ENABLE(DFG_JIT)
+
+#include "DFGGraph.h"
+#include "DFGInsertionSet.h"
+#include "DFGPhase.h"
+#include "DFGPredictionPropagationPhase.h"
+#include "DFGVariableAccessDataDump.h"
+#include "JSCInlines.h"
+
+namespace JSC { namespace DFG {
+
+class CleanUpPhase : public Phase {
+public:
+ CleanUpPhase(Graph& graph)
+ : Phase(graph, "clean up")
+ {
+ }
+
+ bool run()
+ {
+ bool changed = false;
+
+ for (BasicBlock* block : m_graph.blocksInNaturalOrder()) {
+ unsigned sourceIndex = 0;
+ unsigned targetIndex = 0;
+ while (sourceIndex < block->size()) {
+ Node* node = block->at(sourceIndex++);
+ bool kill = false;
+
+ if (node->op() == Check)
+ node->children = node->children.justChecks();
+
+ switch (node->op()) {
+ case Phantom:
+ case Check:
+ if (node->children.isEmpty())
+ kill = true;
+ break;
+ default:
+ break;
+ }
+
+ if (kill)
+ m_graph.m_allocator.free(node);
+ else
+ block->at(targetIndex++) = node;
+ }
+ block->resize(targetIndex);
+ }
+
+ return changed;
+ }
+};
+
+bool performCleanUp(Graph& graph)
+{
+ SamplingRegion samplingRegion("DFG Clean Up Phase");
+ return runPhase<CleanUpPhase>(graph);
+}
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
+
</ins></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGCleanUpPhaseh"></a>
<div class="addfile"><h4>Added: trunk/Source/JavaScriptCore/dfg/DFGCleanUpPhase.h (0 => 183497)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGCleanUpPhase.h (rev 0)
+++ trunk/Source/JavaScriptCore/dfg/DFGCleanUpPhase.h 2015-04-28 19:27:23 UTC (rev 183497)
</span><span class="lines">@@ -0,0 +1,43 @@
</span><ins>+/*
+ * Copyright (C) 2014, 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ * notice, this list of conditions and the following disclaimer in the
+ * documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef DFGCleanUpPhase_h
+#define DFGCleanUpPhase_h
+
+#if ENABLE(DFG_JIT)
+
+namespace JSC { namespace DFG {
+
+class Graph;
+
+// Cleans up unneeded nodes, like empty Checks and Phantoms.
+
+bool performCleanUp(Graph&);
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
+
+#endif // DFGCleanUpPhase_h
</ins></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGConstantFoldingPhasecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGConstantFoldingPhase.cpp (183496 => 183497)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGConstantFoldingPhase.cpp 2015-04-28 18:56:51 UTC (rev 183496)
+++ trunk/Source/JavaScriptCore/dfg/DFGConstantFoldingPhase.cpp 2015-04-28 19:27:23 UTC (rev 183497)
</span><span class="lines">@@ -108,7 +108,7 @@
</span><span class="cx"> set = node->structureSet();
</span><span class="cx"> if (value.m_structure.isSubsetOf(set)) {
</span><span class="cx"> m_interpreter.execute(indexInBlock); // Catch the fact that we may filter on cell.
</span><del>- node->convertToPhantom();
</del><ins>+ node->remove();
</ins><span class="cx"> eliminated = true;
</span><span class="cx"> break;
</span><span class="cx"> }
</span><span class="lines">@@ -133,8 +133,7 @@
</span><span class="cx"> m_interpreter.execute(indexInBlock);
</span><span class="cx"> eliminated = true;
</span><span class="cx">
</span><del>- m_insertionSet.insertNode(
- indexInBlock, SpecNone, Phantom, node->origin, node->children);
</del><ins>+ m_insertionSet.insertCheck(indexInBlock, node->origin, node->children);
</ins><span class="cx"> node->convertToConstantStoragePointer(view->vector());
</span><span class="cx"> break;
</span><span class="cx"> }
</span><span class="lines">@@ -147,7 +146,7 @@
</span><span class="cx"> if (Structure* structure = jsDynamicCast<Structure*>(value.value())) {
</span><span class="cx"> if (set.contains(structure)) {
</span><span class="cx"> m_interpreter.execute(indexInBlock);
</span><del>- node->convertToPhantom();
</del><ins>+ node->remove();
</ins><span class="cx"> eliminated = true;
</span><span class="cx"> break;
</span><span class="cx"> }
</span><span class="lines">@@ -167,7 +166,7 @@
</span><span class="cx"> });
</span><span class="cx"> if (allGood) {
</span><span class="cx"> m_interpreter.execute(indexInBlock);
</span><del>- node->convertToPhantom();
</del><ins>+ node->remove();
</ins><span class="cx"> eliminated = true;
</span><span class="cx"> break;
</span><span class="cx"> }
</span><span class="lines">@@ -179,7 +178,7 @@
</span><span class="cx"> case Arrayify: {
</span><span class="cx"> if (!node->arrayMode().alreadyChecked(m_graph, node, m_state.forNode(node->child1())))
</span><span class="cx"> break;
</span><del>- node->convertToPhantom();
</del><ins>+ node->remove();
</ins><span class="cx"> eliminated = true;
</span><span class="cx"> break;
</span><span class="cx"> }
</span><span class="lines">@@ -188,7 +187,7 @@
</span><span class="cx"> if (m_state.forNode(node->child1()).m_structure.onlyStructure() != node->transition()->next)
</span><span class="cx"> break;
</span><span class="cx">
</span><del>- node->convertToPhantom();
</del><ins>+ node->remove();
</ins><span class="cx"> eliminated = true;
</span><span class="cx"> break;
</span><span class="cx"> }
</span><span class="lines">@@ -196,7 +195,7 @@
</span><span class="cx"> case CheckCell: {
</span><span class="cx"> if (m_state.forNode(node->child1()).value() != node->cellOperand()->value())
</span><span class="cx"> break;
</span><del>- node->convertToPhantom();
</del><ins>+ node->remove();
</ins><span class="cx"> eliminated = true;
</span><span class="cx"> break;
</span><span class="cx"> }
</span><span class="lines">@@ -204,7 +203,7 @@
</span><span class="cx"> case CheckNotEmpty: {
</span><span class="cx"> if (m_state.forNode(node->child1()).m_type & SpecEmpty)
</span><span class="cx"> break;
</span><del>- node->convertToPhantom();
</del><ins>+ node->remove();
</ins><span class="cx"> eliminated = true;
</span><span class="cx"> break;
</span><span class="cx"> }
</span><span class="lines">@@ -214,7 +213,7 @@
</span><span class="cx"> JSValue right = m_state.forNode(node->child2()).value();
</span><span class="cx"> if (left && right && left.isInt32() && right.isInt32()
</span><span class="cx"> && static_cast<uint32_t>(left.asInt32()) < static_cast<uint32_t>(right.asInt32())) {
</span><del>- node->convertToPhantom();
</del><ins>+ node->remove();
</ins><span class="cx"> eliminated = true;
</span><span class="cx"> break;
</span><span class="cx"> }
</span><span class="lines">@@ -512,14 +511,16 @@
</span><span class="cx"> if (!*value)
</span><span class="cx"> continue;
</span><span class="cx">
</span><del>- NodeOrigin origin = node->origin;
- AdjacencyList children = node->children;
-
- m_graph.convertToConstant(node, value);
- if (!children.isEmpty()) {
</del><ins>+ if (node->op() == GetLocal) {
+ // Need to preserve bytecode liveness in ThreadedCPS form. This wouldn't be necessary
+ // if it wasn't for https://bugs.webkit.org/show_bug.cgi?id=144086.
</ins><span class="cx"> m_insertionSet.insertNode(
</span><del>- indexInBlock, SpecNone, Phantom, origin, children);
- }
</del><ins>+ indexInBlock, SpecNone, PhantomLocal, node->origin,
+ OpInfo(node->variableAccessData()));
+ m_graph.dethread();
+ } else
+ m_insertionSet.insertCheck(indexInBlock, node->origin, node->children);
+ m_graph.convertToConstant(node, value);
</ins><span class="cx">
</span><span class="cx"> changed = true;
</span><span class="cx"> }
</span><span class="lines">@@ -640,10 +641,8 @@
</span><span class="cx"> return;
</span><span class="cx"> }
</span><span class="cx">
</span><del>- if (baseValue.m_type & ~SpecCell) {
- m_insertionSet.insertNode(
- indexInBlock, SpecNone, Phantom, node->origin, node->child1());
- }
</del><ins>+ if (baseValue.m_type & ~SpecCell)
+ m_insertionSet.insertCheck(indexInBlock, node->origin, node->child1());
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> void addChecks(
</span><span class="lines">@@ -683,7 +682,7 @@
</span><span class="cx"> case JSConstant:
</span><span class="cx"> case DoubleConstant:
</span><span class="cx"> case Int52Constant:
</span><del>- node->convertToPhantom();
</del><ins>+ node->remove();
</ins><span class="cx"> break;
</span><span class="cx"> default:
</span><span class="cx"> DFG_CRASH(m_graph, node, "Bad Upsilon phi() pointer");
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGDCEPhasecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGDCEPhase.cpp (183496 => 183497)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGDCEPhase.cpp 2015-04-28 18:56:51 UTC (rev 183496)
+++ trunk/Source/JavaScriptCore/dfg/DFGDCEPhase.cpp 2015-04-28 19:27:23 UTC (rev 183497)
</span><span class="lines">@@ -50,27 +50,11 @@
</span><span class="cx">
</span><span class="cx"> m_graph.computeRefCounts();
</span><span class="cx">
</span><del>- if (m_graph.m_form == SSA) {
- for (BasicBlock* block : m_graph.blocksInPreOrder())
- fixupBlock(block);
-
- // This is like cleanVariables, but has a much simpler approach to GetLocal.
- for (unsigned i = m_graph.m_arguments.size(); i--;) {
- Node* node = m_graph.m_arguments[i];
- if (!node)
- continue;
- if (node->op() != Phantom && node->op() != Check && node->shouldGenerate())
- continue;
- m_graph.m_arguments[i] = nullptr;
- }
- } else {
- RELEASE_ASSERT(m_graph.m_form == ThreadedCPS);
-
- for (BlockIndex blockIndex = 0; blockIndex < m_graph.numBlocks(); ++blockIndex)
- fixupBlock(m_graph.block(blockIndex));
- cleanVariables(m_graph.m_arguments);
- }
</del><ins>+ for (BasicBlock* block : m_graph.blocksInPreOrder())
+ fixupBlock(block);
</ins><span class="cx">
</span><ins>+ cleanVariables(m_graph.m_arguments);
+
</ins><span class="cx"> // Just do a basic Phantom/Check clean-up.
</span><span class="cx"> for (BlockIndex blockIndex = m_graph.numBlocks(); blockIndex--;) {
</span><span class="cx"> BasicBlock* block = m_graph.block(blockIndex);
</span><span class="lines">@@ -104,22 +88,12 @@
</span><span class="cx"> {
</span><span class="cx"> if (!block)
</span><span class="cx"> return;
</span><del>-
- switch (m_graph.m_form) {
- case SSA:
- break;
-
- case ThreadedCPS: {
- // Clean up variable links for the block. We need to do this before the actual DCE
- // because we need to see GetLocals, so we can bypass them in situations where the
- // vars-at-tail point to a GetLocal, the GetLocal is dead, but the Phi it points
- // to is alive.
-
</del><ins>+
+ if (m_graph.m_form == ThreadedCPS) {
</ins><span class="cx"> for (unsigned phiIndex = 0; phiIndex < block->phis.size(); ++phiIndex) {
</span><del>- if (!block->phis[phiIndex]->shouldGenerate()) {
- // FIXME: We could actually free nodes here. Except that it probably
- // doesn't matter, since we don't add any nodes after this phase.
- // https://bugs.webkit.org/show_bug.cgi?id=126239
</del><ins>+ Node* phi = block->phis[phiIndex];
+ if (!phi->shouldGenerate()) {
+ m_graph.m_allocator.free(phi);
</ins><span class="cx"> block->phis[phiIndex--] = block->phis.last();
</span><span class="cx"> block->phis.removeLast();
</span><span class="cx"> }
</span><span class="lines">@@ -127,13 +101,7 @@
</span><span class="cx">
</span><span class="cx"> cleanVariables(block->variablesAtHead);
</span><span class="cx"> cleanVariables(block->variablesAtTail);
</span><del>- break;
</del><span class="cx"> }
</span><del>-
- default:
- RELEASE_ASSERT_NOT_REACHED();
- return;
- }
</del><span class="cx">
</span><span class="cx"> // This has to be a forward loop because we are using the insertion set.
</span><span class="cx"> for (unsigned indexInBlock = 0; indexInBlock < block->size(); ++indexInBlock) {
</span><span class="lines">@@ -141,40 +109,24 @@
</span><span class="cx"> if (node->shouldGenerate())
</span><span class="cx"> continue;
</span><span class="cx">
</span><del>- switch (node->op()) {
- case MovHint:
- case ZombieHint:
- // These are not killable. (They once were.)
- RELEASE_ASSERT_NOT_REACHED();
-
- default: {
- if (node->flags() & NodeHasVarArgs) {
- for (unsigned childIdx = node->firstChild(); childIdx < node->firstChild() + node->numChildren(); childIdx++) {
- Edge edge = m_graph.m_varArgChildren[childIdx];
-
- if (!edge || edge.isProved() || edge.willNotHaveCheck())
- continue;
-
- m_insertionSet.insertNode(indexInBlock, SpecNone, Check, node->origin, edge);
- }
-
- node->convertToPhantom();
- node->children.reset();
- node->setRefCount(1);
- break;
- }
-
- node->convertToCheck();
- for (unsigned i = 0; i < AdjacencyList::Size; ++i) {
- Edge edge = node->children.child(i);
- if (!edge)
</del><ins>+ if (node->flags() & NodeHasVarArgs) {
+ for (unsigned childIdx = node->firstChild(); childIdx < node->firstChild() + node->numChildren(); childIdx++) {
+ Edge edge = m_graph.m_varArgChildren[childIdx];
+
+ if (!edge || edge.willNotHaveCheck())
</ins><span class="cx"> continue;
</span><del>- if (edge.isProved() || edge.willNotHaveCheck())
- node->children.removeEdge(i--);
</del><ins>+
+ m_insertionSet.insertNode(indexInBlock, SpecNone, Check, node->origin, edge);
</ins><span class="cx"> }
</span><ins>+
+ node->setOpAndDefaultFlags(Check);
+ node->children.reset();
</ins><span class="cx"> node->setRefCount(1);
</span><del>- break;
- } }
</del><ins>+ continue;
+ }
+
+ node->remove();
+ node->setRefCount(1);
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> m_insertionSet.execute(block);
</span><span class="lines">@@ -187,19 +139,9 @@
</span><span class="cx"> Node* node = variables[i];
</span><span class="cx"> if (!node)
</span><span class="cx"> continue;
</span><del>- if (node->op() != Phantom && node->op() != Check && node->shouldGenerate())
</del><ins>+ if (node->op() != Check && node->shouldGenerate())
</ins><span class="cx"> continue;
</span><del>- if (node->op() == GetLocal) {
- node = node->child1().node();
-
- ASSERT(node->op() == Phi || node->op() == SetArgument);
-
- if (node->shouldGenerate()) {
- variables[i] = node;
- continue;
- }
- }
- variables[i] = 0;
</del><ins>+ variables[i] = nullptr;
</ins><span class="cx"> }
</span><span class="cx"> }
</span><span class="cx">
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGFixupPhasecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp (183496 => 183497)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp 2015-04-28 18:56:51 UTC (rev 183496)
+++ trunk/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp 2015-04-28 19:27:23 UTC (rev 183497)
</span><span class="lines">@@ -82,10 +82,8 @@
</span><span class="cx"> m_block = block;
</span><span class="cx"> for (m_indexInBlock = 0; m_indexInBlock < block->size(); ++m_indexInBlock) {
</span><span class="cx"> m_currentNode = block->at(m_indexInBlock);
</span><del>- addPhantomsIfNecessary();
</del><span class="cx"> fixupNode(m_currentNode);
</span><span class="cx"> }
</span><del>- addPhantomsIfNecessary();
</del><span class="cx"> m_insertionSet.execute(block);
</span><span class="cx"> }
</span><span class="cx">
</span><span class="lines">@@ -142,14 +140,12 @@
</span><span class="cx"> case ValueAdd: {
</span><span class="cx"> if (attemptToMakeIntegerAdd(node)) {
</span><span class="cx"> node->setOp(ArithAdd);
</span><del>- node->clearFlags(NodeMustGenerate);
</del><span class="cx"> break;
</span><span class="cx"> }
</span><span class="cx"> if (Node::shouldSpeculateNumberOrBooleanExpectingDefined(node->child1().node(), node->child2().node())) {
</span><span class="cx"> fixDoubleOrBooleanEdge(node->child1());
</span><span class="cx"> fixDoubleOrBooleanEdge(node->child2());
</span><span class="cx"> node->setOp(ArithAdd);
</span><del>- node->clearFlags(NodeMustGenerate);
</del><span class="cx"> node->setResult(NodeResultDouble);
</span><span class="cx"> break;
</span><span class="cx"> }
</span><span class="lines">@@ -268,12 +264,6 @@
</span><span class="cx"> fixDoubleOrBooleanEdge(node->child1());
</span><span class="cx"> fixDoubleOrBooleanEdge(node->child2());
</span><span class="cx">
</span><del>- // But we have to make sure that everything is phantom'd until after the
- // DoubleAsInt32 node, which occurs after the Div/Mod node that the conversions
- // will be insered on.
- addRequiredPhantom(node->child1().node());
- addRequiredPhantom(node->child2().node());
-
</del><span class="cx"> // We don't need to do ref'ing on the children because we're stealing them from
</span><span class="cx"> // the original division.
</span><span class="cx"> Node* newDivision = m_insertionSet.insertNode(
</span><span class="lines">@@ -847,7 +837,7 @@
</span><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> m_insertionSet.insertNode(
</span><del>- m_indexInBlock, SpecNone, Phantom, node->origin,
</del><ins>+ m_indexInBlock, SpecNone, Check, node->origin,
</ins><span class="cx"> Edge(node->child1().node(), OtherUse));
</span><span class="cx"> observeUseKindOnNode<OtherUse>(node->child1().node());
</span><span class="cx"> m_graph.convertToConstant(
</span><span class="lines">@@ -998,7 +988,6 @@
</span><span class="cx"> break;
</span><span class="cx"> }
</span><span class="cx">
</span><del>- case Phantom:
</del><span class="cx"> case Check: {
</span><span class="cx"> switch (node->child1().useKind()) {
</span><span class="cx"> case NumberUse:
</span><span class="lines">@@ -1012,6 +1001,11 @@
</span><span class="cx"> break;
</span><span class="cx"> }
</span><span class="cx">
</span><ins>+ case Phantom:
+ // Phantoms are meaningless past Fixup. We recreate them on-demand in the backend.
+ node->remove();
+ break;
+
</ins><span class="cx"> case FiatInt52: {
</span><span class="cx"> RELEASE_ASSERT(enableInt52());
</span><span class="cx"> node->convertToIdentity();
</span><span class="lines">@@ -1075,7 +1069,7 @@
</span><span class="cx"> case IsString:
</span><span class="cx"> if (node->child1()->shouldSpeculateString()) {
</span><span class="cx"> m_insertionSet.insertNode(
</span><del>- m_indexInBlock, SpecNone, Phantom, node->origin,
</del><ins>+ m_indexInBlock, SpecNone, Check, node->origin,
</ins><span class="cx"> Edge(node->child1().node(), StringUse));
</span><span class="cx"> m_graph.convertToConstant(node, jsBoolean(true));
</span><span class="cx"> observeUseKindOnNode<StringUse>(node);
</span><span class="lines">@@ -1085,7 +1079,7 @@
</span><span class="cx"> case IsObject:
</span><span class="cx"> if (node->child1()->shouldSpeculateObject()) {
</span><span class="cx"> m_insertionSet.insertNode(
</span><del>- m_indexInBlock, SpecNone, Phantom, node->origin,
</del><ins>+ m_indexInBlock, SpecNone, Check, node->origin,
</ins><span class="cx"> Edge(node->child1().node(), ObjectUse));
</span><span class="cx"> m_graph.convertToConstant(node, jsBoolean(true));
</span><span class="cx"> observeUseKindOnNode<ObjectUse>(node);
</span><span class="lines">@@ -1158,28 +1152,28 @@
</span><span class="cx"> RefPtr<TypeSet> typeSet = node->typeLocation()->m_instructionTypeSet;
</span><span class="cx"> RuntimeTypeMask seenTypes = typeSet->seenTypes();
</span><span class="cx"> if (typeSet->doesTypeConformTo(TypeMachineInt)) {
</span><del>- node->convertToCheck();
</del><span class="cx"> if (node->child1()->shouldSpeculateInt32())
</span><span class="cx"> fixEdge<Int32Use>(node->child1());
</span><span class="cx"> else
</span><span class="cx"> fixEdge<MachineIntUse>(node->child1());
</span><ins>+ node->remove();
</ins><span class="cx"> } else if (typeSet->doesTypeConformTo(TypeNumber | TypeMachineInt)) {
</span><del>- node->convertToCheck();
</del><span class="cx"> fixEdge<NumberUse>(node->child1());
</span><ins>+ node->remove();
</ins><span class="cx"> } else if (typeSet->doesTypeConformTo(TypeString)) {
</span><del>- node->convertToCheck();
</del><span class="cx"> fixEdge<StringUse>(node->child1());
</span><ins>+ node->remove();
</ins><span class="cx"> } else if (typeSet->doesTypeConformTo(TypeBoolean)) {
</span><del>- node->convertToCheck();
</del><span class="cx"> fixEdge<BooleanUse>(node->child1());
</span><ins>+ node->remove();
</ins><span class="cx"> } else if (typeSet->doesTypeConformTo(TypeUndefined | TypeNull) && (seenTypes & TypeUndefined) && (seenTypes & TypeNull)) {
</span><del>- node->convertToCheck();
</del><span class="cx"> fixEdge<OtherUse>(node->child1());
</span><ins>+ node->remove();
</ins><span class="cx"> } else if (typeSet->doesTypeConformTo(TypeObject)) {
</span><span class="cx"> StructureSet set = typeSet->structureSet();
</span><span class="cx"> if (!set.isEmpty()) {
</span><del>- node->convertToCheckStructure(m_graph.addStructureSet(set));
</del><span class="cx"> fixEdge<CellUse>(node->child1());
</span><ins>+ node->convertToCheckStructure(m_graph.addStructureSet(set));
</ins><span class="cx"> }
</span><span class="cx"> }
</span><span class="cx">
</span><span class="lines">@@ -1296,7 +1290,7 @@
</span><span class="cx"> // decision process much easier.
</span><span class="cx"> observeUseKindOnNode<StringUse>(edge.node());
</span><span class="cx"> m_insertionSet.insertNode(
</span><del>- m_indexInBlock, SpecNone, Phantom, node->origin,
</del><ins>+ m_indexInBlock, SpecNone, Check, node->origin,
</ins><span class="cx"> Edge(edge.node(), StringUse));
</span><span class="cx"> edge.setUseKind(KnownStringUse);
</span><span class="cx"> return;
</span><span class="lines">@@ -1398,9 +1392,6 @@
</span><span class="cx"> template<UseKind leftUseKind>
</span><span class="cx"> bool attemptToMakeFastStringAdd(Node* node, Edge& left, Edge& right)
</span><span class="cx"> {
</span><del>- Node* originalLeft = left.node();
- Node* originalRight = right.node();
-
</del><span class="cx"> ASSERT(leftUseKind == StringUse || leftUseKind == StringObjectUse || leftUseKind == StringOrStringObjectUse);
</span><span class="cx">
</span><span class="cx"> if (isStringObjectUse<leftUseKind>() && !canOptimizeStringObjectAccess(node->origin.semantic))
</span><span class="lines">@@ -1435,12 +1426,6 @@
</span><span class="cx"> right.setNode(toString);
</span><span class="cx"> }
</span><span class="cx">
</span><del>- // We're doing checks up there, so we need to make sure that the
- // *original* inputs to the addition are live up to here.
- m_insertionSet.insertNode(
- m_indexInBlock, SpecNone, Phantom, node->origin,
- Edge(originalLeft), Edge(originalRight));
-
</del><span class="cx"> convertToMakeRope(node);
</span><span class="cx"> return true;
</span><span class="cx"> }
</span><span class="lines">@@ -1564,7 +1549,7 @@
</span><span class="cx">
</span><span class="cx"> if (arrayMode.type() == Array::String) {
</span><span class="cx"> m_insertionSet.insertNode(
</span><del>- m_indexInBlock, SpecNone, Phantom, origin, Edge(array, StringUse));
</del><ins>+ m_indexInBlock, SpecNone, Check, origin, Edge(array, StringUse));
</ins><span class="cx"> } else {
</span><span class="cx"> Structure* structure = arrayMode.originalArrayStructure(m_graph, origin.semantic);
</span><span class="cx">
</span><span class="lines">@@ -1775,7 +1760,6 @@
</span><span class="cx"> observeUseKindOnNode(node, useKind);
</span><span class="cx">
</span><span class="cx"> edge = Edge(newNode, KnownInt32Use);
</span><del>- addRequiredPhantom(node);
</del><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> void fixIntOrBooleanEdge(Edge& edge)
</span><span class="lines">@@ -1797,7 +1781,6 @@
</span><span class="cx"> observeUseKindOnNode(node, useKind);
</span><span class="cx">
</span><span class="cx"> edge = Edge(newNode, Int32Use);
</span><del>- addRequiredPhantom(node);
</del><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> void fixDoubleOrBooleanEdge(Edge& edge)
</span><span class="lines">@@ -1819,7 +1802,6 @@
</span><span class="cx"> observeUseKindOnNode(node, useKind);
</span><span class="cx">
</span><span class="cx"> edge = Edge(newNode, DoubleRepUse);
</span><del>- addRequiredPhantom(node);
</del><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> void truncateConstantToInt32(Edge& edge)
</span><span class="lines">@@ -1999,11 +1981,9 @@
</span><span class="cx"> m_block = block;
</span><span class="cx"> for (m_indexInBlock = 0; m_indexInBlock < block->size(); ++m_indexInBlock) {
</span><span class="cx"> m_currentNode = block->at(m_indexInBlock);
</span><del>- addPhantomsIfNecessary();
</del><span class="cx"> tryToRelaxRepresentation(m_currentNode);
</span><span class="cx"> DFG_NODE_DO_TO_CHILDREN(m_graph, m_currentNode, injectTypeConversionsForEdge);
</span><span class="cx"> }
</span><del>- addPhantomsIfNecessary();
</del><span class="cx"> m_insertionSet.execute(block);
</span><span class="cx"> }
</span><span class="cx">
</span><span class="lines">@@ -2017,7 +1997,6 @@
</span><span class="cx">
</span><span class="cx"> switch (node->op()) {
</span><span class="cx"> case MovHint:
</span><del>- case Phantom:
</del><span class="cx"> case Check:
</span><span class="cx"> DFG_NODE_DO_TO_CHILDREN(m_graph, m_currentNode, fixEdgeRepresentation);
</span><span class="cx"> break;
</span><span class="lines">@@ -2078,8 +2057,6 @@
</span><span class="cx"> if (edge->hasDoubleResult())
</span><span class="cx"> break;
</span><span class="cx">
</span><del>- addRequiredPhantom(edge.node());
-
</del><span class="cx"> if (edge->isNumberConstant()) {
</span><span class="cx"> result = m_insertionSet.insertNode(
</span><span class="cx"> m_indexInBlock, SpecBytecodeDouble, DoubleConstant, node->origin,
</span><span class="lines">@@ -2102,8 +2079,6 @@
</span><span class="cx"> if (edge->hasInt52Result())
</span><span class="cx"> break;
</span><span class="cx">
</span><del>- addRequiredPhantom(edge.node());
-
</del><span class="cx"> if (edge->isMachineIntConstant()) {
</span><span class="cx"> result = m_insertionSet.insertNode(
</span><span class="cx"> m_indexInBlock, SpecMachineInt, Int52Constant, node->origin,
</span><span class="lines">@@ -2130,8 +2105,6 @@
</span><span class="cx"> if (!edge->hasDoubleResult() && !edge->hasInt52Result())
</span><span class="cx"> break;
</span><span class="cx">
</span><del>- addRequiredPhantom(edge.node());
-
</del><span class="cx"> if (edge->hasDoubleResult()) {
</span><span class="cx"> result = m_insertionSet.insertNode(
</span><span class="cx"> m_indexInBlock, SpecBytecodeDouble, ValueRep, node->origin,
</span><span class="lines">@@ -2147,32 +2120,11 @@
</span><span class="cx"> } }
</span><span class="cx"> }
</span><span class="cx">
</span><del>- void addRequiredPhantom(Node* node)
- {
- m_requiredPhantoms.append(node);
- }
-
- void addPhantomsIfNecessary()
- {
- if (m_requiredPhantoms.isEmpty())
- return;
-
- for (unsigned i = m_requiredPhantoms.size(); i--;) {
- Node* node = m_requiredPhantoms[i];
- m_insertionSet.insertNode(
- m_indexInBlock, SpecNone, Phantom, m_currentNode->origin,
- node->defaultEdge());
- }
-
- m_requiredPhantoms.resize(0);
- }
-
</del><span class="cx"> BasicBlock* m_block;
</span><span class="cx"> unsigned m_indexInBlock;
</span><span class="cx"> Node* m_currentNode;
</span><span class="cx"> InsertionSet m_insertionSet;
</span><span class="cx"> bool m_profitabilityChanged;
</span><del>- Vector<Node*, 3> m_requiredPhantoms;
</del><span class="cx"> };
</span><span class="cx">
</span><span class="cx"> bool performFixup(Graph& graph)
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGGraphcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGGraph.cpp (183496 => 183497)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGGraph.cpp 2015-04-28 18:56:51 UTC (rev 183496)
+++ trunk/Source/JavaScriptCore/dfg/DFGGraph.cpp 2015-04-28 19:27:23 UTC (rev 183497)
</span><span class="lines">@@ -593,26 +593,6 @@
</span><span class="cx"> determineReachability();
</span><span class="cx"> }
</span><span class="cx">
</span><del>-void Graph::mergeRelevantToOSR()
-{
- for (BasicBlock* block : blocksInNaturalOrder()) {
- for (Node* node : *block) {
- switch (node->op()) {
- case MovHint:
- node->child1()->mergeFlags(NodeRelevantToOSR);
- break;
-
- case PutHint:
- node->child2()->mergeFlags(NodeRelevantToOSR);
- break;
-
- default:
- break;
- }
- }
- }
-}
-
</del><span class="cx"> namespace {
</span><span class="cx">
</span><span class="cx"> class RefCountCalculator {
</span><span class="lines">@@ -625,12 +605,6 @@
</span><span class="cx"> void calculate()
</span><span class="cx"> {
</span><span class="cx"> // First reset the counts to 0 for all nodes.
</span><del>- //
- // Also take this opportunity to pretend that Check nodes are not NodeMustGenerate. Check
- // nodes are MustGenerate because they are executed for effect, but they follow the same
- // DCE rules as nodes that aren't MustGenerate: they only contribute to the ref count of
- // their children if the edges require checks. Non-checking edges are removed. Note that
- // for any Checks left over, this phase will turn them back into NodeMustGenerate.
</del><span class="cx"> for (BlockIndex blockIndex = 0; blockIndex < m_graph.numBlocks(); ++blockIndex) {
</span><span class="cx"> BasicBlock* block = m_graph.block(blockIndex);
</span><span class="cx"> if (!block)
</span><span class="lines">@@ -654,11 +628,6 @@
</span><span class="cx"> DFG_NODE_DO_TO_CHILDREN(m_graph, node, findTypeCheckRoot);
</span><span class="cx"> if (!(node->flags() & NodeMustGenerate))
</span><span class="cx"> continue;
</span><del>- if (node->op() == Check) {
- // We don't treat Check nodes as MustGenerate. We will gladly
- // kill them off in this phase.
- continue;
- }
</del><span class="cx"> if (!node->postfixRef())
</span><span class="cx"> m_worklist.append(node);
</span><span class="cx"> }
</span><span class="lines">@@ -1263,12 +1232,6 @@
</span><span class="cx"> {
</span><span class="cx"> if (value->structure())
</span><span class="cx"> assertIsRegistered(value->structure());
</span><del>- if (m_form == ThreadedCPS) {
- if (node->op() == GetLocal)
- dethread();
- else
- ASSERT(!node->hasVariableAccessData(*this));
- }
</del><span class="cx"> node->convertToConstant(value);
</span><span class="cx"> }
</span><span class="cx">
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGGraphh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGGraph.h (183496 => 183497)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGGraph.h 2015-04-28 18:56:51 UTC (rev 183496)
+++ trunk/Source/JavaScriptCore/dfg/DFGGraph.h 2015-04-28 19:27:23 UTC (rev 183497)
</span><span class="lines">@@ -452,8 +452,6 @@
</span><span class="cx"> void determineReachability();
</span><span class="cx"> void resetReachability();
</span><span class="cx">
</span><del>- void mergeRelevantToOSR();
-
</del><span class="cx"> void computeRefCounts();
</span><span class="cx">
</span><span class="cx"> unsigned varArgNumChildren(Node* node)
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGInsertionSeth"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGInsertionSet.h (183496 => 183497)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGInsertionSet.h 2015-04-28 18:56:51 UTC (rev 183496)
+++ trunk/Source/JavaScriptCore/dfg/DFGInsertionSet.h 2015-04-28 19:27:23 UTC (rev 183497)
</span><span class="lines">@@ -125,6 +125,26 @@
</span><span class="cx"> return insertConstantForUse(index, origin, jsUndefined(), useKind);
</span><span class="cx"> }
</span><span class="cx">
</span><ins>+ Node* insertCheck(size_t index, NodeOrigin origin, AdjacencyList children)
+ {
+ children = children.justChecks();
+ if (children.isEmpty())
+ return nullptr;
+ return insertNode(index, SpecNone, Check, origin, children);
+ }
+
+ Node* insertCheck(size_t index, Node* node)
+ {
+ return insertCheck(index, node->origin, node->children);
+ }
+
+ Node* insertCheck(size_t index, NodeOrigin origin, Edge edge)
+ {
+ if (edge.willHaveCheck())
+ return insertNode(index, SpecNone, Check, origin, edge);
+ return nullptr;
+ }
+
</ins><span class="cx"> void execute(BasicBlock* block)
</span><span class="cx"> {
</span><span class="cx"> executeInsertions(*block, m_insertions);
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGIntegerCheckCombiningPhasecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGIntegerCheckCombiningPhase.cpp (183496 => 183497)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGIntegerCheckCombiningPhase.cpp 2015-04-28 18:56:51 UTC (rev 183496)
+++ trunk/Source/JavaScriptCore/dfg/DFGIntegerCheckCombiningPhase.cpp 2015-04-28 19:27:23 UTC (rev 183497)
</span><span class="lines">@@ -292,7 +292,7 @@
</span><span class="cx"> break;
</span><span class="cx">
</span><span class="cx"> case ArrayBounds:
</span><del>- node->convertToPhantom();
</del><ins>+ node->remove();
</ins><span class="cx"> m_changed = true;
</span><span class="cx"> break;
</span><span class="cx">
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGLICMPhasecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGLICMPhase.cpp (183496 => 183497)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGLICMPhase.cpp 2015-04-28 18:56:51 UTC (rev 183496)
+++ trunk/Source/JavaScriptCore/dfg/DFGLICMPhase.cpp 2015-04-28 19:27:23 UTC (rev 183497)
</span><span class="lines">@@ -263,7 +263,7 @@
</span><span class="cx"> // code. But for now we just assert that's the case.
</span><span class="cx"> DFG_ASSERT(m_graph, node, !(node->flags() & NodeHasVarArgs));
</span><span class="cx">
</span><del>- nodeRef = m_graph.addNode(SpecNone, Phantom, originalOrigin, node->children);
</del><ins>+ nodeRef = m_graph.addNode(SpecNone, Check, originalOrigin, node->children);
</ins><span class="cx">
</span><span class="cx"> return true;
</span><span class="cx"> }
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGNodecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGNode.cpp (183496 => 183497)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGNode.cpp 2015-04-28 18:56:51 UTC (rev 183496)
+++ trunk/Source/JavaScriptCore/dfg/DFGNode.cpp 2015-04-28 19:27:23 UTC (rev 183497)
</span><span class="lines">@@ -85,6 +85,15 @@
</span><span class="cx"> }
</span><span class="cx"> }
</span><span class="cx">
</span><ins>+void Node::remove()
+{
+ ASSERT(!(flags() & NodeHasVarArgs));
+
+ children = children.justChecks();
+
+ setOpAndDefaultFlags(Check);
+}
+
</ins><span class="cx"> void Node::convertToIdentity()
</span><span class="cx"> {
</span><span class="cx"> RELEASE_ASSERT(child1());
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGNodeh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGNode.h (183496 => 183497)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGNode.h 2015-04-28 18:56:51 UTC (rev 183496)
+++ trunk/Source/JavaScriptCore/dfg/DFGNode.h 2015-04-28 19:27:23 UTC (rev 183497)
</span><span class="lines">@@ -407,15 +407,7 @@
</span><span class="cx"> m_flags = defaultFlags(op);
</span><span class="cx"> }
</span><span class="cx">
</span><del>- void convertToPhantom()
- {
- setOpAndDefaultFlags(Phantom);
- }
-
- void convertToCheck()
- {
- setOpAndDefaultFlags(Check);
- }
</del><ins>+ void remove();
</ins><span class="cx">
</span><span class="cx"> void convertToCheckStructure(StructureSet* set)
</span><span class="cx"> {
</span><span class="lines">@@ -425,7 +417,7 @@
</span><span class="cx">
</span><span class="cx"> void replaceWith(Node* other)
</span><span class="cx"> {
</span><del>- convertToPhantom();
</del><ins>+ remove();
</ins><span class="cx"> setReplacement(other);
</span><span class="cx"> }
</span><span class="cx">
</span><span class="lines">@@ -1557,20 +1549,6 @@
</span><span class="cx"> return m_refCount;
</span><span class="cx"> }
</span><span class="cx">
</span><del>- bool willHaveCodeGenOrOSR()
- {
- switch (op()) {
- case SetLocal:
- case MovHint:
- case ZombieHint:
- return true;
- case Phantom:
- return child1().useKindUnchecked() != UntypedUse || child2().useKindUnchecked() != UntypedUse || child3().useKindUnchecked() != UntypedUse;
- default:
- return shouldGenerate();
- }
- }
-
</del><span class="cx"> bool isSemanticallySkippable()
</span><span class="cx"> {
</span><span class="cx"> return op() == CountExecution;
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGNodeFlagsh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGNodeFlags.h (183496 => 183497)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGNodeFlags.h 2015-04-28 18:56:51 UTC (rev 183496)
+++ trunk/Source/JavaScriptCore/dfg/DFGNodeFlags.h 2015-04-28 19:27:23 UTC (rev 183497)
</span><span class="lines">@@ -65,13 +65,12 @@
</span><span class="cx">
</span><span class="cx"> #define NodeArithFlagsMask (NodeBehaviorMask | NodeBytecodeBackPropMask)
</span><span class="cx">
</span><del>-#define NodeRelevantToOSR 0x10000
</del><ins>+#define NodeIsFlushed 0x10000 // Computed by CPSRethreadingPhase, will tell you which local nodes are backwards-reachable from a Flush.
</ins><span class="cx">
</span><del>-#define NodeIsFlushed 0x20000 // Computed by CPSRethreadingPhase, will tell you which local nodes are backwards-reachable from a Flush.
</del><ins>+#define NodeMiscFlag1 0x20000
+#define NodeMiscFlag2 0x40000
+#define NodeMiscFlag3 0x80000
</ins><span class="cx">
</span><del>-#define NodeMiscFlag1 0x40000
-#define NodeMiscFlag2 0x80000
-
</del><span class="cx"> typedef uint32_t NodeFlags;
</span><span class="cx">
</span><span class="cx"> static inline bool bytecodeUsesAsNumber(NodeFlags flags)
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGNodeTypeh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGNodeType.h (183496 => 183497)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGNodeType.h 2015-04-28 18:56:51 UTC (rev 183496)
+++ trunk/Source/JavaScriptCore/dfg/DFGNodeType.h 2015-04-28 19:27:23 UTC (rev 183497)
</span><span class="lines">@@ -60,7 +60,8 @@
</span><span class="cx"> /* basic block might have read a local variable in bytecode. We only remove GetLocals if it */\
</span><span class="cx"> /* is redundant because of an earlier GetLocal or SetLocal in the same block. We could make */\
</span><span class="cx"> /* these not MustGenerate and use a more sophisticated analysis to insert PhantomLocals in */\
</span><del>- /* the same way that we insert Phantoms. https://bugs.webkit.org/show_bug.cgi?id=144086 */\
</del><ins>+ /* the same way that we insert Phantoms. That's hard and probably not profitable. See */\
+ /* https://bugs.webkit.org/show_bug.cgi?id=144086 */\
</ins><span class="cx"> macro(GetLocal, NodeResultJS | NodeMustGenerate) \
</span><span class="cx"> macro(SetLocal, 0) \
</span><span class="cx"> \
</span><span class="lines">@@ -72,8 +73,8 @@
</span><span class="cx"> macro(ZombieHint, NodeMustGenerate) \
</span><span class="cx"> macro(Phantom, NodeMustGenerate) \
</span><span class="cx"> macro(Check, NodeMustGenerate) /* Used if we want just a type check but not liveness. Non-checking uses will be removed. */\
</span><del>- macro(Upsilon, NodeRelevantToOSR) \
- macro(Phi, NodeRelevantToOSR) \
</del><ins>+ macro(Upsilon, 0) \
+ macro(Phi, 0) \
</ins><span class="cx"> macro(Flush, NodeMustGenerate) \
</span><span class="cx"> macro(PhantomLocal, NodeMustGenerate) \
</span><span class="cx"> \
</span><span class="lines">@@ -281,10 +282,10 @@
</span><span class="cx"> macro(CreateActivation, NodeResultJS) \
</span><span class="cx"> \
</span><span class="cx"> macro(CreateDirectArguments, NodeResultJS) \
</span><del>- macro(PhantomDirectArguments, NodeResultJS) \
</del><ins>+ macro(PhantomDirectArguments, NodeResultJS | NodeMustGenerate) \
</ins><span class="cx"> macro(CreateScopedArguments, NodeResultJS) \
</span><span class="cx"> macro(CreateClonedArguments, NodeResultJS) \
</span><del>- macro(PhantomClonedArguments, NodeResultJS) \
</del><ins>+ macro(PhantomClonedArguments, NodeResultJS | NodeMustGenerate) \
</ins><span class="cx"> macro(GetFromArguments, NodeResultJS) \
</span><span class="cx"> macro(PutToArguments, NodeMustGenerate) \
</span><span class="cx"> \
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGObjectAllocationSinkingPhasecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGObjectAllocationSinkingPhase.cpp (183496 => 183497)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGObjectAllocationSinkingPhase.cpp 2015-04-28 18:56:51 UTC (rev 183496)
+++ trunk/Source/JavaScriptCore/dfg/DFGObjectAllocationSinkingPhase.cpp 2015-04-28 19:27:23 UTC (rev 183497)
</span><span class="lines">@@ -585,7 +585,7 @@
</span><span class="cx"> Node* target = node->child1().node();
</span><span class="cx"> if (m_sinkCandidates.contains(target)) {
</span><span class="cx"> ASSERT(target->isPhantomObjectAllocation());
</span><del>- node->convertToPhantom();
</del><ins>+ node->remove();
</ins><span class="cx"> }
</span><span class="cx"> break;
</span><span class="cx"> }
</span><span class="lines">@@ -795,7 +795,6 @@
</span><span class="cx"> break;
</span><span class="cx">
</span><span class="cx"> case MovHint:
</span><del>- case Phantom:
</del><span class="cx"> case Check:
</span><span class="cx"> case PutHint:
</span><span class="cx"> break;
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGPhantomCanonicalizationPhasecpp"></a>
<div class="delfile"><h4>Deleted: trunk/Source/JavaScriptCore/dfg/DFGPhantomCanonicalizationPhase.cpp (183496 => 183497)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGPhantomCanonicalizationPhase.cpp 2015-04-28 18:56:51 UTC (rev 183496)
+++ trunk/Source/JavaScriptCore/dfg/DFGPhantomCanonicalizationPhase.cpp 2015-04-28 19:27:23 UTC (rev 183497)
</span><span class="lines">@@ -1,122 +0,0 @@
</span><del>-/*
- * Copyright (C) 2014 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- * notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- * notice, this list of conditions and the following disclaimer in the
- * documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "config.h"
-#include "DFGPhantomCanonicalizationPhase.h"
-
-#if ENABLE(DFG_JIT)
-
-#include "DFGGraph.h"
-#include "DFGInsertionSet.h"
-#include "DFGPhase.h"
-#include "DFGPredictionPropagationPhase.h"
-#include "DFGVariableAccessDataDump.h"
-#include "JSCInlines.h"
-
-namespace JSC { namespace DFG {
-
-static const NodeFlags NodeNeedsPhantom = NodeMiscFlag1;
-
-class PhantomCanonicalizationPhase : public Phase {
-public:
- PhantomCanonicalizationPhase(Graph& graph)
- : Phase(graph, "phantom canonicalization")
- {
- }
-
- bool run()
- {
- ASSERT(m_graph.m_form == SSA);
-
- m_graph.clearFlagsOnAllNodes(NodeNeedsPhantom | NodeRelevantToOSR);
- m_graph.mergeRelevantToOSR();
-
- for (BlockIndex blockIndex = m_graph.numBlocks(); blockIndex--;) {
- BasicBlock* block = m_graph.block(blockIndex);
- if (!block)
- continue;
-
- unsigned sourceIndex = 0;
- unsigned targetIndex = 0;
- while (sourceIndex < block->size()) {
- Node* node = block->at(sourceIndex++);
- if (node->op() == Phantom || node->op() == Check) {
- for (unsigned i = 0; i < AdjacencyList::Size; ++i) {
- Edge edge = node->children.child(i);
- if (!edge)
- break;
- if ((edge->flags() & NodeRelevantToOSR) && node->op() == Phantom) {
- // A Phantom on a node that is RelevantToOSR means that we need to keep
- // a Phantom on this node instead of just having a Check.
- edge->mergeFlags(NodeNeedsPhantom);
- }
- if (edge.willHaveCheck())
- continue; // Keep the type check.
-
- node->children.removeEdge(i--);
- }
-
- if (node->children.isEmpty()) {
- m_graph.m_allocator.free(node);
- continue;
- }
-
- node->convertToCheck();
- }
- block->at(targetIndex++) = node;
- }
- block->resize(targetIndex);
- }
-
- InsertionSet insertionSet(m_graph);
- for (BlockIndex blockIndex = m_graph.numBlocks(); blockIndex--;) {
- BasicBlock* block = m_graph.block(blockIndex);
- if (!block)
- continue;
-
- for (unsigned nodeIndex = 0; nodeIndex < block->size(); ++nodeIndex) {
- Node* node = block->at(nodeIndex);
- if (node->flags() & NodeNeedsPhantom) {
- insertionSet.insertNode(
- nodeIndex + 1, SpecNone, Phantom, node->origin, node->defaultEdge());
- }
- }
- insertionSet.execute(block);
- }
-
- return true;
- }
-};
-
-bool performPhantomCanonicalization(Graph& graph)
-{
- SamplingRegion samplingRegion("DFG Phantom Canonicalization Phase");
- return runPhase<PhantomCanonicalizationPhase>(graph);
-}
-
-} } // namespace JSC::DFG
-
-#endif // ENABLE(DFG_JIT)
-
</del></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGPhantomCanonicalizationPhaseh"></a>
<div class="delfile"><h4>Deleted: trunk/Source/JavaScriptCore/dfg/DFGPhantomCanonicalizationPhase.h (183496 => 183497)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGPhantomCanonicalizationPhase.h 2015-04-28 18:56:51 UTC (rev 183496)
+++ trunk/Source/JavaScriptCore/dfg/DFGPhantomCanonicalizationPhase.h 2015-04-28 19:27:23 UTC (rev 183497)
</span><span class="lines">@@ -1,51 +0,0 @@
</span><del>-/*
- * Copyright (C) 2014 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- * notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- * notice, this list of conditions and the following disclaimer in the
- * documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#ifndef DFGPhantomCanonicalizationPhase_h
-#define DFGPhantomCanonicalizationPhase_h
-
-#if ENABLE(DFG_JIT)
-
-namespace JSC { namespace DFG {
-
-class Graph;
-
-// Replaces all pre-existing Phantoms with Checks or removes them if the Check is unnecessary. If
-// the Phantom was necessary (it uses a node that is relevant to OSR) then the Phantom is hoisted
-// to just below the node.
-//
-// This phase is only valid in SSA, because it's only in SSA that Phantoms are ignored for the
-// purpose of liveness-at-some-point and are only used for absolute liveness.
-//
-// This phase makes a lot of things easier, like CFG simplification: you don't have to insert any
-// phantoms when jettisoning a CFG edge.
-
-bool performPhantomCanonicalization(Graph&);
-
-} } // namespace JSC::DFG
-
-#endif // ENABLE(DFG_JIT)
-
-#endif // DFGPhantomCanonicalizationPhase_h
</del></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGPhantomRemovalPhasecpp"></a>
<div class="delfile"><h4>Deleted: trunk/Source/JavaScriptCore/dfg/DFGPhantomRemovalPhase.cpp (183496 => 183497)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGPhantomRemovalPhase.cpp 2015-04-28 18:56:51 UTC (rev 183496)
+++ trunk/Source/JavaScriptCore/dfg/DFGPhantomRemovalPhase.cpp 2015-04-28 19:27:23 UTC (rev 183497)
</span><span class="lines">@@ -1,172 +0,0 @@
</span><del>-/*
- * Copyright (C) 2014 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- * notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- * notice, this list of conditions and the following disclaimer in the
- * documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "config.h"
-#include "DFGPhantomRemovalPhase.h"
-
-#if ENABLE(DFG_JIT)
-
-#include "DFGGraph.h"
-#include "DFGInsertionSet.h"
-#include "DFGPhase.h"
-#include "DFGPredictionPropagationPhase.h"
-#include "DFGVariableAccessDataDump.h"
-#include "JSCInlines.h"
-
-namespace JSC { namespace DFG {
-
-class PhantomRemovalPhase : public Phase {
-public:
- PhantomRemovalPhase(Graph& graph)
- : Phase(graph, "phantom removal")
- {
- }
-
- bool run()
- {
- bool changed = false;
-
- for (BlockIndex blockIndex = m_graph.numBlocks(); blockIndex--;) {
- BasicBlock* block = m_graph.block(blockIndex);
- if (!block)
- continue;
-
- // All Phis need to already be marked as relevant to OSR.
- if (!ASSERT_DISABLED) {
- for (unsigned i = 0; i < block->phis.size(); ++i)
- ASSERT(block->phis[i]->flags() & NodeRelevantToOSR);
- }
-
- for (unsigned i = block->size(); i--;) {
- Node* node = block->at(i);
-
- switch (node->op()) {
- case SetLocal:
- case GetLocal: // FIXME: The GetLocal case is only necessary until we do https://bugs.webkit.org/show_bug.cgi?id=106707.
- node->mergeFlags(NodeRelevantToOSR);
- break;
- default:
- node->clearFlags(NodeRelevantToOSR);
- break;
- }
- }
- }
-
- m_graph.mergeRelevantToOSR();
-
- for (BlockIndex blockIndex = m_graph.numBlocks(); blockIndex--;) {
- BasicBlock* block = m_graph.block(blockIndex);
- if (!block)
- continue;
-
- unsigned sourceIndex = 0;
- unsigned targetIndex = 0;
- while (sourceIndex < block->size()) {
- Node* node = block->at(sourceIndex++);
- switch (node->op()) {
- case Phantom: {
- Node* lastNode = nullptr;
- if (sourceIndex > 1) {
- lastNode = block->at(sourceIndex - 2);
-
- // This doesn't need to specialize for Phantom. lastNode could be any node
- // that isn't subject to DCE. But we keep it simple for now.
- if (lastNode->op() != Phantom
- || lastNode->origin.forExit != node->origin.forExit)
- lastNode = nullptr;
- }
- for (unsigned i = 0; i < AdjacencyList::Size; ++i) {
- Edge edge = node->children.child(i);
- if (!edge)
- break;
- if (edge.willHaveCheck())
- continue; // Keep the type check.
- if (edge->flags() & NodeRelevantToOSR) {
- bool found = false;
- if (lastNode) {
- for (unsigned j = 0; j < AdjacencyList::Size; ++j) {
- if (lastNode->children.child(j).node() == edge.node()) {
- found = true;
- break;
- }
- }
- }
- if (!found)
- continue;
- }
-
- node->children.removeEdge(i--);
- changed = true;
- }
-
- if (node->children.isEmpty()) {
- m_graph.m_allocator.free(node);
- changed = true;
- continue;
- }
- break;
- }
-
- case Check: {
- for (unsigned i = 0; i < AdjacencyList::Size; ++i) {
- Edge edge = node->children.child(i);
- if (!edge)
- break;
- if (edge.willHaveCheck())
- continue;
- node->children.removeEdge(i--);
- changed = true;
- }
- if (node->children.isEmpty()) {
- m_graph.m_allocator.free(node);
- changed = true;
- continue;
- }
- break;
- }
-
- default:
- break;
- }
-
- block->at(targetIndex++) = node;
- }
- block->resize(targetIndex);
- }
-
- return changed;
- }
-};
-
-bool performPhantomRemoval(Graph& graph)
-{
- SamplingRegion samplingRegion("DFG Phantom Removal Phase");
- return runPhase<PhantomRemovalPhase>(graph);
-}
-
-} } // namespace JSC::DFG
-
-#endif // ENABLE(DFG_JIT)
-
</del></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGPhantomRemovalPhaseh"></a>
<div class="delfile"><h4>Deleted: trunk/Source/JavaScriptCore/dfg/DFGPhantomRemovalPhase.h (183496 => 183497)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGPhantomRemovalPhase.h 2015-04-28 18:56:51 UTC (rev 183496)
+++ trunk/Source/JavaScriptCore/dfg/DFGPhantomRemovalPhase.h 2015-04-28 19:27:23 UTC (rev 183497)
</span><span class="lines">@@ -1,47 +0,0 @@
</span><del>-/*
- * Copyright (C) 2014 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- * notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- * notice, this list of conditions and the following disclaimer in the
- * documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#ifndef DFGPhantomRemovalPhase_h
-#define DFGPhantomRemovalPhase_h
-
-#if ENABLE(DFG_JIT)
-
-namespace JSC { namespace DFG {
-
-class Graph;
-
-// Cleans up unnecessary Phantoms and Phanton children. This reduces live ranges, but also, it
-// eliminates many Phantoms entirely. This invalidates liveness analysis.
-//
-// This should work over all IR forms; however, in SSA form it's better to run
-// PhantomCanonicalizationPhase since it's more powerful.
-
-bool performPhantomRemoval(Graph&);
-
-} } // namespace JSC::DFG
-
-#endif // ENABLE(DFG_JIT)
-
-#endif // DFGPhantomRemovalPhase_h
</del></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGPlancpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGPlan.cpp (183496 => 183497)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGPlan.cpp 2015-04-28 18:56:51 UTC (rev 183496)
+++ trunk/Source/JavaScriptCore/dfg/DFGPlan.cpp 2015-04-28 19:27:23 UTC (rev 183497)
</span><span class="lines">@@ -35,6 +35,7 @@
</span><span class="cx"> #include "DFGCFGSimplificationPhase.h"
</span><span class="cx"> #include "DFGCPSRethreadingPhase.h"
</span><span class="cx"> #include "DFGCSEPhase.h"
</span><ins>+#include "DFGCleanUpPhase.h"
</ins><span class="cx"> #include "DFGConstantFoldingPhase.h"
</span><span class="cx"> #include "DFGCriticalEdgeBreakingPhase.h"
</span><span class="cx"> #include "DFGDCEPhase.h"
</span><span class="lines">@@ -51,13 +52,10 @@
</span><span class="cx"> #include "DFGOSRAvailabilityAnalysisPhase.h"
</span><span class="cx"> #include "DFGOSREntrypointCreationPhase.h"
</span><span class="cx"> #include "DFGObjectAllocationSinkingPhase.h"
</span><del>-#include "DFGPhantomCanonicalizationPhase.h"
</del><span class="cx"> #include "DFGPhantomInsertionPhase.h"
</span><del>-#include "DFGPhantomRemovalPhase.h"
</del><span class="cx"> #include "DFGPredictionInjectionPhase.h"
</span><span class="cx"> #include "DFGPredictionPropagationPhase.h"
</span><span class="cx"> #include "DFGPutStackSinkingPhase.h"
</span><del>-#include "DFGResurrectionForValidationPhase.h"
</del><span class="cx"> #include "DFGSSAConversionPhase.h"
</span><span class="cx"> #include "DFGSSALoweringPhase.h"
</span><span class="cx"> #include "DFGStackLayoutPhase.h"
</span><span class="lines">@@ -318,7 +316,7 @@
</span><span class="cx"> performTierUpCheckInjection(dfg);
</span><span class="cx">
</span><span class="cx"> performStoreBarrierElision(dfg);
</span><del>- performPhantomRemoval(dfg);
</del><ins>+ performCleanUp(dfg);
</ins><span class="cx"> performCPSRethreading(dfg);
</span><span class="cx"> performDCE(dfg);
</span><span class="cx"> performPhantomInsertion(dfg);
</span><span class="lines">@@ -344,7 +342,7 @@
</span><span class="cx"> return FailPath;
</span><span class="cx"> }
</span><span class="cx">
</span><del>- performPhantomRemoval(dfg); // Reduce the graph size a bit.
</del><ins>+ performCleanUp(dfg); // Reduce the graph size a bit.
</ins><span class="cx"> performCriticalEdgeBreaking(dfg);
</span><span class="cx"> performLoopPreHeaderCreation(dfg);
</span><span class="cx"> performCPSRethreading(dfg);
</span><span class="lines">@@ -359,7 +357,7 @@
</span><span class="cx"> performLivenessAnalysis(dfg);
</span><span class="cx"> performCFA(dfg);
</span><span class="cx"> performConstantFolding(dfg);
</span><del>- performPhantomCanonicalization(dfg); // Reduce the graph size a lot.
</del><ins>+ performCleanUp(dfg); // Reduce the graph size a lot.
</ins><span class="cx"> changed = false;
</span><span class="cx"> changed |= performStrengthReduction(dfg);
</span><span class="cx"> if (Options::enableObjectAllocationSinking()) {
</span><span class="lines">@@ -381,7 +379,7 @@
</span><span class="cx"> // then we'd need to do some simple SSA fix-up.
</span><span class="cx"> performLICM(dfg);
</span><span class="cx">
</span><del>- performPhantomCanonicalization(dfg);
</del><ins>+ performCleanUp(dfg);
</ins><span class="cx"> performIntegerCheckCombining(dfg);
</span><span class="cx"> performGlobalCSE(dfg);
</span><span class="cx">
</span><span class="lines">@@ -390,15 +388,11 @@
</span><span class="cx"> dfg.m_fixpointState = FixpointConverged;
</span><span class="cx">
</span><span class="cx"> performStoreBarrierElision(dfg);
</span><del>- performPhantomCanonicalization(dfg);
</del><span class="cx"> performLivenessAnalysis(dfg);
</span><span class="cx"> performCFA(dfg);
</span><del>- if (Options::validateFTLOSRExitLiveness())
- performResurrectionForValidation(dfg);
- if (Options::enableMovHintRemoval()) {
</del><ins>+ if (Options::enableMovHintRemoval())
</ins><span class="cx"> performMovHintRemoval(dfg);
</span><del>- performPhantomCanonicalization(dfg);
- }
</del><ins>+ performCleanUp(dfg);
</ins><span class="cx"> performDCE(dfg); // We rely on this to kill dead code that won't be recognized as dead by LLVM.
</span><span class="cx"> performStackLayout(dfg);
</span><span class="cx"> performLivenessAnalysis(dfg);
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGPutStackSinkingPhasecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGPutStackSinkingPhase.cpp (183496 => 183497)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGPutStackSinkingPhase.cpp 2015-04-28 18:56:51 UTC (rev 183496)
+++ trunk/Source/JavaScriptCore/dfg/DFGPutStackSinkingPhase.cpp 2015-04-28 19:27:23 UTC (rev 183497)
</span><span class="lines">@@ -495,7 +495,7 @@
</span><span class="cx">
</span><span class="cx"> insertionSet.insertNode(
</span><span class="cx"> nodeIndex, SpecNone, KillStack, node->origin, OpInfo(node->stackAccessData()->local.offset()));
</span><del>- node->convertToPhantom();
</del><ins>+ node->remove();
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> insertionSet.execute(block);
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGResurrectionForValidationPhasecpp"></a>
<div class="delfile"><h4>Deleted: trunk/Source/JavaScriptCore/dfg/DFGResurrectionForValidationPhase.cpp (183496 => 183497)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGResurrectionForValidationPhase.cpp 2015-04-28 18:56:51 UTC (rev 183496)
+++ trunk/Source/JavaScriptCore/dfg/DFGResurrectionForValidationPhase.cpp 2015-04-28 19:27:23 UTC (rev 183497)
</span><span class="lines">@@ -1,79 +0,0 @@
</span><del>-/*
- * Copyright (C) 2013 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- * notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- * notice, this list of conditions and the following disclaimer in the
- * documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "config.h"
-#include "DFGResurrectionForValidationPhase.h"
-
-#if ENABLE(DFG_JIT)
-
-#include "DFGBasicBlockInlines.h"
-#include "DFGGraph.h"
-#include "DFGInsertionSet.h"
-#include "DFGPhase.h"
-#include "JSCInlines.h"
-
-namespace JSC { namespace DFG {
-
-class ResurrectionForValidationPhase : public Phase {
-public:
- ResurrectionForValidationPhase(Graph& graph)
- : Phase(graph, "resurrection for validation")
- {
- }
-
- bool run()
- {
- InsertionSet insertionSet(m_graph);
-
- for (BlockIndex blockIndex = m_graph.numBlocks(); blockIndex--;) {
- BasicBlock* block = m_graph.block(blockIndex);
- if (!block)
- continue;
-
- for (unsigned nodeIndex = 0; nodeIndex < block->size(); ++nodeIndex) {
- Node* node = block->at(nodeIndex);
- if (!node->hasResult())
- continue;
- insertionSet.insertNode(
- nodeIndex + 1, SpecNone, Phantom, node->origin, node->defaultEdge());
- }
-
- insertionSet.execute(block);
- }
-
- return true;
- }
-};
-
-bool performResurrectionForValidation(Graph& graph)
-{
- SamplingRegion samplingRegion("DFG Resurrection For Validation Phase");
- return runPhase<ResurrectionForValidationPhase>(graph);
-}
-
-} } // namespace JSC::DFG
-
-#endif // ENABLE(DFG_JIT)
-
</del></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGResurrectionForValidationPhaseh"></a>
<div class="delfile"><h4>Deleted: trunk/Source/JavaScriptCore/dfg/DFGResurrectionForValidationPhase.h (183496 => 183497)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGResurrectionForValidationPhase.h 2015-04-28 18:56:51 UTC (rev 183496)
+++ trunk/Source/JavaScriptCore/dfg/DFGResurrectionForValidationPhase.h 2015-04-28 19:27:23 UTC (rev 183497)
</span><span class="lines">@@ -1,50 +0,0 @@
</span><del>-/*
- * Copyright (C) 2013 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- * notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- * notice, this list of conditions and the following disclaimer in the
- * documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#ifndef DFGResurrectionForValidationPhase_h
-#define DFGResurrectionForValidationPhase_h
-
-#if ENABLE(DFG_JIT)
-
-#include "DFGCommon.h"
-
-namespace JSC { namespace DFG {
-
-class Graph;
-
-// Places a Phantom after every value-producing node, thereby disabling DCE from killing it.
-// This is useful for validating our OSR exit machinery by instituting the requirement that
-// any live-in-bytecode variable should be OSR-available. Without this phase, it's impossible
-// to make such an assertion because our DCE is more aggressive than the bytecode liveness
-// analysis.
-
-bool performResurrectionForValidation(Graph&);
-
-} } // namespace JSC::DFG
-
-#endif // ENABLE(DFG_JIT)
-
-#endif // DFGResurrectionForValidationPhase_h
-
</del></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGSSAConversionPhasecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGSSAConversionPhase.cpp (183496 => 183497)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGSSAConversionPhase.cpp 2015-04-28 18:56:51 UTC (rev 183496)
+++ trunk/Source/JavaScriptCore/dfg/DFGSSAConversionPhase.cpp 2015-04-28 19:27:23 UTC (rev 183497)
</span><span class="lines">@@ -300,7 +300,7 @@
</span><span class="cx"> VariableAccessData* variable = node->variableAccessData();
</span><span class="cx"> node->children.reset();
</span><span class="cx">
</span><del>- node->convertToPhantom();
</del><ins>+ node->remove();
</ins><span class="cx"> if (verbose)
</span><span class="cx"> dataLog("Replacing node ", node, " with ", valueForOperand.operand(variable->local()), "\n");
</span><span class="cx"> node->setReplacement(valueForOperand.operand(variable->local()));
</span><span class="lines">@@ -309,7 +309,7 @@
</span><span class="cx">
</span><span class="cx"> case Flush: {
</span><span class="cx"> node->children.reset();
</span><del>- node->convertToPhantom();
</del><ins>+ node->remove();
</ins><span class="cx"> break;
</span><span class="cx"> }
</span><span class="cx">
</span><span class="lines">@@ -317,12 +317,12 @@
</span><span class="cx"> ASSERT(node->child1().useKind() == UntypedUse);
</span><span class="cx"> VariableAccessData* variable = node->variableAccessData();
</span><span class="cx"> node->child1() = valueForOperand.operand(variable->local())->defaultEdge();
</span><del>- node->convertToPhantom();
</del><ins>+ node->remove();
</ins><span class="cx"> break;
</span><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> case SetArgument: {
</span><del>- node->convertToPhantom();
</del><ins>+ node->remove();
</ins><span class="cx"> break;
</span><span class="cx"> }
</span><span class="cx">
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGSpeculativeJIT64cpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp (183496 => 183497)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp 2015-04-28 18:56:51 UTC (rev 183496)
+++ trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp 2015-04-28 19:27:23 UTC (rev 183497)
</span><span class="lines">@@ -1068,6 +1068,12 @@
</span><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> DataFormat spillFormat = info.spillFormat();
</span><ins>+ if (spillFormat != DataFormatDouble) {
+ DFG_CRASH(
+ m_jit.graph(), m_currentNode, toCString(
+ "Expected ", edge, " to have double format but instead it is spilled as ",
+ dataFormatToString(spillFormat)).data());
+ }
</ins><span class="cx"> DFG_ASSERT(m_jit.graph(), m_currentNode, spillFormat == DataFormatDouble);
</span><span class="cx"> FPRReg fpr = fprAllocate();
</span><span class="cx"> m_jit.loadDouble(JITCompiler::addressFor(virtualRegister), fpr);
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGStoreBarrierElisionPhasecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGStoreBarrierElisionPhase.cpp (183496 => 183497)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGStoreBarrierElisionPhase.cpp 2015-04-28 18:56:51 UTC (rev 183496)
+++ trunk/Source/JavaScriptCore/dfg/DFGStoreBarrierElisionPhase.cpp 2015-04-28 19:27:23 UTC (rev 183497)
</span><span class="lines">@@ -95,7 +95,7 @@
</span><span class="cx"> void elideBarrier(Node* node)
</span><span class="cx"> {
</span><span class="cx"> ASSERT(node->isStoreBarrier());
</span><del>- node->convertToPhantom();
</del><ins>+ node->remove();
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> void handleNode(HashSet<Node*>& dontNeedBarriers, Node* node)
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGStrengthReductionPhasecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGStrengthReductionPhase.cpp (183496 => 183497)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGStrengthReductionPhase.cpp 2015-04-28 18:56:51 UTC (rev 183496)
+++ trunk/Source/JavaScriptCore/dfg/DFGStrengthReductionPhase.cpp 2015-04-28 19:27:23 UTC (rev 183497)
</span><span class="lines">@@ -139,7 +139,7 @@
</span><span class="cx"> if (yOperandValue == 1) {
</span><span class="cx"> convertToIdentityOverChild1();
</span><span class="cx"> } else if (yOperandValue == 0.5) {
</span><del>- m_insertionSet.insertNode(m_nodeIndex, SpecNone, Phantom, m_node->origin, m_node->children);
</del><ins>+ m_insertionSet.insertCheck(m_nodeIndex, m_node);
</ins><span class="cx"> m_node->convertToArithSqrt();
</span><span class="cx"> m_changed = true;
</span><span class="cx"> }
</span><span class="lines">@@ -166,8 +166,7 @@
</span><span class="cx"> for (Node* node = m_node->child1().node(); ; node = node->child1().node()) {
</span><span class="cx"> if (canonicalResultRepresentation(node->result()) ==
</span><span class="cx"> canonicalResultRepresentation(m_node->result())) {
</span><del>- m_insertionSet.insertNode(
- m_nodeIndex, SpecNone, Phantom, m_node->origin, m_node->child1());
</del><ins>+ m_insertionSet.insertCheck(m_nodeIndex, m_node);
</ins><span class="cx"> if (hadInt32Check) {
</span><span class="cx"> // FIXME: Consider adding Int52RepInt32Use or even DoubleRepInt32Use,
</span><span class="cx"> // which would be super weird. The latter would only arise in some
</span><span class="lines">@@ -175,9 +174,8 @@
</span><span class="cx"> if (canonicalResultRepresentation(node->result()) != NodeResultJS)
</span><span class="cx"> break;
</span><span class="cx">
</span><del>- m_insertionSet.insertNode(
- m_nodeIndex, SpecNone, Phantom, m_node->origin,
- Edge(node, Int32Use));
</del><ins>+ m_insertionSet.insertCheck(
+ m_nodeIndex, m_node->origin, Edge(node, Int32Use));
</ins><span class="cx"> }
</span><span class="cx"> m_node->child1() = node->defaultEdge();
</span><span class="cx"> m_node->convertToIdentity();
</span><span class="lines">@@ -239,8 +237,7 @@
</span><span class="cx">
</span><span class="cx"> void convertToIdentityOverChild(unsigned childIndex)
</span><span class="cx"> {
</span><del>- m_insertionSet.insertNode(
- m_nodeIndex, SpecNone, Phantom, m_node->origin, m_node->children);
</del><ins>+ m_insertionSet.insertCheck(m_nodeIndex, m_node);
</ins><span class="cx"> m_node->children.removeEdge(childIndex ^ 1);
</span><span class="cx"> m_node->convertToIdentity();
</span><span class="cx"> m_changed = true;
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGValidatecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGValidate.cpp (183496 => 183497)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGValidate.cpp 2015-04-28 18:56:51 UTC (rev 183496)
+++ trunk/Source/JavaScriptCore/dfg/DFGValidate.cpp 2015-04-28 19:27:23 UTC (rev 183497)
</span><span class="lines">@@ -146,31 +146,6 @@
</span><span class="cx"> break;
</span><span class="cx"> VALIDATE((node, edge), edge->variableAccessData() == node->variableAccessData());
</span><span class="cx"> break;
</span><del>- case Phantom:
- switch (m_graph.m_form) {
- case LoadStore:
- if (j) {
- VALIDATE((node, edge), edge->hasResult());
- break;
- }
- switch (edge->op()) {
- case Phi:
- case SetArgument:
- case SetLocal:
- break;
- default:
- VALIDATE((node, edge), edge->hasResult());
- break;
- }
- break;
- case ThreadedCPS:
- VALIDATE((node, edge), edge->hasResult());
- break;
- case SSA:
- RELEASE_ASSERT_NOT_REACHED();
- break;
- }
- break;
</del><span class="cx"> default:
</span><span class="cx"> VALIDATE((node, edge), edge->hasResult());
</span><span class="cx"> break;
</span><span class="lines">@@ -196,7 +171,7 @@
</span><span class="cx"> foundTerminal = true;
</span><span class="cx"> for (size_t j = i + 1; j < block->size(); ++j) {
</span><span class="cx"> node = block->at(j);
</span><del>- VALIDATE((node), node->op() == Phantom || node->op() == PhantomLocal || node->op() == Flush);
</del><ins>+ VALIDATE((node), node->op() == Phantom || node->op() == PhantomLocal || node->op() == Flush || node->op() == Check);
</ins><span class="cx"> m_graph.doToChildren(
</span><span class="cx"> node,
</span><span class="cx"> [&] (Edge edge) {
</span><span class="lines">@@ -437,10 +412,6 @@
</span><span class="cx"> case GetLocal:
</span><span class="cx"> case Flush:
</span><span class="cx"> break;
</span><del>- case Phantom:
- if (m_graph.m_form == LoadStore && !j)
- break;
- FALLTHROUGH;
</del><span class="cx"> default:
</span><span class="cx"> VALIDATE((node, edge), !phisInThisBlock.contains(edge.node()));
</span><span class="cx"> break;
</span><span class="lines">@@ -462,6 +433,9 @@
</span><span class="cx"> case GetStack:
</span><span class="cx"> VALIDATE((node), !"unexpected node type in CPS");
</span><span class="cx"> break;
</span><ins>+ case Phantom:
+ VALIDATE((node), m_graph.m_fixpointState != FixpointNotConverged);
+ break;
</ins><span class="cx"> default:
</span><span class="cx"> break;
</span><span class="cx"> }
</span><span class="lines">@@ -541,6 +515,7 @@
</span><span class="cx"> case SetLocal:
</span><span class="cx"> case GetLocalUnlinked:
</span><span class="cx"> case SetArgument:
</span><ins>+ case Phantom:
</ins><span class="cx"> VALIDATE((node), !"bad node type for SSA");
</span><span class="cx"> break;
</span><span class="cx">
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGVarargsForwardingPhasecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGVarargsForwardingPhase.cpp (183496 => 183497)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGVarargsForwardingPhase.cpp 2015-04-28 18:56:51 UTC (rev 183496)
+++ trunk/Source/JavaScriptCore/dfg/DFGVarargsForwardingPhase.cpp 2015-04-28 19:27:23 UTC (rev 183497)
</span><span class="lines">@@ -104,7 +104,6 @@
</span><span class="cx"> relevantLocals.append(node->unlinkedLocal());
</span><span class="cx"> break;
</span><span class="cx">
</span><del>- case Phantom:
</del><span class="cx"> case Check:
</span><span class="cx"> case LoadVarargs:
</span><span class="cx"> if (m_graph.uses(node, candidate))
</span><span class="lines">@@ -237,7 +236,6 @@
</span><span class="cx"> for (unsigned nodeIndex = candidateNodeIndex + 1; nodeIndex <= lastUserIndex; ++nodeIndex) {
</span><span class="cx"> Node* node = block->at(nodeIndex);
</span><span class="cx"> switch (node->op()) {
</span><del>- case Phantom:
</del><span class="cx"> case Check:
</span><span class="cx"> case MovHint:
</span><span class="cx"> case PutHint:
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreftlFTLLinkcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/ftl/FTLLink.cpp (183496 => 183497)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/ftl/FTLLink.cpp 2015-04-28 18:56:51 UTC (rev 183496)
+++ trunk/Source/JavaScriptCore/ftl/FTLLink.cpp 2015-04-28 19:27:23 UTC (rev 183497)
</span><span class="lines">@@ -98,8 +98,6 @@
</span><span class="cx">
</span><span class="cx"> for (size_t nodeIndex = 0; nodeIndex < block->size(); ++nodeIndex) {
</span><span class="cx"> Node* node = block->at(nodeIndex);
</span><del>- if (!node->willHaveCodeGenOrOSR() && !Options::showAllDFGNodes())
- continue;
</del><span class="cx">
</span><span class="cx"> Profiler::OriginStack stack;
</span><span class="cx">
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreftlFTLLowerDFGToLLVMcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/ftl/FTLLowerDFGToLLVM.cpp (183496 => 183497)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/ftl/FTLLowerDFGToLLVM.cpp 2015-04-28 18:56:51 UTC (rev 183496)
+++ trunk/Source/JavaScriptCore/ftl/FTLLowerDFGToLLVM.cpp 2015-04-28 19:27:23 UTC (rev 183497)
</span><span class="lines">@@ -463,9 +463,8 @@
</span><span class="cx"> case PutStack:
</span><span class="cx"> compilePutStack();
</span><span class="cx"> break;
</span><del>- case Phantom:
</del><span class="cx"> case Check:
</span><del>- compilePhantom();
</del><ins>+ compileNoOp();
</ins><span class="cx"> break;
</span><span class="cx"> case ToThis:
</span><span class="cx"> compileToThis();
</span><span class="lines">@@ -1162,7 +1161,7 @@
</span><span class="cx"> }
</span><span class="cx"> }
</span><span class="cx">
</span><del>- void compilePhantom()
</del><ins>+ void compileNoOp()
</ins><span class="cx"> {
</span><span class="cx"> DFG_NODE_DO_TO_CHILDREN(m_graph, m_node, speculate);
</span><span class="cx"> }
</span></span></pre>
</div>
</div>
</body>
</html>