[webkit-reviews] review granted: [Bug 196582] [JSC] OSRExit recovery for SpeculativeAdd does not consier "A = A + A" pattern : [Attachment 366865] Patch

bugzilla-daemon at webkit.org bugzilla-daemon at webkit.org
Fri Apr 5 18:08:22 PDT 2019

Saam Barati <sbarati at apple.com> has granted Yusuke Suzuki <ysuzuki at apple.com>'s
request for review:
Bug 196582: [JSC] OSRExit recovery for SpeculativeAdd does not consier "A = A +
A" pattern

Attachment 366865: Patch


--- Comment #4 from Saam Barati <sbarati at apple.com> ---
Comment on attachment 366865
  --> https://bugs.webkit.org/attachment.cgi?id=366865

View in context: https://bugs.webkit.org/attachment.cgi?id=366865&action=review

> Source/JavaScriptCore/ChangeLog:18
> +	   We do not need to have this mechanism in FTL (because FTL handles
registers and stack places better, we do not need to
> +	   have such a peephole optimization), so only DFG has this bug. This
is found by injecting Double prediction into value
> +	   profiling.

I wouldn't even say this. The FTL would also benefit from this as it alleviates
register pressure.

Instead, I'd just say you're removing dead code.

> Source/JavaScriptCore/dfg/DFGOSRExit.h:62
> +    SpeculativeAddSelf,

Can't this just be detected by asking if src() == dst()?

More information about the webkit-reviews mailing list