[webkit-reviews] review granted: [Bug 196582] [JSC] OSRExit recovery for SpeculativeAdd does not consier "A = A + A" pattern : [Attachment 366865] Patch

[bugzilla-daemon at webkit.org]

Saam Barati <sbarati at apple.com> has granted Yusuke Suzuki <ysuzuki at apple.com>'s
request for review:
Bug 196582: [JSC] OSRExit recovery for SpeculativeAdd does not consier "A = A +
A" pattern
https://bugs.webkit.org/show_bug.cgi?id=196582

Attachment 366865: Patch

https://bugs.webkit.org/attachment.cgi?id=366865&action=review




--- Comment #4 from Saam Barati <sbarati at apple.com> ---
Comment on attachment 366865
  --> https://bugs.webkit.org/attachment.cgi?id=366865
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=366865&action=review

> Source/JavaScriptCore/ChangeLog:18
> +	   We do not need to have this mechanism in FTL (because FTL handles
registers and stack places better, we do not need to
> +	   have such a peephole optimization), so only DFG has this bug. This
is found by injecting Double prediction into value
> +	   profiling.

I wouldn't even say this. The FTL would also benefit from this as it alleviates
register pressure.

Instead, I'd just say you're removing dead code.

> Source/JavaScriptCore/dfg/DFGOSRExit.h:62
> +    SpeculativeAddSelf,

Can't this just be detected by asking if src() == dst()?