<html>
<head>
<base href="https://bugs.webkit.org/" />
</head>
<body><table border="1" cellspacing="0" cellpadding="8">
<tr>
<th>Bug ID</th>
<td><a class="bz_bug_link
bz_status_NEW "
title="NEW - Node::origin.forExit should only be set for those nodes that are allowed to exit"
href="https://bugs.webkit.org/show_bug.cgi?id=145204">145204</a>
</td>
</tr>
<tr>
<th>Summary</th>
<td>Node::origin.forExit should only be set for those nodes that are allowed to exit
</td>
</tr>
<tr>
<th>Classification</th>
<td>Unclassified
</td>
</tr>
<tr>
<th>Product</th>
<td>WebKit
</td>
</tr>
<tr>
<th>Version</th>
<td>528+ (Nightly build)
</td>
</tr>
<tr>
<th>Hardware</th>
<td>All
</td>
</tr>
<tr>
<th>OS</th>
<td>All
</td>
</tr>
<tr>
<th>Status</th>
<td>NEW
</td>
</tr>
<tr>
<th>Severity</th>
<td>Normal
</td>
</tr>
<tr>
<th>Priority</th>
<td>P2
</td>
</tr>
<tr>
<th>Component</th>
<td>JavaScriptCore
</td>
</tr>
<tr>
<th>Assignee</th>
<td>webkit-unassigned@lists.webkit.org
</td>
</tr>
<tr>
<th>Reporter</th>
<td>fpizlo@apple.com
</td>
</tr></table>
<p>
<div>
<pre>We often have sequences of operations like this:
a: GetStuff(...)
b: Check(Thing:@a)
c: Call(@a, ...)
d: MovHint(@c, loc42)
Notice that GetStuff, Check, and Call can all exit. But after Call, you can't exit anymore. In particular, MovHint cannot exit.
But, the fact that MovHint cannot exit is not communicated in the IR. We should change that: a Node's forExit origin is set only when that node can exit.
This means that we can for example immediately see that we cannot hoist an exiting node just above the MovHint. But, we would also see that we could hoist an exiting node above the Call, or above @a or @b.
This would harden the IR for fancier CFG transformations, and make it easier to split blocks and insert control flow.</pre>
</div>
</p>
<hr>
<span>You are receiving this mail because:</span>
<ul>
<li>You are the assignee for the bug.</li>
</ul>
</body>
</html>