Diff
Modified: trunk/Source/_javascript_Core/CMakeLists.txt (183071 => 183072)
--- trunk/Source/_javascript_Core/CMakeLists.txt 2015-04-21 20:06:17 UTC (rev 183071)
+++ trunk/Source/_javascript_Core/CMakeLists.txt 2015-04-21 20:16:18 UTC (rev 183072)
@@ -156,6 +156,7 @@
dfg/DFGDominators.cpp
dfg/DFGDriver.cpp
dfg/DFGEdge.cpp
+ dfg/DFGEpoch.cpp
dfg/DFGFailedFinalizer.cpp
dfg/DFGFinalizer.cpp
dfg/DFGFixupPhase.cpp
@@ -181,6 +182,7 @@
dfg/DFGLoopPreHeaderCreationPhase.cpp
dfg/DFGMayExit.cpp
dfg/DFGMinifiedNode.cpp
+ dfg/DFGMovHintRemovalPhase.cpp
dfg/DFGNaiveDominators.cpp
dfg/DFGNaturalLoops.cpp
dfg/DFGNode.cpp
Modified: trunk/Source/_javascript_Core/ChangeLog (183071 => 183072)
--- trunk/Source/_javascript_Core/ChangeLog 2015-04-21 20:06:17 UTC (rev 183071)
+++ trunk/Source/_javascript_Core/ChangeLog 2015-04-21 20:16:18 UTC (rev 183072)
@@ -1,3 +1,52 @@
+2015-04-19 Filip Pizlo <fpi...@apple.com>
+
+ MovHint should be a strong use
+ https://bugs.webkit.org/show_bug.cgi?id=143734
+
+ Reviewed by Geoffrey Garen.
+
+ This disables any DCE that assumes equivalence between DFG IR uses and bytecode uses. Doing
+ so is a major step towards allowing more fancy DFG transformations and also probably fixing
+ some bugs.
+
+ Just making MovHint a strong use would also completely disable DCE. So we mitigate this by
+ introducing a MovHint removal phase that runs in FTL.
+
+ This is a slight slowdown on Octane/gbemu, but it's basically neutral on suite averages.
+
+ * CMakeLists.txt:
+ * _javascript_Core.vcxproj/_javascript_Core.vcxproj:
+ * _javascript_Core.xcodeproj/project.pbxproj:
+ * bytecode/CodeOrigin.cpp:
+ (JSC::InlineCallFrame::dumpInContext):
+ * dfg/DFGDCEPhase.cpp:
+ (JSC::DFG::DCEPhase::fixupBlock):
+ * dfg/DFGDisassembler.cpp:
+ (JSC::DFG::Disassembler::createDumpList):
+ * dfg/DFGEpoch.cpp: Added.
+ (JSC::DFG::Epoch::dump):
+ * dfg/DFGEpoch.h: Added.
+ (JSC::DFG::Epoch::Epoch):
+ (JSC::DFG::Epoch::first):
+ (JSC::DFG::Epoch::operator!):
+ (JSC::DFG::Epoch::next):
+ (JSC::DFG::Epoch::bump):
+ (JSC::DFG::Epoch::operator==):
+ (JSC::DFG::Epoch::operator!=):
+ * dfg/DFGMayExit.cpp:
+ (JSC::DFG::mayExit):
+ * dfg/DFGMovHintRemovalPhase.cpp: Added.
+ (JSC::DFG::performMovHintRemoval):
+ * dfg/DFGMovHintRemovalPhase.h: Added.
+ * dfg/DFGNodeType.h:
+ * dfg/DFGPlan.cpp:
+ (JSC::DFG::Plan::compileInThreadImpl):
+ * dfg/DFGSpeculativeJIT.cpp:
+ (JSC::DFG::SpeculativeJIT::compileCurrentBlock):
+ * dfg/DFGSpeculativeJIT64.cpp:
+ (JSC::DFG::SpeculativeJIT::compile):
+ * runtime/Options.h:
+
2015-04-21 Basile Clement <basile_clem...@apple.com>
REGRESSION (r182899): icloud.com crashes
Modified: trunk/Source/_javascript_Core/_javascript_Core.vcxproj/_javascript_Core.vcxproj (183071 => 183072)
--- trunk/Source/_javascript_Core/_javascript_Core.vcxproj/_javascript_Core.vcxproj 2015-04-21 20:06:17 UTC (rev 183071)
+++ trunk/Source/_javascript_Core/_javascript_Core.vcxproj/_javascript_Core.vcxproj 2015-04-21 20:16:18 UTC (rev 183072)
@@ -400,6 +400,7 @@
<ClCompile Include="..\dfg\DFGDominators.cpp" />
<ClCompile Include="..\dfg\DFGDriver.cpp" />
<ClCompile Include="..\dfg\DFGEdge.cpp" />
+ <ClCompile Include="..\dfg\DFGEpoch.cpp" />
<ClCompile Include="..\dfg\DFGFailedFinalizer.cpp" />
<ClCompile Include="..\dfg\DFGFinalizer.cpp" />
<ClCompile Include="..\dfg\DFGFixupPhase.cpp" />
@@ -425,6 +426,7 @@
<ClCompile Include="..\dfg\DFGLoopPreHeaderCreationPhase.cpp" />
<ClCompile Include="..\dfg\DFGMayExit.cpp" />
<ClCompile Include="..\dfg\DFGMinifiedNode.cpp" />
+ <ClCompile Include="..\dfg\DFGMovHintRemovalPhase.cpp" />
<ClCompile Include="..\dfg\DFGNaiveDominators.cpp" />
<ClCompile Include="..\dfg\DFGNaturalLoops.cpp" />
<ClCompile Include="..\dfg\DFGNode.cpp" />
@@ -1081,6 +1083,7 @@
<ClInclude Include="..\dfg\DFGEdge.h" />
<ClInclude Include="..\dfg\DFGEdgeDominates.h" />
<ClInclude Include="..\dfg\DFGEdgeUsesStructure.h" />
+ <ClInclude Include="..\dfg\DFGEpoch.h" />
<ClInclude Include="..\dfg\DFGFailedFinalizer.h" />
<ClInclude Include="..\dfg\DFGFiltrationResult.h" />
<ClInclude Include="..\dfg\DFGFinalizer.h" />
@@ -1115,6 +1118,7 @@
<ClInclude Include="..\dfg\DFGMinifiedGraph.h" />
<ClInclude Include="..\dfg\DFGMinifiedID.h" />
<ClInclude Include="..\dfg\DFGMinifiedNode.h" />
+ <ClInclude Include="..\dfg\DFGMovHintRemovalPhase.h" />
<ClInclude Include="..\dfg\DFGNaiveDominators.h" />
<ClInclude Include="..\dfg\DFGNaturalLoops.h" />
<ClInclude Include="..\dfg\DFGNode.h" />
Modified: trunk/Source/_javascript_Core/_javascript_Core.xcodeproj/project.pbxproj (183071 => 183072)
--- trunk/Source/_javascript_Core/_javascript_Core.xcodeproj/project.pbxproj 2015-04-21 20:06:17 UTC (rev 183071)
+++ trunk/Source/_javascript_Core/_javascript_Core.xcodeproj/project.pbxproj 2015-04-21 20:16:18 UTC (rev 183072)
@@ -416,6 +416,10 @@
0F8364B7164B0C110053329A /* DFGBranchDirection.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F8364B5164B0C0E0053329A /* DFGBranchDirection.h */; settings = {ATTRIBUTES = (Private, ); }; };
0F885E111849A3BE00F1E3FA /* BytecodeUseDef.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F885E101849A3BE00F1E3FA /* BytecodeUseDef.h */; settings = {ATTRIBUTES = (Private, ); }; };
0F893BDB1936E23C001211F4 /* DFGStructureAbstractValue.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F893BDA1936E23C001211F4 /* DFGStructureAbstractValue.cpp */; };
+ 0F8F14331ADF090100ED792C /* DFGEpoch.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F8F142F1ADF090100ED792C /* DFGEpoch.cpp */; };
+ 0F8F14341ADF090100ED792C /* DFGEpoch.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F8F14301ADF090100ED792C /* DFGEpoch.h */; settings = {ATTRIBUTES = (Private, ); }; };
+ 0F8F14351ADF090100ED792C /* DFGMovHintRemovalPhase.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F8F14311ADF090100ED792C /* DFGMovHintRemovalPhase.cpp */; };
+ 0F8F14361ADF090100ED792C /* DFGMovHintRemovalPhase.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F8F14321ADF090100ED792C /* DFGMovHintRemovalPhase.h */; settings = {ATTRIBUTES = (Private, ); }; };
0F8F2B95172E04A0007DBDA5 /* FTLLink.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F8F2B93172E049E007DBDA5 /* FTLLink.cpp */; };
0F8F2B96172E04A3007DBDA5 /* FTLLink.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F8F2B94172E049E007DBDA5 /* FTLLink.h */; settings = {ATTRIBUTES = (Private, ); }; };
0F8F2B99172F04FF007DBDA5 /* DFGDesiredIdentifiers.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F8F2B97172F04FD007DBDA5 /* DFGDesiredIdentifiers.cpp */; };
@@ -2142,6 +2146,10 @@
0F8364B5164B0C0E0053329A /* DFGBranchDirection.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGBranchDirection.h; path = dfg/DFGBranchDirection.h; sourceTree = "<group>"; };
0F885E101849A3BE00F1E3FA /* BytecodeUseDef.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = BytecodeUseDef.h; sourceTree = "<group>"; };
0F893BDA1936E23C001211F4 /* DFGStructureAbstractValue.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGStructureAbstractValue.cpp; path = dfg/DFGStructureAbstractValue.cpp; sourceTree = "<group>"; };
+ 0F8F142F1ADF090100ED792C /* DFGEpoch.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGEpoch.cpp; path = dfg/DFGEpoch.cpp; sourceTree = "<group>"; };
+ 0F8F14301ADF090100ED792C /* DFGEpoch.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGEpoch.h; path = dfg/DFGEpoch.h; sourceTree = "<group>"; };
+ 0F8F14311ADF090100ED792C /* DFGMovHintRemovalPhase.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGMovHintRemovalPhase.cpp; path = dfg/DFGMovHintRemovalPhase.cpp; sourceTree = "<group>"; };
+ 0F8F14321ADF090100ED792C /* DFGMovHintRemovalPhase.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGMovHintRemovalPhase.h; path = dfg/DFGMovHintRemovalPhase.h; sourceTree = "<group>"; };
0F8F2B93172E049E007DBDA5 /* FTLLink.cpp */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.cpp.cpp; name = FTLLink.cpp; path = ftl/FTLLink.cpp; sourceTree = "<group>"; };
0F8F2B94172E049E007DBDA5 /* FTLLink.h */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.c.h; name = FTLLink.h; path = ftl/FTLLink.h; sourceTree = "<group>"; };
0F8F2B97172F04FD007DBDA5 /* DFGDesiredIdentifiers.cpp */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.cpp.cpp; name = DFGDesiredIdentifiers.cpp; path = dfg/DFGDesiredIdentifiers.cpp; sourceTree = "<group>"; };
@@ -4906,6 +4914,8 @@
0F66E16914DF3F1300B7B2E4 /* DFGEdge.h */,
A7D9A29117A0BC7400EE2618 /* DFGEdgeDominates.h */,
A7986D5617A0BB1E00A95DD0 /* DFGEdgeUsesStructure.h */,
+ 0F8F142F1ADF090100ED792C /* DFGEpoch.cpp */,
+ 0F8F14301ADF090100ED792C /* DFGEpoch.h */,
A78A976C179738B8009DF744 /* DFGFailedFinalizer.cpp */,
A78A976D179738B8009DF744 /* DFGFailedFinalizer.h */,
A7BFF3BF179868940002F462 /* DFGFiltrationResult.h */,
@@ -4965,6 +4975,8 @@
0FB4B51016B3A964003F696B /* DFGMinifiedID.h */,
0F2BDC4C1522818300CD8910 /* DFGMinifiedNode.cpp */,
0F2BDC3E1522801700CD8910 /* DFGMinifiedNode.h */,
+ 0F8F14311ADF090100ED792C /* DFGMovHintRemovalPhase.cpp */,
+ 0F8F14321ADF090100ED792C /* DFGMovHintRemovalPhase.h */,
0FC3CCFA19ADA410006AC72A /* DFGNaiveDominators.cpp */,
0FC3CCFB19ADA410006AC72A /* DFGNaiveDominators.h */,
A737810A1799EA2E00817533 /* DFGNaturalLoops.cpp */,
@@ -5660,6 +5672,7 @@
969A07230ED1CE3300F1F681 /* BytecodeGenerator.h in Headers */,
C2FCAE1317A9C24E0034C735 /* BytecodeLivenessAnalysis.h in Headers */,
0F666EC0183566F900D017F1 /* BytecodeLivenessAnalysisInlines.h in Headers */,
+ 0F8F14361ADF090100ED792C /* DFGMovHintRemovalPhase.h in Headers */,
0F885E111849A3BE00F1E3FA /* BytecodeUseDef.h in Headers */,
0F8023EA1613832B00A0BA45 /* ByValInfo.h in Headers */,
BC18C3ED0E16F5CD00B34460 /* CallData.h in Headers */,
@@ -6293,6 +6306,7 @@
65303D641447B9E100D3F904 /* ParserTokens.h in Headers */,
0F34B14C16D43E0D001CDA5A /* PolymorphicAccessStructureList.h in Headers */,
0F9FC8C414E1B60000D52AE0 /* PolymorphicPutByIdList.h in Headers */,
+ 0F8F14341ADF090100ED792C /* DFGEpoch.h in Headers */,
0F98206116BFE38300240D02 /* PreciseJumpTargets.h in Headers */,
0F2DD8151AB3D8BE00BBB8E8 /* DFGForAllKills.h in Headers */,
868916B0155F286300CB2B9A /* PrivateName.h in Headers */,
@@ -7375,6 +7389,7 @@
0FF054F91AC35B4400E5BE57 /* ExecutableAllocationFuzz.cpp in Sources */,
86E3C61A167BABEE006D760A /* JSValue.mm in Sources */,
0FF8BDEA1AD4CF7100DFE884 /* InferredValue.cpp in Sources */,
+ 0F8F14351ADF090100ED792C /* DFGMovHintRemovalPhase.cpp in Sources */,
14BD5A320A3E91F600BAF59C /* JSValueRef.cpp in Sources */,
147F39D7107EC37600427A48 /* JSEnvironmentRecord.cpp in Sources */,
86E3C61C167BABEE006D760A /* JSVirtualMachine.mm in Sources */,
@@ -7515,6 +7530,7 @@
A730B6131250068F009D25B1 /* StrictEvalActivation.cpp in Sources */,
14469DEB107EC7E700650446 /* StringConstructor.cpp in Sources */,
14469DEC107EC7E700650446 /* StringObject.cpp in Sources */,
+ 0F8F14331ADF090100ED792C /* DFGEpoch.cpp in Sources */,
14469DED107EC7E700650446 /* StringPrototype.cpp in Sources */,
0F2D4DEF19832DD3007D4B19 /* TypeSet.cpp in Sources */,
9335F24D12E6765B002B5553 /* StringRecursionChecker.cpp in Sources */,
Modified: trunk/Source/_javascript_Core/bytecode/CodeOrigin.cpp (183071 => 183072)
--- trunk/Source/_javascript_Core/bytecode/CodeOrigin.cpp 2015-04-21 20:06:17 UTC (rev 183071)
+++ trunk/Source/_javascript_Core/bytecode/CodeOrigin.cpp 2015-04-21 20:16:18 UTC (rev 183072)
@@ -196,8 +196,8 @@
else
out.print(", known callee: ", inContext(calleeRecovery.constant(), context));
out.print(", numArgs+this = ", arguments.size());
- out.print(", stack < loc", VirtualRegister(stackOffset).toLocal());
- out.print(">");
+ out.print(", stackOffset = ", stackOffset);
+ out.print(" (", virtualRegisterForLocal(0), " maps to ", virtualRegisterForLocal(0) + stackOffset, ")>");
}
void InlineCallFrame::dump(PrintStream& out) const
Modified: trunk/Source/_javascript_Core/dfg/DFGDCEPhase.cpp (183071 => 183072)
--- trunk/Source/_javascript_Core/dfg/DFGDCEPhase.cpp 2015-04-21 20:06:17 UTC (rev 183071)
+++ trunk/Source/_javascript_Core/dfg/DFGDCEPhase.cpp 2015-04-21 20:16:18 UTC (rev 183072)
@@ -143,23 +143,11 @@
continue;
switch (node->op()) {
- case MovHint: {
- // Check if the child is dead. MovHint's child would only be a Phantom or
- // Check if we had just killed it.
- if (node->child1()->op() == Phantom || node->child1()->op() == Check) {
- node->setOpAndDefaultFlags(ZombieHint);
- node->child1() = Edge();
- break;
- }
- break;
- }
-
- case ZombieHint: {
- // Currently we assume that DCE runs only once.
+ case MovHint:
+ case ZombieHint:
+ // These are not killable. (They once were.)
RELEASE_ASSERT_NOT_REACHED();
- break;
- }
-
+
default: {
if (node->flags() & NodeHasVarArgs) {
for (unsigned childIdx = node->firstChild(); childIdx < node->firstChild() + node->numChildren(); childIdx++) {
Modified: trunk/Source/_javascript_Core/dfg/DFGDisassembler.cpp (183071 => 183072)
--- trunk/Source/_javascript_Core/dfg/DFGDisassembler.cpp 2015-04-21 20:06:17 UTC (rev 183071)
+++ trunk/Source/_javascript_Core/dfg/DFGDisassembler.cpp 2015-04-21 20:16:18 UTC (rev 183072)
@@ -112,8 +112,6 @@
append(result, out, previousOrigin);
Node* lastNodeForDisassembly = block->at(0);
for (size_t i = 0; i < block->size(); ++i) {
- if (!block->at(i)->willHaveCodeGenOrOSR() && !Options::showAllDFGNodes())
- continue;
MacroAssembler::Label currentLabel;
HashMap<Node*, MacroAssembler::Label>::iterator iter = m_labelForNode.find(block->at(i));
if (iter != m_labelForNode.end())
Added: trunk/Source/_javascript_Core/dfg/DFGEpoch.cpp (0 => 183072)
--- trunk/Source/_javascript_Core/dfg/DFGEpoch.cpp (rev 0)
+++ trunk/Source/_javascript_Core/dfg/DFGEpoch.cpp 2015-04-21 20:16:18 UTC (rev 183072)
@@ -0,0 +1,43 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ * notice, this list of conditions and the following disclaimer in the
+ * documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "DFGEpoch.h"
+
+#if ENABLE(DFG_JIT)
+
+namespace JSC { namespace DFG {
+
+void Epoch::dump(PrintStream& out) const
+{
+ if (!*this)
+ out.print("none");
+ else
+ out.print(m_epoch);
+}
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
Added: trunk/Source/_javascript_Core/dfg/DFGEpoch.h (0 => 183072)
--- trunk/Source/_javascript_Core/dfg/DFGEpoch.h (rev 0)
+++ trunk/Source/_javascript_Core/dfg/DFGEpoch.h 2015-04-21 20:16:18 UTC (rev 183072)
@@ -0,0 +1,92 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ * notice, this list of conditions and the following disclaimer in the
+ * documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef DFGEpoch_h
+#define DFGEpoch_h
+
+#if ENABLE(DFG_JIT)
+
+#include <wtf/PrintStream.h>
+
+namespace JSC { namespace DFG {
+
+// Utility class for epoch-based analyses.
+
+class Epoch {
+public:
+ Epoch()
+ : m_epoch(s_none)
+ {
+ }
+
+ static Epoch first()
+ {
+ Epoch result;
+ result.m_epoch = s_first;
+ return result;
+ }
+
+ bool operator!() const
+ {
+ return m_epoch == s_none;
+ }
+
+ Epoch next() const
+ {
+ Epoch result;
+ result.m_epoch = m_epoch + 1;
+ return result;
+ }
+
+ void bump()
+ {
+ *this = next();
+ }
+
+ bool operator==(const Epoch& other) const
+ {
+ return m_epoch == other.m_epoch;
+ }
+
+ bool operator!=(const Epoch& other) const
+ {
+ return !(*this == other);
+ }
+
+ void dump(PrintStream&) const;
+
+private:
+ static const unsigned s_none = 0;
+ static const unsigned s_first = 1;
+
+ unsigned m_epoch;
+};
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
+
+#endif // DFGEpoch_h
+
Modified: trunk/Source/_javascript_Core/dfg/DFGMayExit.cpp (183071 => 183072)
--- trunk/Source/_javascript_Core/dfg/DFGMayExit.cpp 2015-04-21 20:06:17 UTC (rev 183071)
+++ trunk/Source/_javascript_Core/dfg/DFGMayExit.cpp 2015-04-21 20:16:18 UTC (rev 183072)
@@ -59,6 +59,9 @@
bool mayExit(Graph& graph, Node* node)
{
switch (node->op()) {
+ // This is a carefully curated list of nodes that definitely do not exit. We try to be very
+ // conservative when maintaining this list, because adding new node types to it doesn't
+ // generally make things a lot better but it might introduce insanely subtle bugs.
case SetArgument:
case JSConstant:
case DoubleConstant:
Added: trunk/Source/_javascript_Core/dfg/DFGMovHintRemovalPhase.cpp (0 => 183072)
--- trunk/Source/_javascript_Core/dfg/DFGMovHintRemovalPhase.cpp (rev 0)
+++ trunk/Source/_javascript_Core/dfg/DFGMovHintRemovalPhase.cpp 2015-04-21 20:16:18 UTC (rev 183072)
@@ -0,0 +1,147 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ * notice, this list of conditions and the following disclaimer in the
+ * documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "DFGMovHintRemovalPhase.h"
+
+#if ENABLE(DFG_JIT)
+
+#include "BytecodeLivenessAnalysisInlines.h"
+#include "DFGEpoch.h"
+#include "DFGForAllKills.h"
+#include "DFGGraph.h"
+#include "DFGInsertionSet.h"
+#include "DFGMayExit.h"
+#include "DFGPhase.h"
+#include "JSCInlines.h"
+#include "OperandsInlines.h"
+
+namespace JSC { namespace DFG {
+
+namespace {
+
+bool verbose = false;
+
+class MovHintRemovalPhase : public Phase {
+public:
+ MovHintRemovalPhase(Graph& graph)
+ : Phase(graph, "MovHint removal")
+ , m_state(OperandsLike, graph.block(0)->variablesAtHead)
+ , m_changed(false)
+ {
+ }
+
+ bool run()
+ {
+ if (verbose) {
+ dataLog("Graph before MovHint removal:\n");
+ m_graph.dump();
+ }
+
+ for (BasicBlock* block : m_graph.blocksInNaturalOrder())
+ handleBlock(block);
+
+ return m_changed;
+ }
+
+private:
+ void handleBlock(BasicBlock* block)
+ {
+ if (verbose)
+ dataLog("Handing block ", pointerDump(block), "\n");
+
+ // A MovHint is unnecessary if the local dies before it is used. We answer this question by
+ // maintaining the current exit epoch, and associating an epoch with each local. When a
+ // local dies, it gets the current exit epoch. If a MovHint occurs in the same epoch as its
+ // local, then it means there was no exit between the local's death and the MovHint - i.e.
+ // the MovHint is unnecessary.
+
+ Epoch currentEpoch = Epoch::first();
+
+ for (unsigned i = m_state.size(); i--;) {
+ VirtualRegister reg = m_state.virtualRegisterForIndex(i);
+ if (m_graph.isLiveInBytecode(reg, block->last()->origin.forExit))
+ m_state[i] = currentEpoch;
+ else
+ m_state[i] = Epoch();
+ }
+
+ if (verbose)
+ dataLog(" Locals: ", m_state, "\n");
+
+ // Assume that blocks after us exit.
+ currentEpoch.bump();
+
+ for (unsigned nodeIndex = block->size(); nodeIndex--;) {
+ Node* node = block->at(nodeIndex);
+
+ if (node->op() == MovHint) {
+ Epoch localEpoch = m_state.operand(node->unlinkedLocal());
+ if (verbose)
+ dataLog(" At ", node, ": current = ", currentEpoch, ", local = ", localEpoch, "\n");
+ if (!localEpoch || localEpoch == currentEpoch) {
+ node->setOpAndDefaultFlags(ZombieHint);
+ node->child1() = Edge();
+ m_changed = true;
+ }
+ m_state.operand(node->unlinkedLocal()) = Epoch();
+ }
+
+ if (mayExit(m_graph, node))
+ currentEpoch.bump();
+
+ if (nodeIndex) {
+ forAllKilledOperands(
+ m_graph, block->at(nodeIndex - 1)->origin.forExit, node,
+ [&] (VirtualRegister reg) {
+ // This function is a bit sloppy - it might claim to kill a local even if
+ // it's still live after. We need to protect against that.
+ if (!!m_state.operand(reg))
+ return;
+
+ if (verbose)
+ dataLog(" Killed operand at ", node, ": ", reg, "\n");
+ m_state.operand(reg) = currentEpoch;
+ });
+ }
+ }
+ }
+
+ Operands<Epoch> m_state;
+ bool m_changed;
+};
+
+} // anonymous namespace
+
+bool performMovHintRemoval(Graph& graph)
+{
+ SamplingRegion samplingRegion("DFG MovHint Removal Phase");
+ return runPhase<MovHintRemovalPhase>(graph);
+}
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
+
Added: trunk/Source/_javascript_Core/dfg/DFGMovHintRemovalPhase.h (0 => 183072)
--- trunk/Source/_javascript_Core/dfg/DFGMovHintRemovalPhase.h (rev 0)
+++ trunk/Source/_javascript_Core/dfg/DFGMovHintRemovalPhase.h 2015-04-21 20:16:18 UTC (rev 183072)
@@ -0,0 +1,44 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ * notice, this list of conditions and the following disclaimer in the
+ * documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef DFGMovHintRemovalPhase_h
+#define DFGMovHintRemovalPhase_h
+
+#if ENABLE(DFG_JIT)
+
+namespace JSC { namespace DFG {
+
+class Graph;
+
+// Cleans up unnecessary MovHints. A MovHint is necessary if the variable dies before there is an
+// exit.
+
+bool performMovHintRemoval(Graph&);
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
+
+#endif // DFGMovHintRemovalPhase_h
Modified: trunk/Source/_javascript_Core/dfg/DFGNodeType.h (183071 => 183072)
--- trunk/Source/_javascript_Core/dfg/DFGNodeType.h 2015-04-21 20:06:17 UTC (rev 183071)
+++ trunk/Source/_javascript_Core/dfg/DFGNodeType.h 2015-04-21 20:16:18 UTC (rev 183072)
@@ -63,8 +63,8 @@
macro(KillStack, NodeMustGenerate) \
macro(GetStack, NodeResultJS) \
\
- macro(MovHint, 0) \
- macro(ZombieHint, 0) \
+ macro(MovHint, NodeMustGenerate) \
+ macro(ZombieHint, NodeMustGenerate) \
macro(Phantom, NodeMustGenerate) \
macro(HardPhantom, NodeMustGenerate) /* Like Phantom, but we never remove any of its children. */ \
macro(Check, NodeMustGenerate) /* Used if we want just a type check but not liveness. Non-checking uses will be removed. */\
Modified: trunk/Source/_javascript_Core/dfg/DFGPlan.cpp (183071 => 183072)
--- trunk/Source/_javascript_Core/dfg/DFGPlan.cpp 2015-04-21 20:06:17 UTC (rev 183071)
+++ trunk/Source/_javascript_Core/dfg/DFGPlan.cpp 2015-04-21 20:16:18 UTC (rev 183072)
@@ -47,6 +47,7 @@
#include "DFGLICMPhase.h"
#include "DFGLivenessAnalysisPhase.h"
#include "DFGLoopPreHeaderCreationPhase.h"
+#include "DFGMovHintRemovalPhase.h"
#include "DFGOSRAvailabilityAnalysisPhase.h"
#include "DFGOSREntrypointCreationPhase.h"
#include "DFGObjectAllocationSinkingPhase.h"
@@ -392,6 +393,8 @@
performCFA(dfg);
if (Options::validateFTLOSRExitLiveness())
performResurrectionForValidation(dfg);
+ if (Options::enableMovHintRemoval())
+ performMovHintRemoval(dfg);
performDCE(dfg); // We rely on this to kill dead code that won't be recognized as dead by LLVM.
performStackLayout(dfg);
performLivenessAnalysis(dfg);
Modified: trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT.cpp (183071 => 183072)
--- trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT.cpp 2015-04-21 20:06:17 UTC (rev 183071)
+++ trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT.cpp 2015-04-21 20:16:18 UTC (rev 183072)
@@ -1429,31 +1429,9 @@
m_codeOriginForExitProfile = m_currentNode->origin.semantic;
m_lastGeneratedNode = m_currentNode->op();
if (!m_currentNode->shouldGenerate()) {
- switch (m_currentNode->op()) {
- case JSConstant:
+ if (belongsInMinifiedGraph(m_currentNode->op()))
m_minifiedGraph->append(MinifiedNode::fromNode(m_currentNode));
- break;
-
- case SetLocal:
- RELEASE_ASSERT_NOT_REACHED();
- break;
-
- case MovHint:
- compileMovHint(m_currentNode);
- break;
-
- case ZombieHint: {
- recordSetLocal(m_currentNode->unlinkedLocal(), VirtualRegister(), DataFormatDead);
- break;
- }
-
- default:
- if (belongsInMinifiedGraph(m_currentNode->op()))
- m_minifiedGraph->append(MinifiedNode::fromNode(m_currentNode));
- break;
- }
} else {
-
if (verboseCompilationEnabled()) {
dataLogF(
"SpeculativeJIT generating Node @%d (bc#%u) at JIT offset 0x%x",
Modified: trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT64.cpp (183071 => 183072)
--- trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT64.cpp 2015-04-21 20:06:17 UTC (rev 183071)
+++ trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT64.cpp 2015-04-21 20:16:18 UTC (rev 183072)
@@ -1921,9 +1921,15 @@
break;
}
- case MovHint:
+ case MovHint: {
+ compileMovHint(m_currentNode);
+ noResult(node);
+ break;
+ }
+
case ZombieHint: {
- DFG_CRASH(m_jit.graph(), node, "Unexpected node");
+ recordSetLocal(m_currentNode->unlinkedLocal(), VirtualRegister(), DataFormatDead);
+ noResult(node);
break;
}
Modified: trunk/Source/_javascript_Core/runtime/Options.h (183071 => 183072)
--- trunk/Source/_javascript_Core/runtime/Options.h 2015-04-21 20:06:17 UTC (rev 183071)
+++ trunk/Source/_javascript_Core/runtime/Options.h 2015-04-21 20:16:18 UTC (rev 183072)
@@ -184,6 +184,7 @@
v(unsigned, frequentCallThreshold, 2, nullptr) \
v(double, minimumCallToKnownRate, 0.51, nullptr) \
v(bool, optimizeNativeCalls, false, nullptr) \
+ v(bool, enableMovHintRemoval, true, nullptr) \
v(bool, enableObjectAllocationSinking, true, nullptr) \
\
v(bool, enableConcurrentJIT, true, "allows the DFG / FTL compilation in threads other than the executing JS thread") \
