Title: [266095] trunk/Source/_javascript_Core
Revision
266095
Author
keith_mil...@apple.com
Date
2020-08-24 18:51:15 -0700 (Mon, 24 Aug 2020)

Log Message

Remove MovHintRemoval phase
https://bugs.webkit.org/show_bug.cgi?id=215785

Reviewed by Saam Barati.

The MovHintRemoval phase doesn't play nicely with our OSR
Availability. Specifically, it needs to do a tricky dance where it
marks all the live ranges of the ZombieHints as not
exitOK. There's also an issue because we treated unused locals as
kill in this block, which is wrong for SSA when a MovHint is
used in another block. Since removing MovHintRemoval isn't a
performance regression, we are removing it rather than fixing bugs
related to it. Relatedly, since the only place we produce
ZombieHints is MovHintRemoval this patch also removes that node
type.

* Sources.txt:
* dfg/DFGAbstractInterpreterInlines.h:
(JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
* dfg/DFGClobberize.h:
(JSC::DFG::clobberize):
* dfg/DFGClobbersExitState.cpp:
(JSC::DFG::clobbersExitState):
* dfg/DFGDoesGC.cpp:
(JSC::DFG::doesGC):
* dfg/DFGFixupPhase.cpp:
(JSC::DFG::FixupPhase::fixupNode):
* dfg/DFGMayExit.cpp:
* dfg/DFGMovHintRemovalPhase.cpp: Removed.
* dfg/DFGMovHintRemovalPhase.h: Removed.
* dfg/DFGNode.h:
(JSC::DFG::Node::containsMovHint):
(JSC::DFG::Node::hasUnlinkedOperand):
* dfg/DFGNodeType.h:
* dfg/DFGOSRAvailabilityAnalysisPhase.cpp:
(JSC::DFG::LocalOSRAvailabilityCalculator::executeNode):
* dfg/DFGPhantomInsertionPhase.cpp:
* dfg/DFGPlan.cpp:
(JSC::DFG::Plan::compileInThreadImpl):
* dfg/DFGPredictionPropagationPhase.cpp:
* dfg/DFGSafeToExecute.h:
(JSC::DFG::safeToExecute):
* dfg/DFGSpeculativeJIT.cpp:
(JSC::DFG::SpeculativeJIT::compileMovHint):
* dfg/DFGSpeculativeJIT32_64.cpp:
(JSC::DFG::SpeculativeJIT::compile):
* dfg/DFGSpeculativeJIT64.cpp:
(JSC::DFG::SpeculativeJIT::compile):
* dfg/DFGVarargsForwardingPhase.cpp:
* ftl/FTLCapabilities.cpp:
(JSC::FTL::canCompile):
* ftl/FTLLowerDFGToB3.cpp:
(JSC::FTL::DFG::LowerDFGToB3::validateAIState):
(JSC::FTL::DFG::LowerDFGToB3::compileNode):
* runtime/OptionsList.h:

Modified Paths

Removed Paths

Diff

Modified: trunk/Source/_javascript_Core/ChangeLog (266094 => 266095)


--- trunk/Source/_javascript_Core/ChangeLog	2020-08-25 00:36:10 UTC (rev 266094)
+++ trunk/Source/_javascript_Core/ChangeLog	2020-08-25 01:51:15 UTC (rev 266095)
@@ -1,3 +1,61 @@
+2020-08-24  Keith Miller  <keith_mil...@apple.com>
+
+        Remove MovHintRemoval phase
+        https://bugs.webkit.org/show_bug.cgi?id=215785
+
+        Reviewed by Saam Barati.
+
+        The MovHintRemoval phase doesn't play nicely with our OSR
+        Availability. Specifically, it needs to do a tricky dance where it
+        marks all the live ranges of the ZombieHints as not
+        exitOK. There's also an issue because we treated unused locals as
+        kill in this block, which is wrong for SSA when a MovHint is
+        used in another block. Since removing MovHintRemoval isn't a
+        performance regression, we are removing it rather than fixing bugs
+        related to it. Relatedly, since the only place we produce
+        ZombieHints is MovHintRemoval this patch also removes that node
+        type.
+
+        * Sources.txt:
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+        * dfg/DFGClobberize.h:
+        (JSC::DFG::clobberize):
+        * dfg/DFGClobbersExitState.cpp:
+        (JSC::DFG::clobbersExitState):
+        * dfg/DFGDoesGC.cpp:
+        (JSC::DFG::doesGC):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        * dfg/DFGMayExit.cpp:
+        * dfg/DFGMovHintRemovalPhase.cpp: Removed.
+        * dfg/DFGMovHintRemovalPhase.h: Removed.
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::containsMovHint):
+        (JSC::DFG::Node::hasUnlinkedOperand):
+        * dfg/DFGNodeType.h:
+        * dfg/DFGOSRAvailabilityAnalysisPhase.cpp:
+        (JSC::DFG::LocalOSRAvailabilityCalculator::executeNode):
+        * dfg/DFGPhantomInsertionPhase.cpp:
+        * dfg/DFGPlan.cpp:
+        (JSC::DFG::Plan::compileInThreadImpl):
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        * dfg/DFGSafeToExecute.h:
+        (JSC::DFG::safeToExecute):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileMovHint):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGVarargsForwardingPhase.cpp:
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        * ftl/FTLLowerDFGToB3.cpp:
+        (JSC::FTL::DFG::LowerDFGToB3::validateAIState):
+        (JSC::FTL::DFG::LowerDFGToB3::compileNode):
+        * runtime/OptionsList.h:
+
 2020-08-24  Devin Rousso  <drou...@apple.com>
 
         Web Inspector: rename `ScriptDebugServer` subclasses/methods

Modified: trunk/Source/_javascript_Core/Sources.txt (266094 => 266095)


--- trunk/Source/_javascript_Core/Sources.txt	2020-08-25 00:36:10 UTC (rev 266094)
+++ trunk/Source/_javascript_Core/Sources.txt	2020-08-25 01:51:15 UTC (rev 266095)
@@ -383,7 +383,6 @@
 dfg/DFGMayExit.cpp
 dfg/DFGMinifiedGraph.cpp
 dfg/DFGMinifiedNode.cpp
-dfg/DFGMovHintRemovalPhase.cpp
 dfg/DFGMultiGetByOffsetData.cpp
 dfg/DFGNode.cpp
 dfg/DFGNodeAbstractValuePair.cpp

Modified: trunk/Source/_javascript_Core/dfg/DFGAbstractInterpreterInlines.h (266094 => 266095)


--- trunk/Source/_javascript_Core/dfg/DFGAbstractInterpreterInlines.h	2020-08-25 00:36:10 UTC (rev 266094)
+++ trunk/Source/_javascript_Core/dfg/DFGAbstractInterpreterInlines.h	2020-08-25 01:51:15 UTC (rev 266095)
@@ -4334,7 +4334,6 @@
     case SuperSamplerEnd:
     case CheckTierUpAndOSREnter:
     case LoopHint:
-    case ZombieHint:
     case ExitOK:
     case FilterCallLinkStatus:
     case FilterGetByStatus:

Modified: trunk/Source/_javascript_Core/dfg/DFGClobberize.h (266094 => 266095)


--- trunk/Source/_javascript_Core/dfg/DFGClobberize.h	2020-08-25 00:36:10 UTC (rev 266094)
+++ trunk/Source/_javascript_Core/dfg/DFGClobberize.h	2020-08-25 01:51:15 UTC (rev 266095)
@@ -474,7 +474,6 @@
         return;
          
     case MovHint:
-    case ZombieHint:
     case ExitOK:
     case Upsilon:
     case Phi:

Modified: trunk/Source/_javascript_Core/dfg/DFGClobbersExitState.cpp (266094 => 266095)


--- trunk/Source/_javascript_Core/dfg/DFGClobbersExitState.cpp	2020-08-25 00:36:10 UTC (rev 266094)
+++ trunk/Source/_javascript_Core/dfg/DFGClobbersExitState.cpp	2020-08-25 01:51:15 UTC (rev 266095)
@@ -41,7 +41,6 @@
     switch (node->op()) {
     case InitializeEntrypointArguments:
     case MovHint:
-    case ZombieHint:
     case PutHint:
     case KillStack:
         return true;

Modified: trunk/Source/_javascript_Core/dfg/DFGDoesGC.cpp (266094 => 266095)


--- trunk/Source/_javascript_Core/dfg/DFGDoesGC.cpp	2020-08-25 00:36:10 UTC (rev 266094)
+++ trunk/Source/_javascript_Core/dfg/DFGDoesGC.cpp	2020-08-25 01:51:15 UTC (rev 266095)
@@ -70,7 +70,6 @@
     case SetLocal:
     case MovHint:
     case InitializeEntrypointArguments:
-    case ZombieHint:
     case ExitOK:
     case Phantom:
     case Upsilon:

Modified: trunk/Source/_javascript_Core/dfg/DFGFixupPhase.cpp (266094 => 266095)


--- trunk/Source/_javascript_Core/dfg/DFGFixupPhase.cpp	2020-08-25 00:36:10 UTC (rev 266094)
+++ trunk/Source/_javascript_Core/dfg/DFGFixupPhase.cpp	2020-08-25 01:51:15 UTC (rev 266095)
@@ -2759,7 +2759,6 @@
         case LoopHint:
         case MovHint:
         case InitializeEntrypointArguments:
-        case ZombieHint:
         case ExitOK:
         case BottomValue:
         case TypeOf:

Modified: trunk/Source/_javascript_Core/dfg/DFGMayExit.cpp (266094 => 266095)


--- trunk/Source/_javascript_Core/dfg/DFGMayExit.cpp	2020-08-25 00:36:10 UTC (rev 266094)
+++ trunk/Source/_javascript_Core/dfg/DFGMayExit.cpp	2020-08-25 01:51:15 UTC (rev 266095)
@@ -65,7 +65,6 @@
     case LoopHint:
     case Phi:
     case Upsilon:
-    case ZombieHint:
     case ExitOK:
     case BottomValue:
     case PutHint:

Deleted: trunk/Source/_javascript_Core/dfg/DFGMovHintRemovalPhase.cpp (266094 => 266095)


--- trunk/Source/_javascript_Core/dfg/DFGMovHintRemovalPhase.cpp	2020-08-25 00:36:10 UTC (rev 266094)
+++ trunk/Source/_javascript_Core/dfg/DFGMovHintRemovalPhase.cpp	2020-08-25 01:51:15 UTC (rev 266095)
@@ -1,145 +0,0 @@
-/*
- * Copyright (C) 2015-2019 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#include "config.h"
-#include "DFGMovHintRemovalPhase.h"
-
-#if ENABLE(DFG_JIT)
-
-#include "DFGEpoch.h"
-#include "DFGForAllKills.h"
-#include "DFGGraph.h"
-#include "DFGMayExit.h"
-#include "DFGPhase.h"
-#include "JSCJSValueInlines.h"
-#include "OperandsInlines.h"
-
-namespace JSC { namespace DFG {
-
-namespace {
-
-namespace DFGMovHintRemovalPhaseInternal {
-static constexpr bool verbose = false;
-}
-
-class MovHintRemovalPhase : public Phase {
-public:
-    MovHintRemovalPhase(Graph& graph)
-        : Phase(graph, "MovHint removal")
-        , m_state(OperandsLike, graph.block(0)->variablesAtHead)
-        , m_changed(false)
-    {
-    }
-    
-    bool run()
-    {
-        if (DFGMovHintRemovalPhaseInternal::verbose) {
-            dataLog("Graph before MovHint removal:\n");
-            m_graph.dump();
-        }
-        
-        for (BasicBlock* block : m_graph.blocksInNaturalOrder())
-            handleBlock(block);
-        
-        return m_changed;
-    }
-
-private:
-    void handleBlock(BasicBlock* block)
-    {
-        if (DFGMovHintRemovalPhaseInternal::verbose)
-            dataLog("Handing block ", pointerDump(block), "\n");
-        
-        // A MovHint is unnecessary if the local dies before it is used. We answer this question by
-        // maintaining the current exit epoch, and associating an epoch with each local. When a
-        // local dies, it gets the current exit epoch. If a MovHint occurs in the same epoch as its
-        // local, then it means there was no exit between the local's death and the MovHint - i.e.
-        // the MovHint is unnecessary.
-        
-        Epoch currentEpoch = Epoch::first();
-        
-        m_state.fill(Epoch());
-        m_graph.forAllLiveInBytecode(
-            block->terminal()->origin.forExit,
-            [&] (Operand reg) {
-                m_state.operand(reg) = currentEpoch;
-            });
-        
-        if (DFGMovHintRemovalPhaseInternal::verbose)
-            dataLog("    Locals at ", block->terminal()->origin.forExit, ": ", m_state, "\n");
-        
-        // Assume that blocks after us exit.
-        currentEpoch.bump();
-        
-        for (unsigned nodeIndex = block->size(); nodeIndex--;) {
-            Node* node = block->at(nodeIndex);
-            
-            if (node->op() == MovHint) {
-                Epoch localEpoch = m_state.operand(node->unlinkedOperand());
-                if (DFGMovHintRemovalPhaseInternal::verbose)
-                    dataLog("    At ", node, " (", node->unlinkedOperand(), "): current = ", currentEpoch, ", local = ", localEpoch, "\n");
-                if (!localEpoch || localEpoch == currentEpoch) {
-                    node->setOpAndDefaultFlags(ZombieHint);
-                    node->child1() = Edge();
-                    m_changed = true;
-                }
-                m_state.operand(node->unlinkedOperand()) = Epoch();
-            }
-            
-            if (mayExit(m_graph, node) != DoesNotExit)
-                currentEpoch.bump();
-            
-            if (nodeIndex) {
-                forAllKilledOperands(
-                    m_graph, block->at(nodeIndex - 1), node,
-                    [&] (Operand operand) {
-                        // This function is a bit sloppy - it might claim to kill a local even if
-                        // it's still live after. We need to protect against that.
-                        if (!!m_state.operand(operand))
-                            return;
-                        
-                        if (DFGMovHintRemovalPhaseInternal::verbose)
-                            dataLog("    Killed operand at ", node, ": ", operand, "\n");
-                        m_state.operand(operand) = currentEpoch;
-                    });
-            }
-        }
-    }
-    
-    Operands<Epoch> m_state;
-    bool m_changed;
-};
-
-} // anonymous namespace
-    
-bool performMovHintRemoval(Graph& graph)
-{
-    return runPhase<MovHintRemovalPhase>(graph);
-}
-
-} } // namespace JSC::DFG
-
-#endif // ENABLE(DFG_JIT)
-

Deleted: trunk/Source/_javascript_Core/dfg/DFGMovHintRemovalPhase.h (266094 => 266095)


--- trunk/Source/_javascript_Core/dfg/DFGMovHintRemovalPhase.h	2020-08-25 00:36:10 UTC (rev 266094)
+++ trunk/Source/_javascript_Core/dfg/DFGMovHintRemovalPhase.h	2020-08-25 01:51:15 UTC (rev 266095)
@@ -1,41 +0,0 @@
-/*
- * Copyright (C) 2015 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#pragma once
-
-#if ENABLE(DFG_JIT)
-
-namespace JSC { namespace DFG {
-
-class Graph;
-
-// Cleans up unnecessary MovHints. A MovHint is necessary if the variable dies before there is an
-// exit.
-
-bool performMovHintRemoval(Graph&);
-
-} } // namespace JSC::DFG
-
-#endif // ENABLE(DFG_JIT)

Modified: trunk/Source/_javascript_Core/dfg/DFGNode.h (266094 => 266095)


--- trunk/Source/_javascript_Core/dfg/DFGNode.h	2020-08-25 00:36:10 UTC (rev 266094)
+++ trunk/Source/_javascript_Core/dfg/DFGNode.h	2020-08-25 01:51:15 UTC (rev 266095)
@@ -978,7 +978,6 @@
     {
         switch (op()) {
         case MovHint:
-        case ZombieHint:
             return true;
         default:
             return false;
@@ -1021,7 +1020,6 @@
         switch (op()) {
         case ExtractOSREntryLocal:
         case MovHint:
-        case ZombieHint:
         case KillStack:
             return true;
         default:

Modified: trunk/Source/_javascript_Core/dfg/DFGNodeType.h (266094 => 266095)


--- trunk/Source/_javascript_Core/dfg/DFGNodeType.h	2020-08-25 00:36:10 UTC (rev 266094)
+++ trunk/Source/_javascript_Core/dfg/DFGNodeType.h	2020-08-25 01:51:15 UTC (rev 266095)
@@ -80,7 +80,6 @@
     macro(GetStack, NodeResultJS) \
     \
     macro(MovHint, NodeMustGenerate) \
-    macro(ZombieHint, NodeMustGenerate) \
     macro(ExitOK, NodeMustGenerate) /* Indicates that exit state is intact and it is safe to exit back to the beginning of the exit origin. */ \
     macro(Phantom, NodeMustGenerate) \
     macro(Check, NodeMustGenerate) /* Used if we want just a type check but not liveness. Non-checking uses will be removed. */\

Modified: trunk/Source/_javascript_Core/dfg/DFGOSRAvailabilityAnalysisPhase.cpp (266094 => 266095)


--- trunk/Source/_javascript_Core/dfg/DFGOSRAvailabilityAnalysisPhase.cpp	2020-08-25 00:36:10 UTC (rev 266094)
+++ trunk/Source/_javascript_Core/dfg/DFGOSRAvailabilityAnalysisPhase.cpp	2020-08-25 01:51:15 UTC (rev 266095)
@@ -267,11 +267,6 @@
         break;
     }
 
-    case ZombieHint: {
-        m_availability.m_locals.operand(node->unlinkedOperand()).setNodeUnavailable();
-        break;
-    }
-
     case InitializeEntrypointArguments: {
         unsigned entrypointIndex = node->entrypointIndex();
         const Vector<FlushFormat>& argumentFormats = m_graph.m_argumentFormats[entrypointIndex];

Modified: trunk/Source/_javascript_Core/dfg/DFGPhantomInsertionPhase.cpp (266094 => 266095)


--- trunk/Source/_javascript_Core/dfg/DFGPhantomInsertionPhase.cpp	2020-08-25 00:36:10 UTC (rev 266094)
+++ trunk/Source/_javascript_Core/dfg/DFGPhantomInsertionPhase.cpp	2020-08-25 01:51:15 UTC (rev 266095)
@@ -105,10 +105,6 @@
                 m_values.operand(node->unlinkedOperand()) = node->child1().node();
                 break;
                 
-            case ZombieHint:
-                m_values.operand(node->unlinkedOperand()) = nullptr;
-                break;
-
             case GetLocal:
             case SetArgumentDefinitely:
             case SetArgumentMaybe:

Modified: trunk/Source/_javascript_Core/dfg/DFGPlan.cpp (266094 => 266095)


--- trunk/Source/_javascript_Core/dfg/DFGPlan.cpp	2020-08-25 00:36:10 UTC (rev 266094)
+++ trunk/Source/_javascript_Core/dfg/DFGPlan.cpp	2020-08-25 01:51:15 UTC (rev 266095)
@@ -51,7 +51,6 @@
 #include "DFGLiveCatchVariablePreservationPhase.h"
 #include "DFGLivenessAnalysisPhase.h"
 #include "DFGLoopPreHeaderCreationPhase.h"
-#include "DFGMovHintRemovalPhase.h"
 #include "DFGOSRAvailabilityAnalysisPhase.h"
 #include "DFGOSREntrypointCreationPhase.h"
 #include "DFGObjectAllocationSinkingPhase.h"
@@ -478,8 +477,6 @@
         RUN_PHASE(performCFA);
         RUN_PHASE(performGlobalStoreBarrierInsertion);
         RUN_PHASE(performStoreBarrierClustering);
-        if (Options::useMovHintRemoval())
-            RUN_PHASE(performMovHintRemoval);
         RUN_PHASE(performCleanUp);
         RUN_PHASE(performDCE); // We rely on this to kill dead code that won't be recognized as dead by B3.
         RUN_PHASE(performStackLayout);

Modified: trunk/Source/_javascript_Core/dfg/DFGPredictionPropagationPhase.cpp (266094 => 266095)


--- trunk/Source/_javascript_Core/dfg/DFGPredictionPropagationPhase.cpp	2020-08-25 00:36:10 UTC (rev 266094)
+++ trunk/Source/_javascript_Core/dfg/DFGPredictionPropagationPhase.cpp	2020-08-25 01:51:15 UTC (rev 266095)
@@ -1430,7 +1430,6 @@
         case NotifyWrite:
         case ConstantStoragePointer:
         case MovHint:
-        case ZombieHint:
         case ExitOK:
         case VarargsLength:
         case LoadVarargs:

Modified: trunk/Source/_javascript_Core/dfg/DFGSafeToExecute.h (266094 => 266095)


--- trunk/Source/_javascript_Core/dfg/DFGSafeToExecute.h	2020-08-25 00:36:10 UTC (rev 266094)
+++ trunk/Source/_javascript_Core/dfg/DFGSafeToExecute.h	2020-08-25 01:51:15 UTC (rev 266095)
@@ -501,7 +501,6 @@
     case PutStack:
     case KillStack:
     case MovHint:
-    case ZombieHint:
     case Upsilon:
     case Phi:
     case Flush:

Modified: trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT.cpp (266094 => 266095)


--- trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT.cpp	2020-08-25 00:36:10 UTC (rev 266094)
+++ trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT.cpp	2020-08-25 01:51:15 UTC (rev 266095)
@@ -1901,7 +1901,7 @@
 
 void SpeculativeJIT::compileMovHint(Node* node)
 {
-    ASSERT(node->containsMovHint() && node->op() != ZombieHint);
+    ASSERT(node->containsMovHint());
     
     Node* child = node->child1().node();
     noticeOSRBirth(child);

Modified: trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT32_64.cpp (266094 => 266095)


--- trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT32_64.cpp	2020-08-25 00:36:10 UTC (rev 266094)
+++ trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT32_64.cpp	2020-08-25 01:51:15 UTC (rev 266095)
@@ -1923,12 +1923,6 @@
         noResult(node);
         break;
     }
-        
-    case ZombieHint: {
-        recordSetLocal(m_currentNode->unlinkedOperand(), VirtualRegister(), DataFormatDead);
-        noResult(node);
-        break;
-    }
 
     case ExitOK: {
         noResult(node);

Modified: trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT64.cpp (266094 => 266095)


--- trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT64.cpp	2020-08-25 00:36:10 UTC (rev 266094)
+++ trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT64.cpp	2020-08-25 01:51:15 UTC (rev 266095)
@@ -2241,12 +2241,6 @@
         break;
     }
         
-    case ZombieHint: {
-        recordSetLocal(m_currentNode->unlinkedOperand(), VirtualRegister(), DataFormatDead);
-        noResult(node);
-        break;
-    }
-        
     case ExitOK: {
         noResult(node);
         break;

Modified: trunk/Source/_javascript_Core/dfg/DFGVarargsForwardingPhase.cpp (266094 => 266095)


--- trunk/Source/_javascript_Core/dfg/DFGVarargsForwardingPhase.cpp	2020-08-25 00:36:10 UTC (rev 266094)
+++ trunk/Source/_javascript_Core/dfg/DFGVarargsForwardingPhase.cpp	2020-08-25 01:51:15 UTC (rev 266095)
@@ -264,7 +264,6 @@
             // what gets read on OSR exit.
             switch (node->op()) {
             case MovHint:
-            case ZombieHint:
             case KillStack:
                 if (argumentsInvolveStackSlot(candidate, node->unlinkedOperand())) {
                     if (verbose)

Modified: trunk/Source/_javascript_Core/ftl/FTLCapabilities.cpp (266094 => 266095)


--- trunk/Source/_javascript_Core/ftl/FTLCapabilities.cpp	2020-08-25 00:36:10 UTC (rev 266094)
+++ trunk/Source/_javascript_Core/ftl/FTLCapabilities.cpp	2020-08-25 01:51:15 UTC (rev 266095)
@@ -51,7 +51,6 @@
     case KillStack:
     case GetStack:
     case MovHint:
-    case ZombieHint:
     case ExitOK:
     case Phantom:
     case Flush:

Modified: trunk/Source/_javascript_Core/ftl/FTLLowerDFGToB3.cpp (266094 => 266095)


--- trunk/Source/_javascript_Core/ftl/FTLLowerDFGToB3.cpp	2020-08-25 00:36:10 UTC (rev 266094)
+++ trunk/Source/_javascript_Core/ftl/FTLLowerDFGToB3.cpp	2020-08-25 01:51:15 UTC (rev 266095)
@@ -564,7 +564,6 @@
 
         switch (node->op()) {
         case MovHint:
-        case ZombieHint:
         case JSConstant:
         case LazyJSConstant:
         case DoubleConstant:
@@ -1631,7 +1630,6 @@
 
         case PhantomLocal:
         case MovHint:
-        case ZombieHint:
         case ExitOK:
         case PhantomNewObject:
         case PhantomNewFunction:

Modified: trunk/Source/_javascript_Core/runtime/OptionsList.h (266094 => 266095)


--- trunk/Source/_javascript_Core/runtime/OptionsList.h	2020-08-25 00:36:10 UTC (rev 266094)
+++ trunk/Source/_javascript_Core/runtime/OptionsList.h	2020-08-25 01:51:15 UTC (rev 266095)
@@ -240,7 +240,6 @@
     v(Unsigned, frequentCallThreshold, 2, Normal, nullptr) \
     v(Double, minimumCallToKnownRate, 0.51, Normal, nullptr) \
     v(Bool, createPreHeaders, true, Normal, nullptr) \
-    v(Bool, useMovHintRemoval, true, Normal, nullptr) \
     v(Bool, usePutStackSinking, true, Normal, nullptr) \
     v(Bool, useObjectAllocationSinking, true, Normal, nullptr) \
     v(Bool, useValueRepElimination, true, Normal, nullptr) \
_______________________________________________
webkit-changes mailing list
webkit-changes@lists.webkit.org
https://lists.webkit.org/mailman/listinfo/webkit-changes

Reply via email to