Title: [181550] releases/WebKitGTK/webkit-2.8/Source/_javascript_Core
- Revision
- 181550
- Author
- carlo...@webkit.org
- Date
- 2015-03-16 05:24:46 -0700 (Mon, 16 Mar 2015)
Log Message
Merge r181495 - Object allocation sinking phase shouldn't re-decorate previously sunken allocations on each fixpoint operation
https://bugs.webkit.org/show_bug.cgi?id=142686
Reviewed by Oliver Hunt.
Just because promoteHeapAccess() notifies us of an effect to a heap location in a node doesn't
mean that we should handle it as if it was for one of our sinking candidates. Instead we should
prune based on m_sinkCandidates.
This fixes a benign bug where we would generate a lot of repeated IR for some pathological
tests.
* dfg/DFGObjectAllocationSinkingPhase.cpp:
(JSC::DFG::ObjectAllocationSinkingPhase::promoteSunkenFields):
Modified Paths
Diff
Modified: releases/WebKitGTK/webkit-2.8/Source/_javascript_Core/ChangeLog (181549 => 181550)
--- releases/WebKitGTK/webkit-2.8/Source/_javascript_Core/ChangeLog 2015-03-16 12:20:59 UTC (rev 181549)
+++ releases/WebKitGTK/webkit-2.8/Source/_javascript_Core/ChangeLog 2015-03-16 12:24:46 UTC (rev 181550)
@@ -1,3 +1,20 @@
+2015-03-13 Filip Pizlo <fpi...@apple.com>
+
+ Object allocation sinking phase shouldn't re-decorate previously sunken allocations on each fixpoint operation
+ https://bugs.webkit.org/show_bug.cgi?id=142686
+
+ Reviewed by Oliver Hunt.
+
+ Just because promoteHeapAccess() notifies us of an effect to a heap location in a node doesn't
+ mean that we should handle it as if it was for one of our sinking candidates. Instead we should
+ prune based on m_sinkCandidates.
+
+ This fixes a benign bug where we would generate a lot of repeated IR for some pathological
+ tests.
+
+ * dfg/DFGObjectAllocationSinkingPhase.cpp:
+ (JSC::DFG::ObjectAllocationSinkingPhase::promoteSunkenFields):
+
2015-03-12 Geoffrey Garen <gga...@apple.com>
Prohibit GC while sweeping
Modified: releases/WebKitGTK/webkit-2.8/Source/_javascript_Core/dfg/DFGObjectAllocationSinkingPhase.cpp (181549 => 181550)
--- releases/WebKitGTK/webkit-2.8/Source/_javascript_Core/dfg/DFGObjectAllocationSinkingPhase.cpp 2015-03-16 12:20:59 UTC (rev 181549)
+++ releases/WebKitGTK/webkit-2.8/Source/_javascript_Core/dfg/DFGObjectAllocationSinkingPhase.cpp 2015-03-16 12:24:46 UTC (rev 181550)
@@ -581,10 +581,12 @@
promoteHeapAccess(
node,
[&] (PromotedHeapLocation location, Edge) {
- locations.add(location);
+ if (m_sinkCandidates.contains(location.base()))
+ locations.add(location);
},
[&] (PromotedHeapLocation location) {
- locations.add(location);
+ if (m_sinkCandidates.contains(location.base()))
+ locations.add(location);
});
}
}
@@ -636,6 +638,8 @@
promoteHeapAccess(
node,
[&] (PromotedHeapLocation location, Edge value) {
+ if (!m_sinkCandidates.contains(location.base()))
+ return;
SSACalculator::Variable* variable = m_locationToVariable.get(location);
m_ssaCalculator.newDef(variable, block, value.node());
},
@@ -687,10 +691,12 @@
promoteHeapAccess(
node,
[&] (PromotedHeapLocation location, Edge value) {
- m_localMapping.set(location, value.node());
+ if (m_sinkCandidates.contains(location.base()))
+ m_localMapping.set(location, value.node());
},
[&] (PromotedHeapLocation location) {
- node->replaceWith(resolve(block, location));
+ if (m_sinkCandidates.contains(location.base()))
+ node->replaceWith(resolve(block, location));
});
}
_______________________________________________
webkit-changes mailing list
webkit-changes@lists.webkit.org
https://lists.webkit.org/mailman/listinfo/webkit-changes
