Title: [183492] trunk/Source/_javascript_Core
- Revision
- 183492
- Author
- fpi...@apple.com
- Date
- 2015-04-28 11:04:10 -0700 (Tue, 28 Apr 2015)
Log Message
VarargsForwardingPhase should only consider MovHints that have the candidate as a child
https://bugs.webkit.org/show_bug.cgi?id=144340
Reviewed by Michael Saboff and Mark Lam.
Since we were considering all MovHints, we'd assume that the CreateDirectArguments or
CreateClosedArguments node was live so long as any MovHinted bytecode variable was alive.
Basically, we'd keep it alive until the end of the block. This maximized the chances of
there being an interfering operation, which would prevent elimination.
The fix is to only consider MovHints that have the arguments candidate as a child. We only
care to track the liveness of those bytecode locals that would need an arguments object
recovery on OSR exit.
This is a speed-up on V8Spider/raytrace and Octane/raytrace because it undoes the regression
introduced in http://trac.webkit.org/changeset/183406.
* dfg/DFGVarargsForwardingPhase.cpp:
Modified Paths
Diff
Modified: trunk/Source/_javascript_Core/ChangeLog (183491 => 183492)
--- trunk/Source/_javascript_Core/ChangeLog 2015-04-28 18:01:57 UTC (rev 183491)
+++ trunk/Source/_javascript_Core/ChangeLog 2015-04-28 18:04:10 UTC (rev 183492)
@@ -1,3 +1,24 @@
+2015-04-28 Filip Pizlo <fpi...@apple.com>
+
+ VarargsForwardingPhase should only consider MovHints that have the candidate as a child
+ https://bugs.webkit.org/show_bug.cgi?id=144340
+
+ Reviewed by Michael Saboff and Mark Lam.
+
+ Since we were considering all MovHints, we'd assume that the CreateDirectArguments or
+ CreateClosedArguments node was live so long as any MovHinted bytecode variable was alive.
+ Basically, we'd keep it alive until the end of the block. This maximized the chances of
+ there being an interfering operation, which would prevent elimination.
+
+ The fix is to only consider MovHints that have the arguments candidate as a child. We only
+ care to track the liveness of those bytecode locals that would need an arguments object
+ recovery on OSR exit.
+
+ This is a speed-up on V8Spider/raytrace and Octane/raytrace because it undoes the regression
+ introduced in http://trac.webkit.org/changeset/183406.
+
+ * dfg/DFGVarargsForwardingPhase.cpp:
+
2015-04-28 Csaba Osztrogonác <o...@webkit.org>
Remove WinCE cruft from cmake build system
Modified: trunk/Source/_javascript_Core/dfg/DFGVarargsForwardingPhase.cpp (183491 => 183492)
--- trunk/Source/_javascript_Core/dfg/DFGVarargsForwardingPhase.cpp 2015-04-28 18:01:57 UTC (rev 183491)
+++ trunk/Source/_javascript_Core/dfg/DFGVarargsForwardingPhase.cpp 2015-04-28 18:04:10 UTC (rev 183492)
@@ -34,6 +34,7 @@
#include "DFGGraph.h"
#include "DFGPhase.h"
#include "JSCInlines.h"
+#include <wtf/ListDump.h>
namespace JSC { namespace DFG {
@@ -96,6 +97,8 @@
switch (node->op()) {
case MovHint:
+ if (node->child1() != candidate)
+ break;
lastUserIndex = nodeIndex;
if (!relevantLocals.contains(node->unlinkedLocal()))
relevantLocals.append(node->unlinkedLocal());
@@ -138,6 +141,8 @@
forAllKilledOperands(
m_graph, node, block->tryAt(nodeIndex + 1),
[&] (VirtualRegister reg) {
+ if (verbose)
+ dataLog(" Killing ", reg, " while we are interested in ", listDump(relevantLocals), "\n");
for (unsigned i = 0; i < relevantLocals.size(); ++i) {
if (relevantLocals[i] == reg) {
relevantLocals[i--] = relevantLocals.last();
_______________________________________________
webkit-changes mailing list
webkit-changes@lists.webkit.org
https://lists.webkit.org/mailman/listinfo/webkit-changes
