Diff
Modified: branches/safari-601.1.46-branch/Source/_javascript_Core/ChangeLog (191462 => 191463)
--- branches/safari-601.1.46-branch/Source/_javascript_Core/ChangeLog 2015-10-22 18:36:16 UTC (rev 191462)
+++ branches/safari-601.1.46-branch/Source/_javascript_Core/ChangeLog 2015-10-22 18:36:28 UTC (rev 191463)
@@ -1,3 +1,22 @@
+2015-10-21 Matthew Hanson <matthew_han...@apple.com>
+
+ Merge r191395. rdar://problem/22846455
+
+ 2015-10-21 Filip Pizlo <fpi...@apple.com>
+
+ Failures in PutStackSinkingPhase should be less severe
+ https://bugs.webkit.org/show_bug.cgi?id=150400
+
+ Reviewed by Geoffrey Garen.
+
+ Make the PutStackSinkingPhase abort instead of asserting. To test that it's OK to not have
+ PutStackSinkingPhase run, this adds a test mode where we run without PutStackSinkingPhase.
+
+ * dfg/DFGPlan.cpp: Make it possible to not run PutStackSinkingPhase for tests.
+ (JSC::DFG::Plan::compileInThreadImpl):
+ * dfg/DFGPutStackSinkingPhase.cpp: PutStackSinkingPhase should abort instead of asserting, except when validation is enabled.
+ * runtime/Options.h: Add an option for disabling PutStackSinkingPhase.
+
2015-10-20 Matthew Hanson <matthew_han...@apple.com>
Merge r191364. rdar://problem/22864960
Modified: branches/safari-601.1.46-branch/Source/_javascript_Core/dfg/DFGPlan.cpp (191462 => 191463)
--- branches/safari-601.1.46-branch/Source/_javascript_Core/dfg/DFGPlan.cpp 2015-10-22 18:36:16 UTC (rev 191462)
+++ branches/safari-601.1.46-branch/Source/_javascript_Core/dfg/DFGPlan.cpp 2015-10-22 18:36:28 UTC (rev 191463)
@@ -354,7 +354,8 @@
// Ideally, these would be run to fixpoint with the object allocation sinking phase.
performArgumentsElimination(dfg);
- performPutStackSinking(dfg);
+ if (Options::usePutStackSinking())
+ performPutStackSinking(dfg);
performConstantHoisting(dfg);
performGlobalCSE(dfg);
Modified: branches/safari-601.1.46-branch/Source/_javascript_Core/dfg/DFGPutStackSinkingPhase.cpp (191462 => 191463)
--- branches/safari-601.1.46-branch/Source/_javascript_Core/dfg/DFGPutStackSinkingPhase.cpp 2015-10-22 18:36:16 UTC (rev 191462)
+++ branches/safari-601.1.46-branch/Source/_javascript_Core/dfg/DFGPutStackSinkingPhase.cpp 2015-10-22 18:36:28 UTC (rev 191463)
@@ -230,6 +230,39 @@
dataLog("Deferred at ", node, ":", deferred, "\n");
if (node->op() == GetStack) {
+ // Handle the case that the input doesn't match our requirements. This is
+ // really a bug, but it's a benign one if we simply don't run this phase.
+ // It usually arises because of patterns like:
+ //
+ // if (thing)
+ // PutStack()
+ // ...
+ // if (thing)
+ // GetStack()
+ //
+ // Or:
+ //
+ // if (never happens)
+ // GetStack()
+ //
+ // Because this phase runs early in SSA, it should be sensible to enforce
+ // that no such code pattern has arisen yet. So, when validation is
+ // enabled, we assert that we aren't seeing this. But with validation
+ // disabled we silently let this fly and we just abort this phase.
+ // FIXME: Get rid of all remaining cases of conflicting GetStacks.
+ // https://bugs.webkit.org/show_bug.cgi?id=150398
+
+ bool isConflicting =
+ deferred.operand(node->stackAccessData()->local) == ConflictingFlush;
+
+ if (validationEnabled())
+ DFG_ASSERT(m_graph, node, !isConflicting);
+
+ if (isConflicting) {
+ // Oh noes! Abort!!
+ return false;
+ }
+
// A GetStack doesn't affect anything, since we know which local we are reading
// from.
continue;
Modified: branches/safari-601.1.46-branch/Source/_javascript_Core/runtime/Options.h (191462 => 191463)
--- branches/safari-601.1.46-branch/Source/_javascript_Core/runtime/Options.h 2015-10-22 18:36:16 UTC (rev 191462)
+++ branches/safari-601.1.46-branch/Source/_javascript_Core/runtime/Options.h 2015-10-22 18:36:28 UTC (rev 191463)
@@ -190,6 +190,7 @@
v(bool, optimizeNativeCalls, false, nullptr) \
v(bool, enableMovHintRemoval, true, nullptr) \
v(bool, enableObjectAllocationSinking, true, nullptr) \
+ v(bool, usePutStackSinking, true, nullptr) \
\
v(bool, enableConcurrentJIT, true, "allows the DFG / FTL compilation in threads other than the executing JS thread") \
v(unsigned, numberOfDFGCompilerThreads, computeNumberOfWorkerThreads(2, 2) - 1, nullptr) \
Modified: branches/safari-601.1.46-branch/Tools/ChangeLog (191462 => 191463)
--- branches/safari-601.1.46-branch/Tools/ChangeLog 2015-10-22 18:36:16 UTC (rev 191462)
+++ branches/safari-601.1.46-branch/Tools/ChangeLog 2015-10-22 18:36:28 UTC (rev 191463)
@@ -1,3 +1,18 @@
+2015-10-21 Matthew Hanson <matthew_han...@apple.com>
+
+ Merge r191395. rdar://problem/22846455
+
+ 2015-10-21 Filip Pizlo <fpi...@apple.com>
+
+ Failures in PutStackSinkingPhase should be less severe
+ https://bugs.webkit.org/show_bug.cgi?id=150400
+
+ Reviewed by Geoffrey Garen.
+
+ Add a test mode for no PutStackSinkingPhase.
+
+ * Scripts/run-jsc-stress-tests:
+
2015-10-20 Matthew Hanson <matthew_han...@apple.com>
Merge r191063. rdar://problem/22900764
Modified: branches/safari-601.1.46-branch/Tools/Scripts/run-jsc-stress-tests (191462 => 191463)
--- branches/safari-601.1.46-branch/Tools/Scripts/run-jsc-stress-tests 2015-10-22 18:36:16 UTC (rev 191462)
+++ branches/safari-601.1.46-branch/Tools/Scripts/run-jsc-stress-tests 2015-10-22 18:36:28 UTC (rev 191463)
@@ -710,6 +710,10 @@
run("ftl-no-cjit-validate", "--validateGraph=true", *(FTL_OPTIONS + NO_CJIT_OPTIONS)) if $enableFTL
end
+def runFTLNoCJITNoPutStackValidate
+ run("ftl-no-cjit-no-put-stack-validate", "--validateGraph=true", "--usePutStackSinking=false", *(FTL_OPTIONS + NO_CJIT_OPTIONS)) if $enableFTL
+end
+
def runFTLNoCJITNoInlineValidate
run("ftl-no-cjit-no-inline-validate", "--validateGraph=true", "--maximumInliningDepth=1", *(FTL_OPTIONS + NO_CJIT_OPTIONS)) if $enableFTL
end
@@ -773,6 +777,7 @@
runDefaultFTL
runFTLNoCJITValidate
runFTLNoCJITNoInlineValidate
+ runFTLNoCJITNoPutStackValidate
runFTLEager
runFTLEagerNoCJITValidate
runFTLNoCJITSmallPool
