Diff
Modified: trunk/Source/_javascript_Core/ChangeLog (118467 => 118468)
--- trunk/Source/_javascript_Core/ChangeLog 2012-05-25 03:27:04 UTC (rev 118467)
+++ trunk/Source/_javascript_Core/ChangeLog 2012-05-25 03:29:18 UTC (rev 118468)
@@ -1,3 +1,35 @@
+2012-05-24 Filip Pizlo <[email protected]>
+
+ new test fast/js/dfg-arguments-mixed-alias.html fails on JSVALUE32_64
+ https://bugs.webkit.org/show_bug.cgi?id=87378
+
+ Reviewed by Gavin Barraclough.
+
+ - Captured variable tracking forgot did not consistently handle arguments, leading to OSR
+ badness.
+
+ - Nodes capable of exiting were tracked in a non-monotonic way, leading to compiler errors.
+
+ * dfg/DFGByteCodeParser.cpp:
+ (JSC::DFG::ByteCodeParser::InlineStackEntry::InlineStackEntry):
+ * dfg/DFGCSEPhase.cpp:
+ (JSC::DFG::CSEPhase::CSEPhase):
+ (CSEPhase):
+ (JSC::DFG::performCSE):
+ * dfg/DFGCSEPhase.h:
+ (DFG):
+ * dfg/DFGCommon.h:
+ * dfg/DFGDriver.cpp:
+ (JSC::DFG::compile):
+ * dfg/DFGGraph.cpp:
+ (JSC::DFG::Graph::resetExitStates):
+ (DFG):
+ * dfg/DFGGraph.h:
+ (Graph):
+ * dfg/DFGPhase.h:
+ (DFG):
+ (JSC::DFG::runPhase):
+
2012-05-24 Geoffrey Garen <[email protected]>
Made WeakSet per-block instead of per-heap
Modified: trunk/Source/_javascript_Core/dfg/DFGByteCodeParser.cpp (118467 => 118468)
--- trunk/Source/_javascript_Core/dfg/DFGByteCodeParser.cpp 2012-05-25 03:27:04 UTC (rev 118467)
+++ trunk/Source/_javascript_Core/dfg/DFGByteCodeParser.cpp 2012-05-25 03:29:18 UTC (rev 118468)
@@ -2836,6 +2836,10 @@
inlineCallFrame.capturedVars.set(i);
}
+ if (codeBlock->usesArguments() || codeBlock->needsActivation()) {
+ for (int i = argumentCountIncludingThis; i--;)
+ inlineCallFrame.capturedVars.set(argumentToOperand(i) + inlineCallFrame.stackOffset);
+ }
for (int i = codeBlock->m_numCapturedVars; i--;)
inlineCallFrame.capturedVars.set(i + inlineCallFrame.stackOffset);
Modified: trunk/Source/_javascript_Core/dfg/DFGCSEPhase.cpp (118467 => 118468)
--- trunk/Source/_javascript_Core/dfg/DFGCSEPhase.cpp 2012-05-25 03:27:04 UTC (rev 118467)
+++ trunk/Source/_javascript_Core/dfg/DFGCSEPhase.cpp 2012-05-25 03:29:18 UTC (rev 118468)
@@ -35,8 +35,9 @@
class CSEPhase : public Phase {
public:
- CSEPhase(Graph& graph)
+ CSEPhase(Graph& graph, OptimizationFixpointState fixpointState)
: Phase(graph, "common subexpression elimination")
+ , m_fixpointState(fixpointState)
{
// Replacements are used to implement local common subexpression elimination.
m_replacements.resize(m_graph.size());
@@ -750,11 +751,12 @@
unsigned m_indexInBlock;
Vector<NodeIndex, 16> m_replacements;
FixedArray<unsigned, LastNodeType> m_lastSeen;
+ OptimizationFixpointState m_fixpointState;
};
-bool performCSE(Graph& graph)
+bool performCSE(Graph& graph, OptimizationFixpointState fixpointState)
{
- return runPhase<CSEPhase>(graph);
+ return runPhase<CSEPhase>(graph, fixpointState);
}
} } // namespace JSC::DFG
Modified: trunk/Source/_javascript_Core/dfg/DFGCSEPhase.h (118467 => 118468)
--- trunk/Source/_javascript_Core/dfg/DFGCSEPhase.h 2012-05-25 03:27:04 UTC (rev 118467)
+++ trunk/Source/_javascript_Core/dfg/DFGCSEPhase.h 2012-05-25 03:29:18 UTC (rev 118468)
@@ -30,6 +30,8 @@
#if ENABLE(DFG_JIT)
+#include "DFGCommon.h"
+
namespace JSC { namespace DFG {
class Graph;
@@ -39,7 +41,7 @@
// a wide range of subexpression similarities. It's known to produce big wins
// on a few benchmarks, and is relatively cheap to run.
-bool performCSE(Graph&);
+bool performCSE(Graph&, OptimizationFixpointState);
} } // namespace JSC::DFG
Modified: trunk/Source/_javascript_Core/dfg/DFGCommon.h (118467 => 118468)
--- trunk/Source/_javascript_Core/dfg/DFGCommon.h 2012-05-25 03:27:04 UTC (rev 118467)
+++ trunk/Source/_javascript_Core/dfg/DFGCommon.h 2012-05-25 03:29:18 UTC (rev 118468)
@@ -130,6 +130,8 @@
enum NoResultTag { NoResult };
+enum OptimizationFixpointState { FixpointConverged, FixpointNotConverged };
+
} } // namespace JSC::DFG
#endif // ENABLE(DFG_JIT)
Modified: trunk/Source/_javascript_Core/dfg/DFGDriver.cpp (118467 => 118468)
--- trunk/Source/_javascript_Core/dfg/DFGDriver.cpp 2012-05-25 03:27:04 UTC (rev 118467)
+++ trunk/Source/_javascript_Core/dfg/DFGDriver.cpp 2012-05-25 03:29:18 UTC (rev 118468)
@@ -82,10 +82,12 @@
changed |= performConstantFolding(dfg);
changed |= performArgumentsSimplification(dfg);
changed |= performCFGSimplification(dfg);
- performCSE(dfg);
if (!changed)
break;
+ performCSE(dfg, FixpointNotConverged);
+ dfg.resetExitStates();
}
+ performCSE(dfg, FixpointConverged);
#if DFG_ENABLE(DEBUG_VERBOSE)
dataLog("DFG optimization fixpoint converged in %u iterations.\n", cnt);
#endif
Modified: trunk/Source/_javascript_Core/dfg/DFGGraph.cpp (118467 => 118468)
--- trunk/Source/_javascript_Core/dfg/DFGGraph.cpp 2012-05-25 03:27:04 UTC (rev 118467)
+++ trunk/Source/_javascript_Core/dfg/DFGGraph.cpp 2012-05-25 03:29:18 UTC (rev 118468)
@@ -491,6 +491,12 @@
determineReachability();
}
+void Graph::resetExitStates()
+{
+ for (unsigned i = size(); i--;)
+ at(i).setCanExit(true);
+}
+
} } // namespace JSC::DFG
#endif
Modified: trunk/Source/_javascript_Core/dfg/DFGGraph.h (118467 => 118468)
--- trunk/Source/_javascript_Core/dfg/DFGGraph.h 2012-05-25 03:27:04 UTC (rev 118467)
+++ trunk/Source/_javascript_Core/dfg/DFGGraph.h 2012-05-25 03:29:18 UTC (rev 118468)
@@ -461,6 +461,8 @@
void determineReachability();
void resetReachability();
+ void resetExitStates();
+
unsigned numChildren(Node& node)
{
if (node.flags() & NodeHasVarArgs)
Modified: trunk/Source/_javascript_Core/dfg/DFGPhase.h (118467 => 118468)
--- trunk/Source/_javascript_Core/dfg/DFGPhase.h 2012-05-25 03:27:04 UTC (rev 118467)
+++ trunk/Source/_javascript_Core/dfg/DFGPhase.h 2012-05-25 03:29:18 UTC (rev 118468)
@@ -79,6 +79,13 @@
return phase.run();
}
+template<typename PhaseType, typename ArgumentType1>
+bool runPhase(Graph& graph, ArgumentType1 arg1)
+{
+ PhaseType phase(graph, arg1);
+ return phase.run();
+}
+
} } // namespace JSC::DFG
#endif // ENABLE(DFG_JIT)
