Title: [181495] trunk/Source/_javascript_Core
- Revision
- 181495
- Author
- [email protected]
- Date
- 2015-03-13 19:50:36 -0700 (Fri, 13 Mar 2015)
Log Message
Object allocation sinking phase shouldn't re-decorate previously sunken allocations on each fixpoint operation
https://bugs.webkit.org/show_bug.cgi?id=142686
Reviewed by Oliver Hunt.
Just because promoteHeapAccess() notifies us of an effect to a heap location in a node doesn't
mean that we should handle it as if it was for one of our sinking candidates. Instead we should
prune based on m_sinkCandidates.
This fixes a benign bug where we would generate a lot of repeated IR for some pathological
tests.
* dfg/DFGObjectAllocationSinkingPhase.cpp:
(JSC::DFG::ObjectAllocationSinkingPhase::promoteSunkenFields):
Modified Paths
Diff
Modified: trunk/Source/_javascript_Core/ChangeLog (181494 => 181495)
--- trunk/Source/_javascript_Core/ChangeLog 2015-03-14 02:50:28 UTC (rev 181494)
+++ trunk/Source/_javascript_Core/ChangeLog 2015-03-14 02:50:36 UTC (rev 181495)
@@ -1,3 +1,20 @@
+2015-03-13 Filip Pizlo <[email protected]>
+
+ Object allocation sinking phase shouldn't re-decorate previously sunken allocations on each fixpoint operation
+ https://bugs.webkit.org/show_bug.cgi?id=142686
+
+ Reviewed by Oliver Hunt.
+
+ Just because promoteHeapAccess() notifies us of an effect to a heap location in a node doesn't
+ mean that we should handle it as if it was for one of our sinking candidates. Instead we should
+ prune based on m_sinkCandidates.
+
+ This fixes a benign bug where we would generate a lot of repeated IR for some pathological
+ tests.
+
+ * dfg/DFGObjectAllocationSinkingPhase.cpp:
+ (JSC::DFG::ObjectAllocationSinkingPhase::promoteSunkenFields):
+
2015-03-13 Eric Carlson <[email protected]>
[Mac] Enable WIRELESS_PLAYBACK_TARGET
Modified: trunk/Source/_javascript_Core/dfg/DFGObjectAllocationSinkingPhase.cpp (181494 => 181495)
--- trunk/Source/_javascript_Core/dfg/DFGObjectAllocationSinkingPhase.cpp 2015-03-14 02:50:28 UTC (rev 181494)
+++ trunk/Source/_javascript_Core/dfg/DFGObjectAllocationSinkingPhase.cpp 2015-03-14 02:50:36 UTC (rev 181495)
@@ -581,10 +581,12 @@
promoteHeapAccess(
node,
[&] (PromotedHeapLocation location, Edge) {
- locations.add(location);
+ if (m_sinkCandidates.contains(location.base()))
+ locations.add(location);
},
[&] (PromotedHeapLocation location) {
- locations.add(location);
+ if (m_sinkCandidates.contains(location.base()))
+ locations.add(location);
});
}
}
@@ -636,6 +638,8 @@
promoteHeapAccess(
node,
[&] (PromotedHeapLocation location, Edge value) {
+ if (!m_sinkCandidates.contains(location.base()))
+ return;
SSACalculator::Variable* variable = m_locationToVariable.get(location);
m_ssaCalculator.newDef(variable, block, value.node());
},
@@ -687,10 +691,12 @@
promoteHeapAccess(
node,
[&] (PromotedHeapLocation location, Edge value) {
- m_localMapping.set(location, value.node());
+ if (m_sinkCandidates.contains(location.base()))
+ m_localMapping.set(location, value.node());
},
[&] (PromotedHeapLocation location) {
- node->replaceWith(resolve(block, location));
+ if (m_sinkCandidates.contains(location.base()))
+ node->replaceWith(resolve(block, location));
});
}
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
