commit 2407c13a2399c4568e8cece663056bea8d649abf
author keith_miller@apple.com <keith_miller@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc> Fri Jan 17 03:47:54 2020 +0000
committer keith_miller@apple.com <keith_miller@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc> Fri Jan 17 03:47:54 2020 +0000
tree 300d77bda0104ea24fee4e088cb0c331079e7c5e
parent 029acc4bb3986fd290e1548e7a09fcd491f7941b

Revert 254725 since it breaks tests
https://bugs.webkit.org/show_bug.cgi?id=206391

Unreviewed, revert.


JSTests:

* stress/allocation-sinking-puthint-control-flow-2.js: Removed.

Source/JavaScriptCore:

* dfg/DFGObjectAllocationSinkingPhase.cpp:


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@254733 268f45cc-cd09-0410-ab3c-d52691b4dbfc

JSTests/ChangeLog

diff --git a/JSTests/ChangeLog b/JSTests/ChangeLog
index 7f91d14..a16ab24 100644
--- a/JSTests/ChangeLog
+++ b/JSTests/ChangeLog
@@ -1,3 +1,12 @@
+2020-01-16  Keith Miller  <keith_miller@apple.com>
+
+        Revert 254725 since it breaks tests
+        https://bugs.webkit.org/show_bug.cgi?id=206391
+
+        Unreviewed, revert.
+
+        * stress/allocation-sinking-puthint-control-flow-2.js: Removed.
+
 2020-01-16  Tadeu Zagallo  <tzagallo@apple.com>
 
         Object allocation sinking is missing PutHint for allocations unreachable in the graph

JSTests/stress/allocation-sinking-puthint-control-flow-2.js

diff --git a/JSTests/stress/allocation-sinking-puthint-control-flow-2.js b/JSTests/stress/allocation-sinking-puthint-control-flow-2.js
deleted file mode 100644
index 473de06..0000000
--- a/JSTests/stress/allocation-sinking-puthint-control-flow-2.js
+++ /dev/null
@@ -1,16 +0,0 @@
-//@ runDefault("--useConcurrentJIT=0", "--jitPolicyScale=0")
-
-function f() {
-    var x = {};
-    x = 0;
-    var handler = {
-        construct: function () {
-            x;
-        }
-    };
-    for (let i = 0; i < 1; i++)
-        (function () { i });
-    new Proxy(function() { }, handler);
-}
-f();
-f();

Source/JavaScriptCore/ChangeLog

diff --git a/Source/JavaScriptCore/ChangeLog b/Source/JavaScriptCore/ChangeLog
index 4418dc0..03a5ce0 100644
--- a/Source/JavaScriptCore/ChangeLog
+++ b/Source/JavaScriptCore/ChangeLog
@@ -1,3 +1,12 @@
+2020-01-16  Keith Miller  <keith_miller@apple.com>
+
+        Revert 254725 since it breaks tests
+        https://bugs.webkit.org/show_bug.cgi?id=206391
+
+        Unreviewed, revert.
+
+        * dfg/DFGObjectAllocationSinkingPhase.cpp:
+
 2020-01-16  Tadeu Zagallo  <tzagallo@apple.com>
 
         Object allocation sinking is missing PutHint for sunken allocations

Source/JavaScriptCore/dfg/DFGObjectAllocationSinkingPhase.cpp

diff --git a/Source/JavaScriptCore/dfg/DFGObjectAllocationSinkingPhase.cpp b/Source/JavaScriptCore/dfg/DFGObjectAllocationSinkingPhase.cpp
index 2e62e29..e25b68a 100644
--- a/Source/JavaScriptCore/dfg/DFGObjectAllocationSinkingPhase.cpp
+++ b/Source/JavaScriptCore/dfg/DFGObjectAllocationSinkingPhase.cpp
@@ -409,10 +409,8 @@
     Node* follow(PromotedHeapLocation location) const
     {
         const Allocation& base = m_allocations.find(location.base())->value;
-        if (base.isEscapedAllocation())
-            return nullptr;
-
         auto iter = base.fields().find(location.descriptor());
+
         if (iter == base.fields().end())
             return nullptr;
 
@@ -1948,7 +1946,7 @@
                     availabilityCalculator.m_availability, identifier, phiDef->value());
 
                 for (PromotedHeapLocation location : hintsForPhi[variable->index()]) {
-                    if (m_heap.onlyLocalAllocation(location)) {
+                    if (m_heap.onlyLocalAllocation(location.base())) {
                         m_insertionSet.insert(0,
                             location.createHint(m_graph, block->at(0)->origin.withInvalidExit(), phiDef->value()));
                         m_localMapping.set(location, phiDef->value());