DFG IR shouldn't have a separate node for every kind of put hint that could be described using PromotedLocationDescriptor
https://bugs.webkit.org/show_bug.cgi?id=142769
Reviewed by Michael Saboff.
When we sink an object allocation, we need to have some way of tracking what stores would
have happened had the allocation not been sunk, so that we know how to rematerialize the
object on OSR exit. Prior to this change, trunk had two ways of describing such a "put
hint":
- The PutStrutureHint and PutByOffsetHint node types.
- The PromotedLocationDescriptor class, which has an enum with cases StructurePLoc and
NamedPropertyPLoc.
We also had ways of converting from a Node with those two node types to a
PromotedLocationDescriptor, and we had a way of converting a PromotedLocationDescriptor to
a Node.
This change removes the redundancy. We now have just one node type that corresponds to a
put hint, and it's called PutHint. It has a PromotedLocationDescriptor as metadata.
Converting between a PutHint node and a PromotedLocationDescriptor and vice-versa is now
trivial.
This means that if we add new kinds of sunken objects, we'll have less pro-forma to write
for the put hints to those objects. This is mainly to simplify the implementation of
arguments elimination in bug 141174.
* dfg/DFGAbstractInterpreterInlines.h:
(JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
* dfg/DFGClobberize.h:
(JSC::DFG::clobberize):
* dfg/DFGDoesGC.cpp:
(JSC::DFG::doesGC):
* dfg/DFGFixupPhase.cpp:
(JSC::DFG::FixupPhase::fixupNode):
* dfg/DFGGraph.cpp:
(JSC::DFG::Graph::dump):
(JSC::DFG::Graph::mergeRelevantToOSR):
* dfg/DFGMayExit.cpp:
(JSC::DFG::mayExit):
* dfg/DFGNode.cpp:
(JSC::DFG::Node::convertToPutHint):
(JSC::DFG::Node::convertToPutStructureHint):
(JSC::DFG::Node::convertToPutByOffsetHint):
(JSC::DFG::Node::promotedLocationDescriptor):
* dfg/DFGNode.h:
(JSC::DFG::Node::hasIdentifier):
(JSC::DFG::Node::hasPromotedLocationDescriptor):
(JSC::DFG::Node::convertToPutByOffsetHint): Deleted.
(JSC::DFG::Node::convertToPutStructureHint): Deleted.
* dfg/DFGNodeType.h:
* dfg/DFGOSRAvailabilityAnalysisPhase.cpp:
(JSC::DFG::LocalOSRAvailabilityCalculator::executeNode):
* dfg/DFGObjectAllocationSinkingPhase.cpp:
(JSC::DFG::ObjectAllocationSinkingPhase::run):
(JSC::DFG::ObjectAllocationSinkingPhase::lowerNonReadingOperationsOnPhantomAllocations):
(JSC::DFG::ObjectAllocationSinkingPhase::handleNode):
* dfg/DFGPredictionPropagationPhase.cpp:
(JSC::DFG::PredictionPropagationPhase::propagate):
* dfg/DFGPromoteHeapAccess.h:
(JSC::DFG::promoteHeapAccess):
* dfg/DFGPromotedHeapLocation.cpp:
(JSC::DFG::PromotedHeapLocation::createHint):
* dfg/DFGPromotedHeapLocation.h:
(JSC::DFG::PromotedLocationDescriptor::imm1):
(JSC::DFG::PromotedLocationDescriptor::imm2):
* dfg/DFGSafeToExecute.h:
(JSC::DFG::safeToExecute):
* dfg/DFGSpeculativeJIT32_64.cpp:
(JSC::DFG::SpeculativeJIT::compile):
* dfg/DFGSpeculativeJIT64.cpp:
(JSC::DFG::SpeculativeJIT::compile):
* dfg/DFGValidate.cpp:
(JSC::DFG::Validate::validateCPS):
* ftl/FTLCapabilities.cpp:
(JSC::FTL::canCompile):
* ftl/FTLLowerDFGToLLVM.cpp:
(JSC::FTL::LowerDFGToLLVM::compileNode):
git-svn-id: http://svn.webkit.org/repository/webkit/trunk@181650 268f45cc-cd09-0410-ab3c-d52691b4dbfc
diff --git a/Source/JavaScriptCore/dfg/DFGObjectAllocationSinkingPhase.cpp b/Source/JavaScriptCore/dfg/DFGObjectAllocationSinkingPhase.cpp
index 1b7b683..f2d19fa 100644
--- a/Source/JavaScriptCore/dfg/DFGObjectAllocationSinkingPhase.cpp
+++ b/Source/JavaScriptCore/dfg/DFGObjectAllocationSinkingPhase.cpp
@@ -1,5 +1,5 @@
/*
- * Copyright (C) 2014 Apple Inc. All rights reserved.
+ * Copyright (C) 2014, 2015 Apple Inc. All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
@@ -72,10 +72,10 @@
// that would see any other escape. Note that Upsilons constitute escaping sites. Then we
// insert additional MaterializeNewObject nodes on Upsilons that feed into Phis that mix
// materializations and the original PhantomNewObject. We then turn each PutByOffset over a
- // PhantomNewObject into a PutByOffsetHint.
+ // PhantomNewObject into a PutHint.
//
// - We perform the same optimization for MaterializeNewObject. This allows us to cover
- // cases where we had MaterializeNewObject flowing into a PutByOffsetHint.
+ // cases where we had MaterializeNewObject flowing into a PutHint.
//
// We could also add this rule:
//
@@ -527,9 +527,10 @@
if (m_sinkCandidates.contains(node)) {
Node* structure = m_insertionSet.insertConstant(
nodeIndex + 1, node->origin, JSValue(node->structure()));
- m_insertionSet.insertNode(
- nodeIndex + 1, SpecNone, PutStructureHint, node->origin,
- Edge(node, KnownCellUse), Edge(structure, KnownCellUse));
+ m_insertionSet.insert(
+ nodeIndex + 1,
+ PromotedHeapLocation(StructurePLoc, node).createHint(
+ m_graph, node->origin, structure));
node->convertToPhantomNewObject();
}
break;
@@ -537,13 +538,19 @@
case MaterializeNewObject: {
if (m_sinkCandidates.contains(node)) {
- m_insertionSet.insertNode(
- nodeIndex + 1, SpecNone, PutStructureHint, node->origin,
- Edge(node, KnownCellUse), m_graph.varArgChild(node, 0));
+ m_insertionSet.insert(
+ nodeIndex + 1,
+ PromotedHeapLocation(StructurePLoc, node).createHint(
+ m_graph, node->origin, m_graph.varArgChild(node, 0).node()));
for (unsigned i = 0; i < node->objectMaterializationData().m_properties.size(); ++i) {
- m_insertionSet.insertNode(
- nodeIndex + 1, SpecNone, PutByOffsetHint, node->origin,
- Edge(node, KnownCellUse), m_graph.varArgChild(node, i + 1));
+ unsigned identifierNumber =
+ node->objectMaterializationData().m_properties[i].m_identifierNumber;
+ m_insertionSet.insert(
+ nodeIndex + 1,
+ PromotedHeapLocation(
+ NamedPropertyPLoc, node, identifierNumber).createHint(
+ m_graph, node->origin,
+ m_graph.varArgChild(node, i + 1).node()));
}
node->convertToPhantomNewObject();
}
@@ -762,7 +769,7 @@
case HardPhantom:
case StoreBarrier:
case StoreBarrierWithNullCheck:
- case PutByOffsetHint:
+ case PutHint:
break;
case PutByOffset:
