tree db3c12a145373e5ba8484f971de39ca9d14fd652
parent da72c99a8f0cfc82e049f021536a93d342112e71
author tzagallo@apple.com <tzagallo@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc> 1579222515 +0000
committer tzagallo@apple.com <tzagallo@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc> 1579222515 +0000

JSTests:
Object allocation sinking is missing PutHint for allocations unreachable in the graph
https://bugs.webkit.org/show_bug.cgi?id=203799
<rdar://problem/56852162>

Reviewed by Saam Barati.

* stress/allocation-sinking-puthint-control-flow-2.js: Added.
(f.handler.construct):
(f):

Source/JavaScriptCore:
Object allocation sinking is missing PutHint for sunken allocations
https://bugs.webkit.org/show_bug.cgi?id=203799
<rdar://problem/56852162>

Reviewed by Saam Barati.

Consider the following graph:

    Block #0:
      1: PhantomCreateActivation()
      2: PhantomNewFunction()
      PutHint(@2, @1, FunctionActivationPLoc)
      Branch(#1, #2)

    Block #1:
      3: MaterializeCreateActivation()
      PutHint(@2, @3, FunctionActivationPLoc)
      Upsilon(@3, ^5)
      Jump(#3)

    Block #2:
      4: MaterializeCreateActivation()
      PutHint(@2, @4, FunctionActivationPLoc)
      Upsilon(@4, ^5)
      Jump(#3)

    Block #3:
      5: Phi()
      ExitOK()

On Block #3, we need to emit a PutHint after the Phi, since we might exit after it. However,
object allocation sinking skipped this Phi because it was checking whether the base of the
location that caused us to create this Phi (@2) was live, but it's dead in the graph (there
are no pointers to it).  The issue is that, even though there are no pointers to the base, the
location `PromotedHeapLocation(@2, FunctionActivationPLoc)` is still live, so we should PutHint
to it. We fix it by checking for liveness of the location rather than its base.

* dfg/DFGObjectAllocationSinkingPhase.cpp:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@254725 268f45cc-cd09-0410-ab3c-d52691b4dbfc