Changeset 143955 in webkit for trunk/Source/JavaScriptCore/dfg/DFGVariableAccessData.h

Timestamp:

Feb 25, 2013, 12:23:55 PM (12 years ago)

Author:

[email protected]

Message:

The DFG special case checks for isCreatedThisArgument are fragile
​https://bugs.webkit.org/show_bug.cgi?id=110535

Reviewed by Oliver Hunt.

There may be many situations in which we want to force a variable to never be
unboxed. Capturing is one such case, and the created this argument is another.
Previously all code that dealt with this issue had to query both scenarios.

Now DFG::VariableAccessData knows these things. You just have to ask
VariableAccessData for whether a variable should be unboxed. Anyone wishing to
force a variable to never be unboxed just tells VariableAccessData.

• dfg/DFGAbstractState.cpp:

(JSC::DFG::AbstractState::initialize):

• dfg/DFGByteCodeParser.cpp:

(JSC::DFG::ByteCodeParser::parseBlock):
(DFG):

• dfg/DFGCFGSimplificationPhase.cpp:

(CFGSimplificationPhase):

• dfg/DFGFixupPhase.cpp:

(JSC::DFG::FixupPhase::fixupNode):

• dfg/DFGGraph.h:

(Graph):

• dfg/DFGPredictionPropagationPhase.cpp:

(JSC::DFG::PredictionPropagationPhase::doRoundOfDoubleVoting):

• dfg/DFGSpeculativeJIT.cpp:

(JSC::DFG::SpeculativeJIT::compile):

• dfg/DFGSpeculativeJIT32_64.cpp:

(JSC::DFG::SpeculativeJIT::compile):

• dfg/DFGSpeculativeJIT64.cpp:

(JSC::DFG::SpeculativeJIT::compile):

• dfg/DFGUnificationPhase.cpp:

(JSC::DFG::UnificationPhase::run):

• dfg/DFGVariableAccessData.h:

(JSC::DFG::VariableAccessData::VariableAccessData):
(JSC::DFG::VariableAccessData::mergeIsCaptured):
(JSC::DFG::VariableAccessData::mergeShouldNeverUnbox):
(VariableAccessData):
(JSC::DFG::VariableAccessData::shouldNeverUnbox):
(JSC::DFG::VariableAccessData::shouldUnboxIfPossible):
(JSC::DFG::VariableAccessData::shouldUseDoubleFormat):
(JSC::DFG::VariableAccessData::tallyVotesForShouldUseDoubleFormat):

File:

• trunk/Source/JavaScriptCore/dfg/DFGVariableAccessData.h (modified) (7 diffs)

trunk/Source/JavaScriptCore/dfg/DFGVariableAccessData.h

@@ -47 +47 @@
         , m_argumentAwarePrediction(SpecNone)
         , m_flags(0)
-        , m_doubleFormatState(EmptyDoubleFormatState)
         , m_isCaptured(false)
+        , m_shouldNeverUnbox(false)
         , m_isArgumentsAlias(false)
         , m_structureCheckHoistingFailed(false)
+        , m_doubleFormatState(EmptyDoubleFormatState)
     {
         clearVotes();
@@ -60 +61 @@
         , m_argumentAwarePrediction(SpecNone)
         , m_flags(0)
-        , m_doubleFormatState(EmptyDoubleFormatState)
         , m_isCaptured(isCaptured)
+        , m_shouldNeverUnbox(isCaptured)
         , m_isArgumentsAlias(false)
         , m_structureCheckHoistingFailed(false)
+        , m_doubleFormatState(EmptyDoubleFormatState)
     {
         clearVotes();
@@ -81 +83 @@
     bool mergeIsCaptured(bool isCaptured)
     {
+        m_shouldNeverUnbox |= isCaptured;
         bool newIsCaptured = m_isCaptured | isCaptured;
         if (newIsCaptured == m_isCaptured)
@@ -91 +94 @@
     {
         return m_isCaptured;
+    }
+    
+    bool mergeShouldNeverUnbox(bool shouldNeverUnbox)
+    {
+        bool newShouldNeverUnbox = m_shouldNeverUnbox | shouldNeverUnbox;
+        if (newShouldNeverUnbox == m_shouldNeverUnbox)
+            return false;
+        m_shouldNeverUnbox = newShouldNeverUnbox;
+        return true;
+    }
+    
+    // Returns true if it would be unsound to store the value in an unboxed fashion.
+    // If this returns false, it simply means that it is sound to unbox; it doesn't
+    // mean that we have actually done so.
+    bool shouldNeverUnbox()
+    {
+        ASSERT(!(m_isCaptured && !m_shouldNeverUnbox));
+        return m_shouldNeverUnbox;
+    }
+    
+    // Returns true if we should be unboxing the value provided that the predictions
+    // and double format vote say so. This may return false even if shouldNeverUnbox()
+    // returns false, since this incorporates heuristics of profitability.
+    bool shouldUnboxIfPossible()
+    {
+        return !shouldNeverUnbox();
     }
     
@@ -211 +240 @@
     {
         ASSERT(isRoot());
-        return m_doubleFormatState == UsingDoubleFormat;
+        bool result = m_doubleFormatState == UsingDoubleFormat;
+        ASSERT(!(result && shouldNeverUnbox()));
+        ASSERT(!(result && isCaptured()));
+        return result;
     }
     
@@ -217 +249 @@
     {
         ASSERT(isRoot());
+        
+        if (operandIsArgument(local()) || shouldNeverUnbox())
+            return DFG::mergeDoubleFormatState(m_doubleFormatState, NotUsingDoubleFormat);
         
         if (m_doubleFormatState == CantUseDoubleFormat)
@@ -271 +306 @@
     NodeFlags m_flags;
     
+    bool m_isCaptured;
+    bool m_shouldNeverUnbox;
+    bool m_isArgumentsAlias;
+    bool m_structureCheckHoistingFailed;
+
     float m_votes[2]; // Used primarily for double voting but may be reused for other purposes.
     DoubleFormatState m_doubleFormatState;
-    
-    bool m_isCaptured;
-    bool m_isArgumentsAlias;
-    bool m_structureCheckHoistingFailed;
 };