Changeset 174224 in webkit for trunk/Source/JavaScriptCore/dfg/DFGValidate.cpp

Timestamp:

Oct 2, 2014, 12:38:08 PM (11 years ago)

Author:

[email protected]

Message:

Object allocation sinking should have a sound story for picking materialization points
​https://bugs.webkit.org/show_bug.cgi?id=137315

Reviewed by Oliver Hunt.

The only missing piece was having the object allocation sinking phase locate materialization
points that were at CFG edges.

The logic for how and why this "just works" relies on some properties of critical edge
breaking, so I was fairly careful in how I did this. Also, this requires inserting things at
the "first origin node" of a block - that is the first node in a block that has a NodeOrigin
and therefore is allowed to exit. We basically had support for such a notion before, but
didn't close the loop on it; this patch does that.

Also I added the ability to provide a BasicBlock* as context for a DFG_ASSERT().

• dfg/DFGBasicBlock.cpp:

(JSC::DFG::BasicBlock::firstOriginNode):
(JSC::DFG::BasicBlock::firstOrigin):

• dfg/DFGBasicBlock.h:
• dfg/DFGCriticalEdgeBreakingPhase.cpp:

(JSC::DFG::CriticalEdgeBreakingPhase::breakCriticalEdge):

• dfg/DFGGraph.cpp:

(JSC::DFG::crash):
(JSC::DFG::Graph::handleAssertionFailure):

• dfg/DFGGraph.h:
• dfg/DFGLoopPreHeaderCreationPhase.cpp:

(JSC::DFG::createPreHeader):

• dfg/DFGNodeOrigin.h:

(JSC::DFG::NodeOrigin::isSet):

• dfg/DFGObjectAllocationSinkingPhase.cpp:

(JSC::DFG::ObjectAllocationSinkingPhase::determineMaterializationPoints):
(JSC::DFG::ObjectAllocationSinkingPhase::placeMaterializationPoints):
(JSC::DFG::ObjectAllocationSinkingPhase::promoteSunkenFields):
(JSC::DFG::ObjectAllocationSinkingPhase::createMaterialize):

• dfg/DFGValidate.cpp:

(JSC::DFG::Validate::validate):

• runtime/Options.h:

File:

• trunk/Source/JavaScriptCore/dfg/DFGValidate.cpp (modified) (1 diff)

trunk/Source/JavaScriptCore/dfg/DFGValidate.cpp

@@ -214 +214 @@
                     VALIDATE((node), canonicalResultRepresentation(node->result()) == canonicalResultRepresentation(node->child1()->result()));
                     break;
+                case SetLocal:
+                case PutLocal:
+                case Upsilon:
+                    VALIDATE((node), !!node->child1());
+                    switch (node->child1().useKind()) {
+                    case UntypedUse:
+                    case CellUse:
+                    case Int32Use:
+                    case Int52RepUse:
+                    case DoubleRepUse:
+                    case BooleanUse:
+                        break;
+                    default:
+                        VALIDATE((node), !"Bad use kind");
+                        break;
+                    }
+                    break;
                 case MakeRope:
                 case ValueAdd: