DFG IR shouldn't have a separate node for every kind of put hint that could be described using PromotedLocationDescriptor
https://bugs.webkit.org/show_bug.cgi?id=142769
Reviewed by Michael Saboff.
When we sink an object allocation, we need to have some way of tracking what stores would
have happened had the allocation not been sunk, so that we know how to rematerialize the
object on OSR exit. Prior to this change, trunk had two ways of describing such a "put
hint":
- The PutStrutureHint and PutByOffsetHint node types.
- The PromotedLocationDescriptor class, which has an enum with cases StructurePLoc and
NamedPropertyPLoc.
We also had ways of converting from a Node with those two node types to a
PromotedLocationDescriptor, and we had a way of converting a PromotedLocationDescriptor to
a Node.
This change removes the redundancy. We now have just one node type that corresponds to a
put hint, and it's called PutHint. It has a PromotedLocationDescriptor as metadata.
Converting between a PutHint node and a PromotedLocationDescriptor and vice-versa is now
trivial.
This means that if we add new kinds of sunken objects, we'll have less pro-forma to write
for the put hints to those objects. This is mainly to simplify the implementation of
arguments elimination in bug 141174.
- dfg/DFGAbstractInterpreterInlines.h:
(JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
(JSC::DFG::clobberize):
(JSC::DFG::doesGC):
(JSC::DFG::FixupPhase::fixupNode):
(JSC::DFG::Graph::dump):
(JSC::DFG::Graph::mergeRelevantToOSR):
(JSC::DFG::mayExit):
(JSC::DFG::Node::convertToPutHint):
(JSC::DFG::Node::convertToPutStructureHint):
(JSC::DFG::Node::convertToPutByOffsetHint):
(JSC::DFG::Node::promotedLocationDescriptor):
(JSC::DFG::Node::hasIdentifier):
(JSC::DFG::Node::hasPromotedLocationDescriptor):
(JSC::DFG::Node::convertToPutByOffsetHint): Deleted.
(JSC::DFG::Node::convertToPutStructureHint): Deleted.
- dfg/DFGNodeType.h:
- dfg/DFGOSRAvailabilityAnalysisPhase.cpp:
(JSC::DFG::LocalOSRAvailabilityCalculator::executeNode):
- dfg/DFGObjectAllocationSinkingPhase.cpp:
(JSC::DFG::ObjectAllocationSinkingPhase::run):
(JSC::DFG::ObjectAllocationSinkingPhase::lowerNonReadingOperationsOnPhantomAllocations):
(JSC::DFG::ObjectAllocationSinkingPhase::handleNode):
- dfg/DFGPredictionPropagationPhase.cpp:
(JSC::DFG::PredictionPropagationPhase::propagate):
- dfg/DFGPromoteHeapAccess.h:
(JSC::DFG::promoteHeapAccess):
- dfg/DFGPromotedHeapLocation.cpp:
(JSC::DFG::PromotedHeapLocation::createHint):
- dfg/DFGPromotedHeapLocation.h:
(JSC::DFG::PromotedLocationDescriptor::imm1):
(JSC::DFG::PromotedLocationDescriptor::imm2):
(JSC::DFG::safeToExecute):
- dfg/DFGSpeculativeJIT32_64.cpp:
(JSC::DFG::SpeculativeJIT::compile):
- dfg/DFGSpeculativeJIT64.cpp:
(JSC::DFG::SpeculativeJIT::compile):
(JSC::DFG::Validate::validateCPS):
(JSC::FTL::canCompile):
- ftl/FTLLowerDFGToLLVM.cpp:
(JSC::FTL::LowerDFGToLLVM::compileNode):