Changeset 185505 in webkit for trunk/Source/JavaScriptCore/dfg/DFGObjectAllocationSinkingPhase.cpp

Timestamp:

Jun 12, 2015, 9:33:37 AM (10 years ago)

Author:

[email protected]

Message:

DFG Object Allocation Sinking should not consider GetClosureVar as escapes
​https://bugs.webkit.org/show_bug.cgi?id=145904

Reviewed by Filip Pizlo.

The object allocation sinking phase is currently able to sink
CreateActivation nodes, but will consider any GetClosureVar node as
escaping.

This is not problematic in general as most of the GetClosureVar nodes
we would have been able to sink over will have been eliminated by CSE
anyway. Still, this is an oversight that we should fix since the
machinery is already in place.

• dfg/DFGObjectAllocationSinkingPhase.cpp:

(JSC::DFG::ObjectAllocationSinkingPhase::handleNode):

• dfg/DFGPromoteHeapAccess.h:

(JSC::DFG::promoteHeapAccess):

File:

• trunk/Source/JavaScriptCore/dfg/DFGObjectAllocationSinkingPhase.cpp (modified) (1 diff)

trunk/Source/JavaScriptCore/dfg/DFGObjectAllocationSinkingPhase.cpp

@@ -901 +901 @@
         }
 
+        case GetClosureVar: {
+            Node* target = node->child1().node();
+            if (!target->isActivationAllocation())
+                escape(target);
+            break;
+        }
+
         case PutClosureVar: {
             Node* target = node->child1().node();