Changeset 247724 in webkit for trunk/Source/JavaScriptCore/dfg/DFGIntegerRangeOptimizationPhase.cpp

Timestamp:

Jul 23, 2019, 10:24:13 AM (6 years ago)

Author:

Justin Michaud

Message:

Sometimes we miss removable CheckInBounds
​https://bugs.webkit.org/show_bug.cgi?id=200018

Reviewed by Saam Barati.

JSTests:

• microbenchmarks/typed-array-sum.js: Added.

(doTest):

Source/JavaScriptCore:

We failed to remove the CheckInBounds bounds because we did not see that the index was nonnegative. This is because we do not see the relationship between the two
separate zero constants that appear in the IR for the given test case. This patch re-adds the hack to de-duplicate m_zero that was removed in
<​https://trac.webkit.org/changeset/241228/webkit>.

• dfg/DFGIntegerRangeOptimizationPhase.cpp:

File:

• trunk/Source/JavaScriptCore/dfg/DFGIntegerRangeOptimizationPhase.cpp (modified) (2 diffs)

trunk/Source/JavaScriptCore/dfg/DFGIntegerRangeOptimizationPhase.cpp

@@ -1011 +1011 @@
         
         // Before we do anything, make sure that we have a zero constant at the top.
-        m_zero = m_insertionSet.insertConstant(0, m_graph.block(0)->at(0)->origin, jsNumber(0));
-        m_insertionSet.execute(m_graph.block(0));
+        for (Node* node : *m_graph.block(0)) {
+            if (node->isInt32Constant() && !node->asInt32()) {
+                m_zero = node;
+                break;
+            }
+        }
+        if (!m_zero) {
+            m_zero = m_insertionSet.insertConstant(0, m_graph.block(0)->at(0)->origin, jsNumber(0));
+            m_insertionSet.execute(m_graph.block(0));
+        }
         
         if (DFGIntegerRangeOptimizationPhaseInternal::verbose) {
@@ -1322 +1330 @@
                     if (nonNegative && lessThanLength) {
                         executeNode(block->at(nodeIndex));
-                        node->convertToIdentityOn(m_zero);
+                        // We just need to make sure we are a value-producing node.
+                        node->convertToIdentityOn(node->child1().node());
                         changed = true;
                     }