Ignore:
Timestamp:
Jun 2, 2020, 9:55:15 AM (5 years ago)
Author:
[email protected]
Message:

MultiDeleteByOffset should not always def
https://bugs.webkit.org/show_bug.cgi?id=212621
<rdar://problem/63824182>

Reviewed by Yusuke Suzuki.

JSTests:

  • stress/multi-del-by-offset-doesnt-always-def-osr-entry.js: Added.

(foo):

  • stress/multi-del-by-offset-doesnt-always-def.js: Added.

(foo):
(let.p.set undefined):

Source/JavaScriptCore:

Clobberize used to claim that MultiDeleteByOffset always defd a value.
That's an incorrect modeling of MultiDeleteByOffset though, since it might
have delete misses in its variant list. This would lead us to incorrectly
CSE when we shouldn't. This patch fixes this by saying MultiDeleteByOffset
only defs when all its cases write out a value (are hits).

  • dfg/DFGClobberize.h:

(JSC::DFG::clobberize):

  • dfg/DFGNode.cpp:

(JSC::DFG::MultiDeleteByOffsetData::allVariantsStoreEmpty const):

  • dfg/DFGNode.h:
  • ftl/FTLLowerDFGToB3.cpp:

(JSC::FTL::DFG::LowerDFGToB3::compileMultiDeleteByOffset):

File:
1 edited

Legend:

Unmodified
Added
Removed
  • trunk/Source/JavaScriptCore/dfg/DFGNode.cpp

    r261755 r262425  
    6767}
    6868
     69bool MultiDeleteByOffsetData::allVariantsStoreEmpty() const
     70{
     71    for (unsigned i = variants.size(); i--;) {
     72        if (!variants[i].newStructure())
     73            return false;
     74    }
     75    return true;
     76}
     77
    6978void BranchTarget::dump(PrintStream& out) const
    7079{
Note: See TracChangeset for help on using the changeset viewer.