Changeset 267255 in webkit for trunk/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp

Timestamp:

Sep 18, 2020, 12:34:21 PM (5 years ago)

Author:

[email protected]

Message:

DFG should ensure there are PhantomLocals for the taken block of op_jneq_ptr
​https://bugs.webkit.org/show_bug.cgi?id=216669

Reviewed by Saam Barati.

JSTests:

• stress/jneq-ptr-opcode-variable-only-live-on-taken-branch.js: Added.

(bar):
(foo):

Source/JavaScriptCore:

Right now, if there is a local that is live on the taken branch but dead on
not-taken branch then nothing will preserve it for OSR exit. This patch simply
adds a PhantomLocal for each live operand for the first bytecode of the taken block.

• dfg/DFGByteCodeParser.cpp:

(JSC::DFG::ByteCodeParser::parseBlock):

File:

• trunk/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp (modified) (1 diff)

trunk/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp

@@ -7166 +7166 @@
                 LAST_OPCODE(op_jneq_ptr);
             }
+
+            // We need to phantom any local that is live on the taken block but not live on the not-taken block. i.e. `set of locals
+            // live at head of taken` - `set of locals live at head of not-taken`. Otherwise, there are no "uses" to preserve the
+            // those locals for OSR after this point. Since computing this precisely is somewhat non-trivial, we instead Phantom
+            // everything live at the head of the taken block.
+            auto addFlushDirect = [&] (InlineCallFrame* inlineCallFrame, Operand operand) {
+                // We don't need to flush anything here since that should be handled by the terminal of the not-taken block.
+                UNUSED_PARAM(inlineCallFrame);
+                ASSERT_UNUSED(operand, unmapOperand(inlineCallFrame, operand).isArgument() || operand == m_graph.m_codeBlock->scopeRegister());
+            };
+            auto addPhantomLocalDirect = [&] (InlineCallFrame*, Operand operand) { phantomLocalDirect(operand); };
+            // The addPhantomLocalDirect part of flushForTerminal happens to be exactly what we want so let's just call that.
+            flushForTerminalImpl(CodeOrigin(BytecodeIndex(m_currentIndex.offset() + relativeOffset), inlineCallFrame()), addFlushDirect, addPhantomLocalDirect);
+
             addToGraph(CheckIsConstant, OpInfo(frozenPointer), child);
             NEXT_OPCODE(op_jneq_ptr);