Title: [242945] trunk
- Revision
- 242945
- Author
- [email protected]
- Date
- 2019-03-14 10:41:04 -0700 (Thu, 14 Mar 2019)
Log Message
DFG liveness can't skip tail caller inline frames
https://bugs.webkit.org/show_bug.cgi?id=195715
JSTests:
Reviewed by Saam Barati.
* stress/dfg-scan-inlined-tail-caller-frames-liveness.js:
(i.foo):
Source/_javascript_Core:
<rdar://problem/46221598>
Reviewed by Saam Barati.
In order to simplify OSR exit/DFG bytecode parsing our bytecode
generator always emits an op_ret after any tail call. However, the
DFG when computing the liveness of locals, would skip any tail
caller inline frames. This mean that if we ended up inserting a
Check that would OSR to the op_ret we wouldn't have kept
availability data around for it.
* dfg/DFGGraph.cpp:
(JSC::DFG::Graph::isLiveInBytecode):
* dfg/DFGGraph.h:
(JSC::DFG::Graph::forAllLocalsLiveInBytecode):
Modified Paths
Added Paths
Diff
Modified: trunk/JSTests/ChangeLog (242944 => 242945)
--- trunk/JSTests/ChangeLog 2019-03-14 16:41:50 UTC (rev 242944)
+++ trunk/JSTests/ChangeLog 2019-03-14 17:41:04 UTC (rev 242945)
@@ -1,3 +1,13 @@
+2019-03-14 Keith Miller <[email protected]>
+
+ DFG liveness can't skip tail caller inline frames
+ https://bugs.webkit.org/show_bug.cgi?id=195715
+
+ Reviewed by Saam Barati.
+
+ * stress/dfg-scan-inlined-tail-caller-frames-liveness.js:
+ (i.foo):
+
2019-03-13 Mark Lam <[email protected]>
Gardening: reducing the variants on 2 tests to avoid timing out on JSC Debug queue.
Added: trunk/JSTests/stress/dfg-scan-inlined-tail-caller-frames-liveness.js (0 => 242945)
--- trunk/JSTests/stress/dfg-scan-inlined-tail-caller-frames-liveness.js (rev 0)
+++ trunk/JSTests/stress/dfg-scan-inlined-tail-caller-frames-liveness.js 2019-03-14 17:41:04 UTC (rev 242945)
@@ -0,0 +1,5 @@
+//@ requireOptions("--jitPolicyScale=0", "--maximumFunctionForCallInlineCandidateInstructionCount=1000", "--validateFTLOSRExitLiveness=1")
+
+for (let i = 0; i < 100000; i++) {
+ (function foo() { [0].concat().indexOf(0) })()
+}
Modified: trunk/Source/_javascript_Core/ChangeLog (242944 => 242945)
--- trunk/Source/_javascript_Core/ChangeLog 2019-03-14 16:41:50 UTC (rev 242944)
+++ trunk/Source/_javascript_Core/ChangeLog 2019-03-14 17:41:04 UTC (rev 242945)
@@ -1,3 +1,23 @@
+2019-03-14 Keith Miller <[email protected]>
+
+ DFG liveness can't skip tail caller inline frames
+ https://bugs.webkit.org/show_bug.cgi?id=195715
+ <rdar://problem/46221598>
+
+ Reviewed by Saam Barati.
+
+ In order to simplify OSR exit/DFG bytecode parsing our bytecode
+ generator always emits an op_ret after any tail call. However, the
+ DFG when computing the liveness of locals, would skip any tail
+ caller inline frames. This mean that if we ended up inserting a
+ Check that would OSR to the op_ret we wouldn't have kept
+ availability data around for it.
+
+ * dfg/DFGGraph.cpp:
+ (JSC::DFG::Graph::isLiveInBytecode):
+ * dfg/DFGGraph.h:
+ (JSC::DFG::Graph::forAllLocalsLiveInBytecode):
+
2019-03-14 Robin Morisset <[email protected]>
DFG::Worklist can be shrunk by 16 bytes
Modified: trunk/Source/_javascript_Core/dfg/DFGGraph.cpp (242944 => 242945)
--- trunk/Source/_javascript_Core/dfg/DFGGraph.cpp 2019-03-14 16:41:50 UTC (rev 242944)
+++ trunk/Source/_javascript_Core/dfg/DFGGraph.cpp 2019-03-14 17:41:04 UTC (rev 242945)
@@ -1166,15 +1166,10 @@
dataLog("Argument is live.\n");
return true;
}
-
- codeOriginPtr = inlineCallFrame->getCallerSkippingTailCalls();
- // The first inline call frame could be an inline tail call
- if (!codeOriginPtr) {
- if (verbose)
- dataLog("Dead because of tail inlining.\n");
- return false;
- }
+ // We need to handle tail callers because we may decide to exit to the
+ // the return bytecode following the tail call.
+ codeOriginPtr = &inlineCallFrame->directCaller;
}
RELEASE_ASSERT_NOT_REACHED();
Modified: trunk/Source/_javascript_Core/dfg/DFGGraph.h (242944 => 242945)
--- trunk/Source/_javascript_Core/dfg/DFGGraph.h 2019-03-14 16:41:50 UTC (rev 242944)
+++ trunk/Source/_javascript_Core/dfg/DFGGraph.h 2019-03-14 17:41:04 UTC (rev 242945)
@@ -865,12 +865,10 @@
for (VirtualRegister reg = exclusionStart; reg < exclusionEnd; reg += 1)
functor(reg);
-
- codeOriginPtr = inlineCallFrame->getCallerSkippingTailCalls();
- // The first inline call frame could be an inline tail call
- if (!codeOriginPtr)
- break;
+ // We need to handle tail callers because we may decide to exit to the
+ // the return bytecode following the tail call.
+ codeOriginPtr = &inlineCallFrame->directCaller;
}
}
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
