https://bugs.webkit.org/show_bug.cgi?id=86552

Source/JavaScriptCore: 

Reviewed by Geoff Garen.
        
Merged r117542 and r117543 from dfgopt.
        
Performs must-alias and escape analysis on uses of CreateArguments, and if
a variable is must-aliased to CreateArguments and does not escape, then we
turn all uses of that variable into direct arguments accesses.
        
36% speed-up on V8/earley leading to a 2.3% speed-up overall in V8.

* bytecode/CodeBlock.h:
(JSC::CodeBlock::uncheckedArgumentsRegister):
* bytecode/ValueRecovery.h:
(JSC::ValueRecovery::argumentsThatWereNotCreated):
(ValueRecovery):
(JSC::ValueRecovery::dump):
* dfg/DFGAbstractState.cpp:
(JSC::DFG::AbstractState::execute):
* dfg/DFGAdjacencyList.h:
(AdjacencyList):
(JSC::DFG::AdjacencyList::removeEdgeFromBag):
* dfg/DFGArgumentsSimplificationPhase.cpp:
(JSC::DFG::ArgumentsSimplificationPhase::run):
(ArgumentsSimplificationPhase):
(JSC::DFG::ArgumentsSimplificationPhase::observeBadArgumentsUse):
(JSC::DFG::ArgumentsSimplificationPhase::observeBadArgumentsUses):
(JSC::DFG::ArgumentsSimplificationPhase::observeProperArgumentsUse):
(JSC::DFG::ArgumentsSimplificationPhase::isOKToOptimize):
(JSC::DFG::ArgumentsSimplificationPhase::removeArgumentsReferencingPhantomChild):
* dfg/DFGAssemblyHelpers.h:
(JSC::DFG::AssemblyHelpers::argumentsRegisterFor):
(AssemblyHelpers):
* dfg/DFGByteCodeParser.cpp:
(JSC::DFG::ByteCodeParser::parseBlock):
* dfg/DFGCFGSimplificationPhase.cpp:
(JSC::DFG::CFGSimplificationPhase::removePotentiallyDeadPhiReference):
* dfg/DFGGPRInfo.h:
(GPRInfo):
* dfg/DFGGraph.cpp:
(JSC::DFG::Graph::collectGarbage):
(DFG):
* dfg/DFGGraph.h:
(Graph):
(JSC::DFG::Graph::executableFor):
(JSC::DFG::Graph::argumentsRegisterFor):
(JSC::DFG::Graph::uncheckedArgumentsRegisterFor):
(JSC::DFG::Graph::clobbersWorld):
* dfg/DFGNode.h:
(JSC::DFG::Node::hasHeapPrediction):
* dfg/DFGNodeType.h:
(DFG):
* dfg/DFGOSRExitCompiler.cpp:
* dfg/DFGOSRExitCompiler.h:
(JSC::DFG::OSRExitCompiler::OSRExitCompiler):
(OSRExitCompiler):
* dfg/DFGOSRExitCompiler32_64.cpp:
(JSC::DFG::OSRExitCompiler::compileExit):
* dfg/DFGOSRExitCompiler64.cpp:
(JSC::DFG::OSRExitCompiler::compileExit):
* dfg/DFGOperations.cpp:
* dfg/DFGPredictionPropagationPhase.cpp:
(JSC::DFG::PredictionPropagationPhase::propagate):
* dfg/DFGSpeculativeJIT.cpp:
(JSC::DFG::ValueSource::dump):
(JSC::DFG::SpeculativeJIT::compile):
(JSC::DFG::SpeculativeJIT::computeValueRecoveryFor):
* dfg/DFGSpeculativeJIT.h:
* dfg/DFGSpeculativeJIT32_64.cpp:
(JSC::DFG::SpeculativeJIT::compile):
* dfg/DFGSpeculativeJIT64.cpp:
(JSC::DFG::SpeculativeJIT::compile):
* dfg/DFGVariableAccessData.h:
(JSC::DFG::VariableAccessData::VariableAccessData):
(JSC::DFG::VariableAccessData::mergeIsArgumentsAlias):
(VariableAccessData):
(JSC::DFG::VariableAccessData::isArgumentsAlias):
* jit/JITOpcodes.cpp:
(JSC::JIT::emitSlow_op_get_argument_by_val):

LayoutTests: 

Rubber stamped by Geoff Garen.
        
Merged r117542 from dfgopt.
        
Added a bunch of tests that check that our optimizations for aliased uses of the
'arguments' object are robust against various forms of JavaScript crazy.
        
* fast/js/dfg-arguments-alias-escape-expected.txt: Added.
* fast/js/dfg-arguments-alias-escape.html: Added.
* fast/js/dfg-arguments-alias-expected.txt: Added.
* fast/js/dfg-arguments-alias.html: Added.
* fast/js/dfg-arguments-cross-code-origin-expected.txt: Added.
* fast/js/dfg-arguments-cross-code-origin.html: Added.
* fast/js/dfg-arguments-mixed-alias-expected.txt: Added.
* fast/js/dfg-arguments-mixed-alias.html: Added.
* fast/js/dfg-arguments-osr-exit-expected.txt: Added.
* fast/js/dfg-arguments-osr-exit.html: Added.
* fast/js/dfg-arguments-unexpected-escape-expected.txt: Added.
* fast/js/dfg-arguments-unexpected-escape.html: Added.
* fast/js/jsc-test-list:
* fast/js/script-tests/dfg-arguments-alias-escape.js: Added.
(foo):
(bar):
* fast/js/script-tests/dfg-arguments-alias.js: Added.
(foo):
(bar):
* fast/js/script-tests/dfg-arguments-cross-code-origin.js: Added.
(foo):
(bar):
(baz):
* fast/js/script-tests/dfg-arguments-mixed-alias.js: Added.
(foo):
(bar):
* fast/js/script-tests/dfg-arguments-osr-exit.js: Added.
(baz):
(foo):
(bar):
* fast/js/script-tests/dfg-arguments-unexpected-escape.js: Added.
(baz):
(foo):
(bar):



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@118323 268f45cc-cd09-0410-ab3c-d52691b4dbfc