diff --git a/Source/JavaScriptCore/ChangeLog b/Source/JavaScriptCore/ChangeLog index 161c8da63cbc75fac566f336d657b69ee0ab402d..bb4fd1651b56bf56b46e698f4ce28aac1374daa3 100644 --- a/Source/JavaScriptCore/ChangeLog +++ b/Source/JavaScriptCore/ChangeLog @@ -1,3 +1,16 @@ +2013-12-08 Filip Pizlo + + CSE should work in SSA + https://bugs.webkit.org/show_bug.cgi?id=125430 + + Reviewed by Oliver Hunt and Mark Hahnenberg. + + * dfg/DFGCSEPhase.cpp: + (JSC::DFG::CSEPhase::run): + (JSC::DFG::CSEPhase::performNodeCSE): + * dfg/DFGPlan.cpp: + (JSC::DFG::Plan::compileInThreadImpl): + 2013-12-09 Joseph Pecoraro Remove docs/make-bytecode-docs.pl diff --git a/Source/JavaScriptCore/dfg/DFGCSEPhase.cpp b/Source/JavaScriptCore/dfg/DFGCSEPhase.cpp index d9dd3a0088efe6d0ae1df3e60f2e20735225926d..9effa26d160fd0c2b842b5b5cba22edcb0c0aaa9 100644 --- a/Source/JavaScriptCore/dfg/DFGCSEPhase.cpp +++ b/Source/JavaScriptCore/dfg/DFGCSEPhase.cpp @@ -48,15 +48,21 @@ public: bool run() { - ASSERT((cseMode == NormalCSE) == (m_graph.m_fixpointState == FixpointNotConverged)); ASSERT(m_graph.m_fixpointState != BeforeFixpoint); m_changed = false; m_graph.clearReplacements(); - for (unsigned blockIndex = 0; blockIndex < m_graph.numBlocks(); ++blockIndex) - performBlockCSE(m_graph.block(blockIndex)); + if (m_graph.m_form == SSA) { + Vector depthFirst; + m_graph.getBlocksInDepthFirstOrder(depthFirst); + for (unsigned i = 0; i < depthFirst.size(); ++i) + performBlockCSE(depthFirst[i]); + } else { + for (unsigned blockIndex = 0; blockIndex < m_graph.numBlocks(); ++blockIndex) + performBlockCSE(m_graph.block(blockIndex)); + } return m_changed; } @@ -1015,8 +1021,10 @@ private: if (cseMode == NormalCSE) m_graph.performSubstitution(node); - if (node->op() == SetLocal) + if (node->containsMovHint()) { + ASSERT(node->op() != ZombieHint); node->child1()->mergeFlags(NodeRelevantToOSR); + } switch (node->op()) { @@ -1120,6 +1128,11 @@ private: } case Flush: { + if (m_graph.m_form == SSA) { + // FIXME: Enable Flush store elimination in SSA form. + // https://bugs.webkit.org/show_bug.cgi?id=125429 + break; + } VariableAccessData* variableAccessData = node->variableAccessData(); VirtualRegister local = variableAccessData->local(); Node* replacement = node->child1().node(); diff --git a/Source/JavaScriptCore/dfg/DFGPlan.cpp b/Source/JavaScriptCore/dfg/DFGPlan.cpp index 74d30b41b6116b8a6d7abe415e385cec1c5bca0b..e980bccec6d35f0fe29c1d64bbb6c634000f379c 100644 --- a/Source/JavaScriptCore/dfg/DFGPlan.cpp +++ b/Source/JavaScriptCore/dfg/DFGPlan.cpp @@ -269,6 +269,7 @@ Plan::CompilationPath Plan::compileInThreadImpl(LongLivedState& longLivedState) performLivenessAnalysis(dfg); performCFA(dfg); performLICM(dfg); + performCSE(dfg); performLivenessAnalysis(dfg); performCFA(dfg); if (Options::validateFTLOSRExitLiveness())