Bug 152162
| Summary: | B3 should be able to sink values into checks | ||
|---|---|---|---|
| Product: | WebKit | Reporter: | Filip Pizlo <fpizlo> |
| Component: | JavaScriptCore | Assignee: | Nobody <webkit-unassigned> |
| Status: | NEW | ||
| Severity: | Normal | ||
| Priority: | P2 | ||
| Version: | WebKit Nightly Build | ||
| Hardware: | All | ||
| OS: | All | ||
| Bug Depends on: | 152224, 152968 | ||
| Bug Blocks: | 152106 | ||
Filip Pizlo
B3 should sink sinkable operations to the lowest dominating point in the CFG. In case an operation's output is only used for the stackmap of Check, we should turn this:
@a = Foo(...)
Check(@p, @a)
into this:
Branch(@p, #exit, #continuation)
exit:
@a = Foo(...)
Check(false, @a)
contination:
...
This will help with the useless Shr that we will see on some array bounds checks from asm.js code.
| Attachments | ||
|---|---|---|
| Add attachment proposed patch, testcase, etc. |
Filip Pizlo
(In reply to comment #0)
> B3 should sink sinkable operations to the lowest dominating point in the
> CFG. In case an operation's output is only used for the stackmap of Check,
> we should turn this:
>
> @a = Foo(...)
> Check(@p, @a)
>
> into this:
>
> Branch(@p, #exit, #continuation)
>
> exit:
> @a = Foo(...)
> Check(false, @a)
>
> contination:
> ...
>
> This will help with the useless Shr that we will see on some array bounds
> checks from asm.js code.
It's worth saying that usually, https://bugs.webkit.org/show_bug.cgi?id=152160 will obviate the need for this. But things may leak past that optimization. This optimization is more general, but it has a compile time cost due to the introduction of control flow.
Filip Pizlo
The priority right now is sinking into checks, not general sinking.
Filip Pizlo
Note that we could sink anything that the CSE can reason about. For example, we could sink stores into checks!