webkitgtk-2.12.3webkitgtk-2.12.3

1 files changed, 24 insertions, 19 deletions

diff --git a/Source/JavaScriptCore/dfg/DFGLivenessAnalysisPhase.cpp b/Source/JavaScriptCore/dfg/DFGLivenessAnalysisPhase.cpp
index 65c4105bc..94c398da1 100644
--- a/Source/JavaScriptCore/dfg/DFGLivenessAnalysisPhase.cpp
+++ b/Source/JavaScriptCore/dfg/DFGLivenessAnalysisPhase.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2013 Apple Inc. All rights reserved.
+ * Copyright (C) 2013, 2015 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -32,7 +32,7 @@
 #include "DFGGraph.h"
 #include "DFGInsertionSet.h"
 #include "DFGPhase.h"
-#include "Operations.h"
+#include "JSCInlines.h"
 
 namespace JSC { namespace DFG {
 
@@ -57,6 +57,7 @@ public:
             BasicBlock* block = m_graph.block(blockIndex);
             if (!block)
                 continue;
+            block->ssa->liveAtTailIsDirty = true;
             block->ssa->liveAtHead.clear();
             block->ssa->liveAtTail.clear();
         }
@@ -68,12 +69,11 @@ public:
         } while (m_changed);
         
         if (!m_graph.block(0)->ssa->liveAtHead.isEmpty()) {
-            dataLog(
-                "Bad liveness analysis result: live at root is not empty: ",
-                nodeListDump(m_graph.block(0)->ssa->liveAtHead), "\n");
-            dataLog("IR at time of error:\n");
-            m_graph.dump();
-            CRASH();
+            DFG_CRASH(
+                m_graph, nullptr,
+                toCString(
+                    "Bad liveness analysis result: live at root is not empty: ",
+                    nodeListDump(m_graph.block(0)->ssa->liveAtHead)).data());
         }
         
         return true;
@@ -85,11 +85,12 @@ private:
         BasicBlock* block = m_graph.block(blockIndex);
         if (!block)
             return;
-        
-        // FIXME: It's likely that this can be improved, for static analyses that use
-        // HashSets. https://bugs.webkit.org/show_bug.cgi?id=118455
+
+        if (!block->ssa->liveAtTailIsDirty)
+            return;
+        block->ssa->liveAtTailIsDirty = false;
+
         m_live = block->ssa->liveAtTail;
-        
         for (unsigned nodeIndex = block->size(); nodeIndex--;) {
             Node* node = block->at(nodeIndex);
             
@@ -131,13 +132,17 @@ private:
             }
         }
         
-        if (m_live == block->ssa->liveAtHead)
-            return;
-        
-        m_changed = true;
-        block->ssa->liveAtHead = m_live;
-        for (unsigned i = block->predecessors.size(); i--;)
-            block->predecessors[i]->ssa->liveAtTail.add(m_live.begin(), m_live.end());
+        for (Node* node : m_live) {
+            if (!block->ssa->liveAtHead.contains(node)) {
+                m_changed = true;
+                for (unsigned i = block->predecessors.size(); i--;) {
+                    BasicBlock* predecessor = block->predecessors[i];
+                    if (predecessor->ssa->liveAtTail.add(node).isNewEntry)
+                        predecessor->ssa->liveAtTailIsDirty = true;
+                }
+            }
+        }
+        block->ssa->liveAtHead = WTFMove(m_live);
     }
     
     void addChildUse(Node*, Edge& edge)