Imported WebKit commit bb52bf3c0119e8a128cd93afe5572413a8617de9 (http://svn.webkit.org/repository/webkit/trunk@108790)

1 files changed, 37 insertions, 21 deletions

diff --git a/Source/JavaScriptCore/dfg/DFGAbstractState.cpp b/Source/JavaScriptCore/dfg/DFGAbstractState.cpp
index 72c1759c7..ee0cc9ab7 100644
--- a/Source/JavaScriptCore/dfg/DFGAbstractState.cpp
+++ b/Source/JavaScriptCore/dfg/DFGAbstractState.cpp
@@ -48,10 +48,10 @@ namespace JSC { namespace DFG {
 #define FLAG_FOR_MERGE_TO_SUCCESSORS   20
 #define FLAG_FOR_STRUCTURE_CLOBBERING  21
 
-AbstractState::AbstractState(CodeBlock* codeBlock, Graph& graph)
-    : m_codeBlock(codeBlock)
+AbstractState::AbstractState(Graph& graph)
+    : m_codeBlock(graph.m_codeBlock)
     , m_graph(graph)
-    , m_variables(codeBlock->numParameters(), graph.m_localVars)
+    , m_variables(m_codeBlock->numParameters(), graph.m_localVars)
     , m_block(0)
 {
     size_t maxBlockSize = 0;
@@ -104,7 +104,16 @@ void AbstractState::initialize(Graph& graph)
     BasicBlock* root = graph.m_blocks[0].get();
     root->cfaShouldRevisit = true;
     for (size_t i = 0; i < root->valuesAtHead.numberOfArguments(); ++i) {
-        PredictedType prediction = graph[root->variablesAtHead.argument(i)].variableAccessData()->prediction();
+        Node& node = graph[root->variablesAtHead.argument(i)];
+        ASSERT(node.op == SetArgument);
+        if (!node.shouldGenerate()) {
+            // The argument is dead. We don't do any checks for such arguments, and so
+            // for the purpose of the analysis, they contain no value.
+            root->valuesAtHead.argument(i).clear();
+            continue;
+        }
+        
+        PredictedType prediction = node.variableAccessData()->prediction();
         if (isInt32Prediction(prediction))
             root->valuesAtHead.argument(i).set(PredictInt32);
         else if (isArrayPrediction(prediction))
@@ -153,14 +162,14 @@ bool AbstractState::endBasicBlock(MergeMode mergeMode)
     if (mergeMode != DontMerge || !ASSERT_DISABLED) {
         for (size_t argument = 0; argument < block->variablesAtTail.numberOfArguments(); ++argument) {
 #if DFG_ENABLE(DEBUG_PROPAGATION_VERBOSE)
-            printf("        Merging state for argument %zu.\n", argument);
+            dataLog("        Merging state for argument %zu.\n", argument);
 #endif
             changed |= mergeStateAtTail(block->valuesAtTail.argument(argument), m_variables.argument(argument), block->variablesAtTail.argument(argument));
         }
         
         for (size_t local = 0; local < block->variablesAtTail.numberOfLocals(); ++local) {
 #if DFG_ENABLE(DEBUG_PROPAGATION_VERBOSE)
-            printf("        Merging state for local %zu.\n", local);
+            dataLog("        Merging state for local %zu.\n", local);
 #endif
             changed |= mergeStateAtTail(block->valuesAtTail.local(local), m_variables.local(local), block->variablesAtTail.local(local));
         }
@@ -196,10 +205,13 @@ bool AbstractState::execute(NodeIndex nodeIndex)
     switch (node.op) {
     case JSConstant:
     case WeakJSConstant: {
-        JSValue value = m_graph.valueOfJSConstant(m_codeBlock, nodeIndex);
-        if (value.isCell())
-            m_haveStructures = true;
-        forNode(nodeIndex).set(value);
+        JSValue value = m_graph.valueOfJSConstant(nodeIndex);
+        // Have to be careful here! It's tempting to call set(value), but
+        // that would be wrong, since that would constitute a proof that this
+        // value will always have the same structure. The whole point of a value
+        // having a structure is that it may change in the future - for example
+        // between when we compile the code and when we run it.
+        forNode(nodeIndex).set(predictionFromValue(value));
         break;
     }
             
@@ -264,7 +276,7 @@ bool AbstractState::execute(NodeIndex nodeIndex)
             
     case ValueAdd:
     case ArithAdd: {
-        if (m_graph.addShouldSpeculateInteger(node, m_codeBlock)) {
+        if (m_graph.addShouldSpeculateInteger(node)) {
             forNode(node.child1()).filter(PredictInt32);
             forNode(node.child2()).filter(PredictInt32);
             forNode(nodeIndex).set(PredictInt32);
@@ -276,14 +288,18 @@ bool AbstractState::execute(NodeIndex nodeIndex)
             forNode(nodeIndex).set(PredictDouble);
             break;
         }
-        ASSERT(node.op == ValueAdd);
-        clobberStructures(nodeIndex);
-        forNode(nodeIndex).set(PredictString | PredictInt32 | PredictNumber);
+        if (node.op == ValueAdd) {
+            clobberStructures(nodeIndex);
+            forNode(nodeIndex).set(PredictString | PredictInt32 | PredictNumber);
+            break;
+        }
+        // We don't handle this yet. :-(
+        m_isValid = false;
         break;
     }
             
     case ArithSub: {
-        if (m_graph.addShouldSpeculateInteger(node, m_codeBlock)) {
+        if (m_graph.addShouldSpeculateInteger(node)) {
             forNode(node.child1()).filter(PredictInt32);
             forNode(node.child2()).filter(PredictInt32);
             forNode(nodeIndex).set(PredictInt32);
@@ -937,7 +953,7 @@ inline bool AbstractState::mergeStateAtTail(AbstractValue& destination, Abstract
         return false;
     
 #if DFG_ENABLE(DEBUG_PROPAGATION_VERBOSE)
-            printf("          It's live, node @%u.\n", nodeIndex);
+            dataLog("          It's live, node @%u.\n", nodeIndex);
 #endif
 
     switch (node.op) {
@@ -947,7 +963,7 @@ inline bool AbstractState::mergeStateAtTail(AbstractValue& destination, Abstract
         // The block transfers the value from head to tail.
         source = &inVariable;
 #if DFG_ENABLE(DEBUG_PROPAGATION_VERBOSE)
-        printf("          Transfering from head to tail.\n");
+        dataLog("          Transfering from head to tail.\n");
 #endif
         break;
             
@@ -955,7 +971,7 @@ inline bool AbstractState::mergeStateAtTail(AbstractValue& destination, Abstract
         // The block refines the value with additional speculations.
         source = &forNode(nodeIndex);
 #if DFG_ENABLE(DEBUG_PROPAGATION_VERBOSE)
-        printf("          Refining.\n");
+        dataLog("          Refining.\n");
 #endif
         break;
             
@@ -964,7 +980,7 @@ inline bool AbstractState::mergeStateAtTail(AbstractValue& destination, Abstract
         // before and after setting it.
         source = &forNode(node.child1());
 #if DFG_ENABLE(DEBUG_PROPAGATION_VERBOSE)
-        printf("          Setting.\n");
+        dataLog("          Setting.\n");
 #endif
         break;
         
@@ -978,7 +994,7 @@ inline bool AbstractState::mergeStateAtTail(AbstractValue& destination, Abstract
         // Abstract execution did not change the output value of the variable, for this
         // basic block, on this iteration.
 #if DFG_ENABLE(DEBUG_PROPAGATION_VERBOSE)
-        printf("          Not changed!\n");
+        dataLog("          Not changed!\n");
 #endif
         return false;
     }
@@ -988,7 +1004,7 @@ inline bool AbstractState::mergeStateAtTail(AbstractValue& destination, Abstract
     // true to indicate that the fixpoint must go on!
     destination = *source;
 #if DFG_ENABLE(DEBUG_PROPAGATION_VERBOSE)
-    printf("          Changed!\n");
+    dataLog("          Changed!\n");
 #endif
     return true;
 }