B3 should be able to sink values into checks

• Component: JavaScriptCore
• Status: NEW ---

[Filip Pizlo]

B3 should sink sinkable operations to the lowest dominating point in the CFG. In case an operation's output is only used for the stackmap of Check, we should turn this:

    @a = Foo(...)
    Check(@p, @a)

into this:

    Branch(@p, #exit, #continuation)

  exit:
    @a = Foo(...)
    Check(false, @a)

  contination:
    ...

This will help with the useless Shr that we will see on some array bounds checks from asm.js code.

[Filip Pizlo]

(In reply to comment #0)
> B3 should sink sinkable operations to the lowest dominating point in the
> CFG. In case an operation's output is only used for the stackmap of Check,
> we should turn this:
> 
>     @a = Foo(...)
>     Check(@p, @a)
> 
> into this:
> 
>     Branch(@p, #exit, #continuation)
> 
>   exit:
>     @a = Foo(...)
>     Check(false, @a)
> 
>   contination:
>     ...
> 
> This will help with the useless Shr that we will see on some array bounds
> checks from asm.js code.

It's worth saying that usually, https://bugs.webkit.org/show_bug.cgi?id=152160 will obviate the need for this. But things may leak past that optimization. This optimization is more general, but it has a compile time cost due to the introduction of control flow.

[Filip Pizlo]

The priority right now is sinking into checks, not general sinking.

[Filip Pizlo]

Note that we could sink anything that the CSE can reason about.  For example, we could sink stores into checks!