Bug 168140 – Object allocation sinking phase doesn't properly handle control flow when emitting a PutHint of a materialized object into a PromotedHeapLocation of a still sunken object

• Component: JavaScriptCore
• Status: RESOLVED FIXED

[Saam Barati]

For example, if you have a control flow diamond, where we materialize along both sides of the diamond, we will emit PutHints along both sides. But we won't emit a PutHint if the Phi of the two materializations at the join point.

[Saam Barati]

An example program:

What ToT produces
```
bb#0:
b: PhantomActivation()
a: PhantomNewFunction()
c: PutHint(@a, @b, ActivationLoc)
Branch(#1, #2)

bb#1:
d: MaterializeActivation()
e: PutHint(@a, @d, ActivationLoc)
f: Upsilon(@d, ^p)
Jump(#3)

bb#2:
g: MaterializeActivation()
h: PutHint(@a, @g, ActivationLoc)
i: Upsilon(@d, ^p)
Jump(#3)

bb#3:
p: Phi()
// What is PromotedHeapLocation(@a, ActivationLoc) here?
// What would we do if we exited?
// We need to do is PutHint the Phi.
```

What we should produce as IR is:

```
bb#0:
b: PhantomActivation()
a: PhantomNewFunction()
c: PutHint(@a, @b, ActivationLoc)
Branch(#1, #2)

bb#1:
d: MaterializeActivation()
e: PutHint(@a, @d, ActivationLoc)
f: Upsilon(@d, ^p)
Jump(#3)

bb#2:
g: MaterializeActivation()
h: PutHint(@a, @g, ActivationLoc)
i: Upsilon(@d, ^p)
Jump(#3)

bb#3:
p: Phi()
j: PutHint(@a, @p, ActivationLoc)
```

[Saam Barati]

<rdar://problem/30205880>

[Saam Barati]

Created attachment 301233 [details]
patch

[Saam Barati]

Created attachment 301235 [details]
patch for landing

[WebKit Commit Bot]

Comment on attachment 301235 [details]
patch for landing

Clearing flags on attachment: 301235

Committed r212177: <http://trac.webkit.org/changeset/212177>

[WebKit Commit Bot]

All reviewed patches have been landed.  Closing bug.