Bug 82312 – DFG OSR exit should not generate an exit for variables of inlinees if the inlinees are not in scope

• Component: JavaScriptCore
• Status: RESOLVED FIXED

[Filip Pizlo]

Currently DFG OSR exit computes a value recovery, and generates recovery code, for every variable within the DFG code block's Graph::m_localVars, which ends up being the high watermark of the stack for all inlinees.  This means that for example in this code:


function foo(a, b) {
    return a + b;
}

function bar(a, b, c) {
    var x = foo(a, b);
    return x + c.f;
}

If we OSR exit at c.f, then the exit will include code to restore local variables within foo(), which is clearly redundant since foo() is out of scope at that point.

Patch forthcoming.

[Filip Pizlo]

Created attachment 134007 [details]
the patch

[Eric Seidel (no email)]

Attachment 134007 [details] was posted by a committer and has review+, assigning to Filip Pizlo for commit.

[Filip Pizlo]

Landed in http://trac.webkit.org/changeset/112320