This will be fun.
Created attachment 206181 [details] it begins
Created attachment 206182 [details] more
Created attachment 206183 [details] more I'm going to do phi reduction and SSA conversion in one phase.
Created attachment 206196 [details] more
Created attachment 206198 [details] more This is starting to crystalize.
Created attachment 206199 [details] even more
Created attachment 206209 [details] reworked it again I think I might be getting this to work.
Created attachment 206214 [details] slowly adding things
Created attachment 206254 [details] liveness analysis is done
Created attachment 206282 [details] started on CFA
Created attachment 206288 [details] started thinking about FTL backend for SSA
Created attachment 206290 [details] more Starting to make sense of how to deal with flushed locals and their silly value formats.
Created attachment 206338 [details] getting there Still working on constructing OSR exit data over SSA. Doing it as a separate phase that the FTL can run before lowering.
Created attachment 206407 [details] it's getting real OMG. So much code.
Created attachment 206408 [details] forgot to delete a file
Created attachment 206486 [details] I might be done
Created attachment 206489 [details] more
Created attachment 206503 [details] still not compiling
Created attachment 206504 [details] OMG it compiles!
Created attachment 206505 [details] removed a file I accidentally added
Created attachment 206561 [details] added dumping of SSA metadata
Created attachment 206575 [details] it just ran something Obviously I still have work to do but it's getting exciting.
Created attachment 206586 [details] runs some more code
Created attachment 206589 [details] it works.
Comment on attachment 206589 [details] it works. Never mind. This still has bugs.
Created attachment 206592 [details] it really works.
Comment on attachment 206592 [details] it really works. View in context: https://bugs.webkit.org/attachment.cgi?id=206592&action=review r=me with small changes. > Source/JavaScriptCore/dfg/DFGFlushLivenessAnalysisPhase.cpp:144 > + // Three possibilities: > + // 1) Predecessor format is Dead, in which case it acquires our format. > + // 2) Predecessor format is identical to our format, in which case we > + // do nothing. > + // 3) Predecessor format is different from our format and it's not Dead, > + // in which case we have an erroneous set of Flushes and SetLocals. What if the predecessor was already processed by the fixpoint and says "not Dead" and the current block says "Dead"? > Source/JavaScriptCore/dfg/DFGSSAConversionPhase.cpp:260 > + // backwards analysis that LivenessAnalysisPhase does. As part of the FlushLivenessAnalysisPhase? > Source/JavaScriptCore/dfg/DFGSSAConversionPhase.cpp:338 > + case SetArgument: { > + node->setOpAndDefaultFlags(GetArgument); > + node->mergeFlags(resultFor(node->variableAccessData()->flushFormat())); > + break; > + } Should consider keeping SetArgument for captured arguments. > Source/JavaScriptCore/dfg/DFGSSAConversionPhase.cpp:346 > + // Free all phis and reset variables vectors. CPS phis? > Source/JavaScriptCore/dfg/DFGSSAConversionPhase.cpp:373 > + continue; break; > Source/JavaScriptCore/dfg/DFGSSAConversionPhase.cpp:386 > + return edge.node(); node = edge.node(); break; > Source/JavaScriptCore/dfg/DFGSSAConversionPhase.cpp:392 > + return node->child1().node(); node = node->child1().node(); break; > Source/JavaScriptCore/dfg/DFGSSAConversionPhase.h:46 > +// After this, any remaining SetLocal means Flush. Flush nodes are > +// eliminated. PhantomLocals become Phantoms. Nodes may may have children Flush nodes aren't eliminated. "may may". > Source/JavaScriptCore/ftl/FTLLowerDFGToLLVM.cpp:157 > + dataLog("Compiling block ", *block, "\n"); Null guard for "block"? Or hoist check above. > Source/JavaScriptCore/ftl/FTLLowerDFGToLLVM.cpp:475 > + MethodOfGettingAValueProfile profile = > + MethodOfGettingAValueProfile::fromLazyOperand( > + m_graph.m_profiledBlock, > + LazyOperandValueProfileKey(0, operand)); CodeBlock::profileForArgument? > Source/JavaScriptCore/ftl/FTLLowerDFGToLLVM.cpp:1873 > + ExitKind kind, FormattedValue lowValue, MethodOfGettingAValueProfile profile, > + LValue failCondition) > + { > + appendOSRExit( > + kind, lowValue, profile, failCondition, BackwardSpeculation, FormattedValue()); > + } Passing GetArgument as high value also works. > Source/JavaScriptCore/ftl/FTLLowerDFGToLLVM.cpp:2467 > + ExitKind kind, FormattedValue lowValue, MethodOfGettingAValueProfile profile, Ditto.
(In reply to comment #27) > (From update of attachment 206592 [details]) > View in context: https://bugs.webkit.org/attachment.cgi?id=206592&action=review > > r=me with small changes. > > > Source/JavaScriptCore/dfg/DFGFlushLivenessAnalysisPhase.cpp:144 > > + // Three possibilities: > > + // 1) Predecessor format is Dead, in which case it acquires our format. > > + // 2) Predecessor format is identical to our format, in which case we > > + // do nothing. > > + // 3) Predecessor format is different from our format and it's not Dead, > > + // in which case we have an erroneous set of Flushes and SetLocals. > > What if the predecessor was already processed by the fixpoint and says "not Dead" and the current block says "Dead"? We ain't sure about this yet and have no example of where this is needed, so I put in a FIXME for now. > > > Source/JavaScriptCore/dfg/DFGSSAConversionPhase.cpp:260 > > + // backwards analysis that LivenessAnalysisPhase does. As part of the > > FlushLivenessAnalysisPhase? Fixed. > > > Source/JavaScriptCore/dfg/DFGSSAConversionPhase.cpp:338 > > + case SetArgument: { > > + node->setOpAndDefaultFlags(GetArgument); > > + node->mergeFlags(resultFor(node->variableAccessData()->flushFormat())); > > + break; > > + } > > Should consider keeping SetArgument for captured arguments. Fixed. > > > Source/JavaScriptCore/dfg/DFGSSAConversionPhase.cpp:346 > > + // Free all phis and reset variables vectors. > > CPS phis? Fixed. > > > Source/JavaScriptCore/dfg/DFGSSAConversionPhase.cpp:373 > > + continue; > > break; Fixed. > > > Source/JavaScriptCore/dfg/DFGSSAConversionPhase.cpp:386 > > + return edge.node(); > > node = edge.node(); > break; Fixed. > > > Source/JavaScriptCore/dfg/DFGSSAConversionPhase.cpp:392 > > + return node->child1().node(); > > node = node->child1().node(); > break; Fixed. > > > Source/JavaScriptCore/dfg/DFGSSAConversionPhase.h:46 > > +// After this, any remaining SetLocal means Flush. Flush nodes are > > +// eliminated. PhantomLocals become Phantoms. Nodes may may have children > > Flush nodes aren't eliminated. Fixed. > > "may may". Fixed. > > > Source/JavaScriptCore/ftl/FTLLowerDFGToLLVM.cpp:157 > > + dataLog("Compiling block ", *block, "\n"); > > Null guard for "block"? Or hoist check above. Fixed by hoisting the check. > > > Source/JavaScriptCore/ftl/FTLLowerDFGToLLVM.cpp:475 > > + MethodOfGettingAValueProfile profile = > > + MethodOfGettingAValueProfile::fromLazyOperand( > > + m_graph.m_profiledBlock, > > + LazyOperandValueProfileKey(0, operand)); > > CodeBlock::profileForArgument? Fixed by passing m_node as the highValue. > > > Source/JavaScriptCore/ftl/FTLLowerDFGToLLVM.cpp:1873 > > + ExitKind kind, FormattedValue lowValue, MethodOfGettingAValueProfile profile, > > + LValue failCondition) > > + { > > + appendOSRExit( > > + kind, lowValue, profile, failCondition, BackwardSpeculation, FormattedValue()); > > + } > > Passing GetArgument as high value also works. Yup, fixed. > > > Source/JavaScriptCore/ftl/FTLLowerDFGToLLVM.cpp:2467 > > + ExitKind kind, FormattedValue lowValue, MethodOfGettingAValueProfile profile, > > Ditto. Fixed.
Landed in http://trac.webkit.org/changeset/152692