Patch forthcoming.
Created attachment 207217 [details] the patch
Comment on attachment 207217 [details] the patch View in context: https://bugs.webkit.org/attachment.cgi?id=207217&action=review > Source/JavaScriptCore/dfg/DFGNode.h:1404 > union { > Node* replacement; > + BasicBlock* owner; > } misc; Can you add clarification about what ensures that a node only has either a replacement or an owner.
(In reply to comment #2) > (From update of attachment 207217 [details]) > View in context: https://bugs.webkit.org/attachment.cgi?id=207217&action=review > > > Source/JavaScriptCore/dfg/DFGNode.h:1404 > > union { > > Node* replacement; > > + BasicBlock* owner; > > } misc; > > Can you add clarification about what ensures that a node only has either a replacement or an owner. It's not like that. These fields only become valid if you initialize them. You have to make up your mind, when you initialize them, whether your phase needs to use replacement, or needs to know the node-to-block mapping. Most phases need neither of these pieces of information. Only three phases use replacements, and the only phases that will use owners are LICM and possibly GVN.
Created attachment 207222 [details] the patch
Comment on attachment 207217 [details] the patch View in context: https://bugs.webkit.org/attachment.cgi?id=207217&action=review >>> Source/JavaScriptCore/dfg/DFGNode.h:1404 >>> } misc; >> >> Can you add clarification about what ensures that a node only has either a replacement or an owner. > > It's not like that. These fields only become valid if you initialize them. You have to make up your mind, when you initialize them, whether your phase needs to use replacement, or needs to know the node-to-block mapping. Most phases need neither of these pieces of information. Only three phases use replacements, and the only phases that will use owners are LICM and possibly GVN. Ok. You probably want to add some indication of that (or an assertion if possible), as it wasn't clear.
(In reply to comment #5) > (From update of attachment 207217 [details]) > View in context: https://bugs.webkit.org/attachment.cgi?id=207217&action=review > > >>> Source/JavaScriptCore/dfg/DFGNode.h:1404 > >>> } misc; > >> > >> Can you add clarification about what ensures that a node only has either a replacement or an owner. > > > > It's not like that. These fields only become valid if you initialize them. You have to make up your mind, when you initialize them, whether your phase needs to use replacement, or needs to know the node-to-block mapping. Most phases need neither of these pieces of information. Only three phases use replacements, and the only phases that will use owners are LICM and possibly GVN. > > Ok. You probably want to add some indication of that (or an assertion if possible), as it wasn't clear. Moments later, you updated it! r=me.
(In reply to comment #5) > (From update of attachment 207217 [details]) > View in context: https://bugs.webkit.org/attachment.cgi?id=207217&action=review > > >>> Source/JavaScriptCore/dfg/DFGNode.h:1404 > >>> } misc; > >> > >> Can you add clarification about what ensures that a node only has either a replacement or an owner. > > > > It's not like that. These fields only become valid if you initialize them. You have to make up your mind, when you initialize them, whether your phase needs to use replacement, or needs to know the node-to-block mapping. Most phases need neither of these pieces of information. Only three phases use replacements, and the only phases that will use owners are LICM and possibly GVN. > > Ok. You probably want to add some indication of that (or an assertion if possible), as it wasn't clear. I don't think an assertion is either possible or profitable - we don't have any kind of natural way of checking if a pointer points to a Node or a BasicBlock. Also, each phase first initializes 'misc', and then uses it, often in a very obvious way. Like, you'll literally see one loop that initializes them and another loop that uses them.
Landed in http://trac.webkit.org/changeset/152958