Bug 64774 – DFG JIT sometimes emits spill code even when the respective values are never needed

• Status: RESOLVED
• Resolution: FIXED
• Component: JavaScriptCore

[Filip Pizlo]

The DFG JIT does register allocation on-the-fly during code generation.  While emitting code for a DFG node, the registers needed are first reserved prior to any code being emitted, and are typically only released after.  If the code that is emitted needs to save (and possibly restore) registers (using either the silentSpillAllRegisters or the flushRegisters facilities), then this may contain redundant code that spills and fills values that are dead already, since the relevant registers are only unreserved after the code is emitted.  The DFG JIT should more carefully track which registers die during in the middle of the code for a DFG node, so that any save/restore sequences that are emitted will omit registers that are already dead.

[Filip Pizlo]

Created attachment 101268 [details]
the patch

[Gavin Barraclough]

Comment on attachment 101268 [details]
the patch

Per our last discussion I'd quite like to refactor this to make the RAII pattern a little more useful here, and try to make some of this more automatic - but we already have the issue of requiring that gpr() is called at the right point, and this all looks fine.

[WebKit Review Bot]

Comment on attachment 101268 [details]
the patch

Clearing flags on attachment: 101268

Committed r91280: <http://trac.webkit.org/changeset/91280>

[WebKit Review Bot]

All reviewed patches have been landed.  Closing bug.