<?xml version="1.0" encoding="UTF-8" standalone="yes" ?>
<!DOCTYPE bugzilla SYSTEM "https://bugs.webkit.org/page.cgi?id=bugzilla.dtd">

<bugzilla version="5.0.4.1"
          urlbase="https://bugs.webkit.org/"
          
          maintainer="admin@webkit.org"
>

    <bug>
          <bug_id>151315</bug_id>
          
          <creation_ts>2015-11-16 11:08:46 -0800</creation_ts>
          <short_desc>If B3-&gt;Air lowering moves a child to the result tmp when using an Inst with a x86-style UseDef operand, then other uses of that child should also use the result tmp</short_desc>
          <delta_ts>2015-11-16 12:22:17 -0800</delta_ts>
          <reporter_accessible>1</reporter_accessible>
          <cclist_accessible>1</cclist_accessible>
          <classification_id>1</classification_id>
          <classification>Unclassified</classification>
          <product>WebKit</product>
          <component>JavaScriptCore</component>
          <version>WebKit Nightly Build</version>
          <rep_platform>All</rep_platform>
          <op_sys>All</op_sys>
          <bug_status>RESOLVED</bug_status>
          <resolution>WORKSFORME</resolution>
          
          
          <bug_file_loc></bug_file_loc>
          <status_whiteboard></status_whiteboard>
          <keywords></keywords>
          <priority>P2</priority>
          <bug_severity>Normal</bug_severity>
          <target_milestone>---</target_milestone>
          
          <blocked>151214</blocked>
          <everconfirmed>1</everconfirmed>
          <reporter name="Filip Pizlo">fpizlo</reporter>
          <assigned_to name="Nobody">webkit-unassigned</assigned_to>
          
          

      

      

      

          <comment_sort_order>oldest_to_newest</comment_sort_order>  
          <long_desc isprivate="0" >
    <commentid>1142282</commentid>
    <comment_count>0</comment_count>
    <who name="Filip Pizlo">fpizlo</who>
    <bug_when>2015-11-16 11:08:46 -0800</bug_when>
    <thetext>Consider this:

Int32 @2 = Add(@1, @1)

Ignoring for a moment the fact that this goes through Shl as a result of reduceStrength(), we will currently do this:

tmp mapping:
@1 -&gt; %tmp1
@2 -&gt; %tmp2

Move %tmp1, %tmp2
Add32 %tmp1, %tmp2

This prevents us from coalescing %tmp1 and %tmp2, since their live ranges overlap.  The solution is that when we decide to emit the result move, we also force a temporary substitution of s/%tmp1/%tmp2/g on the subsequent Inst.  This would cause us to do:

Move %tmp1, %tmp2
Add32 %tmp2, %tmp2

I believe that such a substitution is both correct and optimal. It&apos;s correct because we use arguments before we def them, so although the Add32 def&apos;s %tmp2, this happens after all arguments are consumed. Hence, %tmp2 is a correct substitute for %tmp1. It&apos;s also optimal, since it avoids the overlapping live range.

We have to be somewhat careful about how we implement this. Probably, the temporary substitution will be something that only some lowering rules opt into.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1142293</commentid>
    <comment_count>1</comment_count>
    <who name="Filip Pizlo">fpizlo</who>
    <bug_when>2015-11-16 11:35:11 -0800</bug_when>
    <thetext>LOL, I picked a bad example.  We have special-case handling of Shl(x, 1), and Add(x, x) turns into Shl(x, 1). That handling already does the right thing.

But this same issue arises for Mul, for example.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1142294</commentid>
    <comment_count>2</comment_count>
    <who name="Filip Pizlo">fpizlo</who>
    <bug_when>2015-11-16 11:47:05 -0800</bug_when>
    <thetext>Hmm!  It looks like the register allocator already does magically good things about the Mul case...</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1142299</commentid>
    <comment_count>3</comment_count>
    <who name="Filip Pizlo">fpizlo</who>
    <bug_when>2015-11-16 12:21:05 -0800</bug_when>
    <thetext>Whoa, our register allocator already does the magically correct thing.  This is Ben&apos;s comment:

            // We do not want the Use() of this move to interfere with the Def(), even if it is live
            // after the Move. If we were to add the interference edge, it would be impossible to
            // coalesce the Move even if the two Tmp never interfere anywhere.

This is the verbiage in the IRC paper:

    Move instructions are given special consideration. It is important not to create
    artifical interferences between the source and destination of a move. Consider the
    program:
        t := s
        ...
        x := ... s ... ...
        y := ... t ...
        ; copy
        ; use of s
        ; use of t
    After the copy instruction both s and t are live, and an interference edge would be
    added between s and t, since t is being defined at a point where s is live. The
    solution is to temporarily remove s from the live set and continue.</thetext>
  </long_desc>
      
      

    </bug>

</bugzilla>