1040814 - IonMonkey: Fold MTest to MGoto when both successors are the same block

Status: RESOLVED FIXED

(Core :: JavaScript Engine: JIT, enhancement, P5)

Description

[Dan Gohman [:sunfish]]

When range analysis deletes an unreachable block, as in

  if (x > 0) {
     if (x < 0) {
         // unreachable
     }
  }

it is able to remove the unreachable code, however it leaves the outer (x > 0) branch behind, which becomes an MTest with both successors leading to the same block. MTest::foldsTo should ideally be able to check for this and fold the MTest into an MGoto.

Comment 1

[Nicolas B. Pierron [:nbp]]

From what I understood, when we remove a block from Range Analysis results, we go over GVN (which now includes UCE), and thus would make this bugs "RESOLVED FIXED" now.  Is that right?

Comment 2

[Dan Gohman [:sunfish]]

Yes.