Title: [246237] trunk
- Revision
- 246237
- Author
- [email protected]
- Date
- 2019-06-09 00:09:48 -0700 (Sun, 09 Jun 2019)
Log Message
[JSC] Use mergePrediction in ValuePow prediction propagation
https://bugs.webkit.org/show_bug.cgi?id=198648
Reviewed by Saam Barati.
JSTests:
* stress/prediction-propagation-should-use-merge-prediction-for-value-pow.js: Added.
Source/_javascript_Core:
We are accidentally using setPrediction. This is wrong since prediction propagation (not processInvariant)
must extend the speculation types to ensure we eventually reach to the fixed point. setPrediction can discard
previously configured predictions, can lead to oscillation potentially. Use mergePrediction instead.
* dfg/DFGPredictionPropagationPhase.cpp:
Modified Paths
Added Paths
Diff
Modified: trunk/JSTests/ChangeLog (246236 => 246237)
--- trunk/JSTests/ChangeLog 2019-06-09 03:55:01 UTC (rev 246236)
+++ trunk/JSTests/ChangeLog 2019-06-09 07:09:48 UTC (rev 246237)
@@ -1,3 +1,12 @@
+2019-06-09 Yusuke Suzuki <[email protected]>
+
+ [JSC] Use mergePrediction in ValuePow prediction propagation
+ https://bugs.webkit.org/show_bug.cgi?id=198648
+
+ Reviewed by Saam Barati.
+
+ * stress/prediction-propagation-should-use-merge-prediction-for-value-pow.js: Added.
+
2019-06-07 Tadeu Zagallo <[email protected]>
AI should get GetterSetter structure from the base's GlobalObject for GetGetterSetterByOffset
Added: trunk/JSTests/stress/prediction-propagation-should-use-merge-prediction-for-value-pow.js (0 => 246237)
--- trunk/JSTests/stress/prediction-propagation-should-use-merge-prediction-for-value-pow.js (rev 0)
+++ trunk/JSTests/stress/prediction-propagation-should-use-merge-prediction-for-value-pow.js 2019-06-09 07:09:48 UTC (rev 246237)
@@ -0,0 +1,4 @@
+//@ runDefault("--useRandomizingFuzzerAgent=1")
+for (let i = 0; i < 100000; i = i + 1 | 0) {
+ if (i ** 2) {}
+}
Modified: trunk/Source/_javascript_Core/ChangeLog (246236 => 246237)
--- trunk/Source/_javascript_Core/ChangeLog 2019-06-09 03:55:01 UTC (rev 246236)
+++ trunk/Source/_javascript_Core/ChangeLog 2019-06-09 07:09:48 UTC (rev 246237)
@@ -1,3 +1,16 @@
+2019-06-09 Yusuke Suzuki <[email protected]>
+
+ [JSC] Use mergePrediction in ValuePow prediction propagation
+ https://bugs.webkit.org/show_bug.cgi?id=198648
+
+ Reviewed by Saam Barati.
+
+ We are accidentally using setPrediction. This is wrong since prediction propagation (not processInvariant)
+ must extend the speculation types to ensure we eventually reach to the fixed point. setPrediction can discard
+ previously configured predictions, can lead to oscillation potentially. Use mergePrediction instead.
+
+ * dfg/DFGPredictionPropagationPhase.cpp:
+
2019-06-07 Tadeu Zagallo <[email protected]>
AI should get GetterSetter structure from the base's GlobalObject for GetGetterSetterByOffset
Modified: trunk/Source/_javascript_Core/dfg/DFGPredictionPropagationPhase.cpp (246236 => 246237)
--- trunk/Source/_javascript_Core/dfg/DFGPredictionPropagationPhase.cpp 2019-06-09 03:55:01 UTC (rev 246236)
+++ trunk/Source/_javascript_Core/dfg/DFGPredictionPropagationPhase.cpp 2019-06-09 07:09:48 UTC (rev 246237)
@@ -286,9 +286,9 @@
changed |= mergePrediction(SpecBigInt);
else if (isFullNumberOrBooleanSpeculationExpectingDefined(left)
&& isFullNumberOrBooleanSpeculationExpectingDefined(right))
- setPrediction(SpecBytecodeDouble);
+ changed |= mergePrediction(SpecBytecodeDouble);
else
- setPrediction(SpecBytecodeDouble | SpecBigInt);
+ changed |= mergePrediction(SpecBytecodeDouble | SpecBigInt);
}
break;
}
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
