Attachment 359658 Details for Bug 186916 – patch

[patch] patch

b-backup.diff (text/plain), 3.22 KB, created by Saam Barati on 2019-01-20 16:34:43 PST

(hide)

Description:

Filename:

MIME Type:

Creator: Saam Barati

Created: 2019-01-20 16:34:43 PST

Size: 3.22 KB

patch

obsolete

>Index: JSTests/ChangeLog
>===================================================================
>--- JSTests/ChangeLog	(revision 240217)
>+++ JSTests/ChangeLog	(working copy)
>@@ -1,3 +1,14 @@
>+2019-01-20  Saam Barati  <sbarati@apple.com>
>+
>+        MovHint must merge NodeBytecodeUsesAsValue for its child
>+        https://bugs.webkit.org/show_bug.cgi?id=186916
>+        <rdar://problem/41396612>
>+
>+        Reviewed by NOBODY (OOPS!).
>+
>+        * stress/movhint-backwards-propagation-must-merge-use-as-value.js: Added.
>+        (foo):
>+
> 2019-01-17  Saam barati  <sbarati@apple.com>
> 
>         StringObjectUse should not be a structure check for the original string object structure
>Index: JSTests/stress/movhint-backwards-propagation-must-merge-use-as-value.js
>===================================================================
>--- JSTests/stress/movhint-backwards-propagation-must-merge-use-as-value.js	(nonexistent)
>+++ JSTests/stress/movhint-backwards-propagation-must-merge-use-as-value.js	(working copy)
>@@ -0,0 +1,16 @@
>+function foo(v, a, b) {
>+    if (v) {
>+        let r = a / b;
>+        OSRExit();
>+        return r;
>+    }
>+}
>+noInline(foo);
>+
>+for (let i = 0; i < 10000; ++i) {
>+    let r = foo(true, 4, 4);
>+    if (r !== 1)
>+        throw new Error("Bad!");
>+}
>+if (foo(true, 1, 4) !== 0.25)
>+    throw new Error("Bad!");
>Index: Source/JavaScriptCore/ChangeLog
>===================================================================
>--- Source/JavaScriptCore/ChangeLog	(revision 240217)
>+++ Source/JavaScriptCore/ChangeLog	(working copy)
>@@ -1,3 +1,33 @@
>+2019-01-20  Saam Barati  <sbarati@apple.com>
>+
>+        MovHint must merge NodeBytecodeUsesAsValue for its child in backwards propagation
>+        https://bugs.webkit.org/show_bug.cgi?id=186916
>+        <rdar://problem/41396612>
>+
>+        Reviewed by NOBODY (OOPS!).
>+	
>+        Otherwise, we may not think we care about the non-integral part in
>+        a division (or perhaps overflow in an add, etc). Consider a program
>+        like this:
>+        
>+        ```return a / b```
>+        
>+        That gets compiled to:
>+        ```
>+        a: ArithDiv // We don't check that the remainder is zero here.
>+        b: MovHint(@a)
>+        c: ForceOSRExit
>+        ```
>+        
>+        If we don't inform @a that we care about its result in full number
>+        accuracy, it will choose to ignore its non-integral remainder. This
>+        makes sense if *everybody* that all uses of the Div only cared about
>+        the integral part. However, OSR exit is not one of those users. OSR
>+        exit cares about the fractional bits in such a Div.
>+
>+        * dfg/DFGBackwardsPropagationPhase.cpp:
>+        (JSC::DFG::BackwardsPropagationPhase::propagate):
>+
> 2019-01-20  Yusuke Suzuki  <yusukesuzuki@slowstart.org>
> 
>         [JSC] Shrink data structure size in JSC/heap
>Index: Source/JavaScriptCore/dfg/DFGBackwardsPropagationPhase.cpp
>===================================================================
>--- Source/JavaScriptCore/dfg/DFGBackwardsPropagationPhase.cpp	(revision 240217)
>+++ Source/JavaScriptCore/dfg/DFGBackwardsPropagationPhase.cpp	(working copy)
>@@ -205,7 +205,6 @@ private:
>             break;
>         }
>             
>-        case MovHint:
>         case Check:
>         case CheckVarargs:
>             break;

Actions: View | Formatted Diff | Diff

Attachments on bug 186916: 343322 | 359650 | 359658 | 359659 | 359660 | 359664 | 364048 | 364066 | 364562 | 364757