Attachment 371701 Details for Bug 198648 – Patch

[patch] Patch

bug-198648-20190608214216.patch (text/plain), 3.20 KB, created by Yusuke Suzuki on 2019-06-08 21:42:17 PDT

(hide)

Description:

Filename:

MIME Type:

Creator: Yusuke Suzuki

Created: 2019-06-08 21:42:17 PDT

Size: 3.20 KB

patch

obsolete

>Subversion Revision: 246236
>diff --git a/Source/JavaScriptCore/ChangeLog b/Source/JavaScriptCore/ChangeLog
>index 636232c50d989e5408aeb1487ce9fe10a4c880ce..9c1f667aa96799bc518d8c4310ccd4196d497dc5 100644
>--- a/Source/JavaScriptCore/ChangeLog
>+++ b/Source/JavaScriptCore/ChangeLog
>@@ -1,3 +1,16 @@
>+2019-06-08  Yusuke Suzuki  <ysuzuki@apple.com>
>+
>+        [JSC] Use mergePrediction in ValuePow prediction propagation
>+        https://bugs.webkit.org/show_bug.cgi?id=198648
>+
>+        Reviewed by NOBODY (OOPS!).
>+
>+        We are accidentally using setPrediction. This is wrong since prediction propagation (not processInvariant)
>+        must extend the speculation types to ensure we eventually reach to the fixed point. setPrediction can discard
>+        previously configured predictions, can lead to oscillation potentially. Use mergePrediction instead.
>+
>+        * dfg/DFGPredictionPropagationPhase.cpp:
>+
> 2019-06-07  Tadeu Zagallo  <tzagallo@apple.com>
> 
>         AI should get GetterSetter structure from the base's GlobalObject for GetGetterSetterByOffset
>diff --git a/Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp b/Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp
>index 84d61de6748af73b19953c275d79dc84e423ae5d..9537ce062407c022caa1a87b726101c3075e73c1 100644
>--- a/Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp
>+++ b/Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp
>@@ -286,9 +286,9 @@ class PredictionPropagationPhase : public Phase {
>                     changed |= mergePrediction(SpecBigInt);
>                 else if (isFullNumberOrBooleanSpeculationExpectingDefined(left)
>                     && isFullNumberOrBooleanSpeculationExpectingDefined(right))
>-                    setPrediction(SpecBytecodeDouble);
>+                    changed |= mergePrediction(SpecBytecodeDouble);
>                 else
>-                    setPrediction(SpecBytecodeDouble | SpecBigInt);
>+                    changed |= mergePrediction(SpecBytecodeDouble | SpecBigInt);
>             }
>             break;
>         }
>diff --git a/JSTests/ChangeLog b/JSTests/ChangeLog
>index 082c1491d80976fe1e929b2d93370a6fffc72a64..60c78bd0705897c9dd39251cbec89f7d9b1cf1a2 100644
>--- a/JSTests/ChangeLog
>+++ b/JSTests/ChangeLog
>@@ -1,3 +1,12 @@
>+2019-06-08  Yusuke Suzuki  <ysuzuki@apple.com>
>+
>+        [JSC] Use mergePrediction in ValuePow prediction propagation
>+        https://bugs.webkit.org/show_bug.cgi?id=198648
>+
>+        Reviewed by NOBODY (OOPS!).
>+
>+        * stress/prediction-propagation-should-use-merge-prediction-for-value-pow.js: Added.
>+
> 2019-06-07  Tadeu Zagallo  <tzagallo@apple.com>
> 
>         AI should get GetterSetter structure from the base's GlobalObject for GetGetterSetterByOffset
>diff --git a/JSTests/stress/prediction-propagation-should-use-merge-prediction-for-value-pow.js b/JSTests/stress/prediction-propagation-should-use-merge-prediction-for-value-pow.js
>new file mode 100644
>index 0000000000000000000000000000000000000000..34954235ce77b51397d370ad1535fdfa2a1f03cf
>--- /dev/null
>+++ b/JSTests/stress/prediction-propagation-should-use-merge-prediction-for-value-pow.js
>@@ -0,0 +1,4 @@
>+//@ runDefault("--useRandomizingFuzzerAgent=1")
>+for (let i = 0; i < 100000; i = i + 1 | 0) {
>+    if (i ** 2) {}
>+}

Actions: View | Formatted Diff | Diff

Attachments on bug 198648: 371572 | 371701