WebKit Bugzilla
Attachment 371701 Details for
Bug 198648
: [JSC] Use mergePrediction in ValuePow prediction propagation
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Requests
|
Help
|
New Account
|
Log In
Remember
[x]
|
Forgot Password
Login:
[x]
[patch]
Patch
bug-198648-20190608214216.patch (text/plain), 3.20 KB, created by
Yusuke Suzuki
on 2019-06-08 21:42:17 PDT
(
hide
)
Description:
Patch
Filename:
MIME Type:
Creator:
Yusuke Suzuki
Created:
2019-06-08 21:42:17 PDT
Size:
3.20 KB
patch
obsolete
>Subversion Revision: 246236 >diff --git a/Source/JavaScriptCore/ChangeLog b/Source/JavaScriptCore/ChangeLog >index 636232c50d989e5408aeb1487ce9fe10a4c880ce..9c1f667aa96799bc518d8c4310ccd4196d497dc5 100644 >--- a/Source/JavaScriptCore/ChangeLog >+++ b/Source/JavaScriptCore/ChangeLog >@@ -1,3 +1,16 @@ >+2019-06-08 Yusuke Suzuki <ysuzuki@apple.com> >+ >+ [JSC] Use mergePrediction in ValuePow prediction propagation >+ https://bugs.webkit.org/show_bug.cgi?id=198648 >+ >+ Reviewed by NOBODY (OOPS!). >+ >+ We are accidentally using setPrediction. This is wrong since prediction propagation (not processInvariant) >+ must extend the speculation types to ensure we eventually reach to the fixed point. setPrediction can discard >+ previously configured predictions, can lead to oscillation potentially. Use mergePrediction instead. >+ >+ * dfg/DFGPredictionPropagationPhase.cpp: >+ > 2019-06-07 Tadeu Zagallo <tzagallo@apple.com> > > AI should get GetterSetter structure from the base's GlobalObject for GetGetterSetterByOffset >diff --git a/Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp b/Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp >index 84d61de6748af73b19953c275d79dc84e423ae5d..9537ce062407c022caa1a87b726101c3075e73c1 100644 >--- a/Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp >+++ b/Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp >@@ -286,9 +286,9 @@ class PredictionPropagationPhase : public Phase { > changed |= mergePrediction(SpecBigInt); > else if (isFullNumberOrBooleanSpeculationExpectingDefined(left) > && isFullNumberOrBooleanSpeculationExpectingDefined(right)) >- setPrediction(SpecBytecodeDouble); >+ changed |= mergePrediction(SpecBytecodeDouble); > else >- setPrediction(SpecBytecodeDouble | SpecBigInt); >+ changed |= mergePrediction(SpecBytecodeDouble | SpecBigInt); > } > break; > } >diff --git a/JSTests/ChangeLog b/JSTests/ChangeLog >index 082c1491d80976fe1e929b2d93370a6fffc72a64..60c78bd0705897c9dd39251cbec89f7d9b1cf1a2 100644 >--- a/JSTests/ChangeLog >+++ b/JSTests/ChangeLog >@@ -1,3 +1,12 @@ >+2019-06-08 Yusuke Suzuki <ysuzuki@apple.com> >+ >+ [JSC] Use mergePrediction in ValuePow prediction propagation >+ https://bugs.webkit.org/show_bug.cgi?id=198648 >+ >+ Reviewed by NOBODY (OOPS!). >+ >+ * stress/prediction-propagation-should-use-merge-prediction-for-value-pow.js: Added. >+ > 2019-06-07 Tadeu Zagallo <tzagallo@apple.com> > > AI should get GetterSetter structure from the base's GlobalObject for GetGetterSetterByOffset >diff --git a/JSTests/stress/prediction-propagation-should-use-merge-prediction-for-value-pow.js b/JSTests/stress/prediction-propagation-should-use-merge-prediction-for-value-pow.js >new file mode 100644 >index 0000000000000000000000000000000000000000..34954235ce77b51397d370ad1535fdfa2a1f03cf >--- /dev/null >+++ b/JSTests/stress/prediction-propagation-should-use-merge-prediction-for-value-pow.js >@@ -0,0 +1,4 @@ >+//@ runDefault("--useRandomizingFuzzerAgent=1") >+for (let i = 0; i < 100000; i = i + 1 | 0) { >+ if (i ** 2) {} >+}
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Formatted Diff
|
Diff
Attachments on
bug 198648
:
371572
| 371701