Attachment 371572 Details for Bug 198648 – Patch

[patch] Patch

bug-198648-20190607004713.patch (text/plain), 3.13 KB, created by Yusuke Suzuki on 2019-06-07 00:47:14 PDT

(hide)

Description:

Filename:

MIME Type:

Creator: Yusuke Suzuki

Created: 2019-06-07 00:47:14 PDT

Size: 3.13 KB

patch

obsolete

>Subversion Revision: 246190
>diff --git a/Source/JavaScriptCore/ChangeLog b/Source/JavaScriptCore/ChangeLog
>index 4615ea2cfd989f912ada374f138af1a30ab94ce0..73317ff7f82dedac514ea8fbfd743d19264d2838 100644
>--- a/Source/JavaScriptCore/ChangeLog
>+++ b/Source/JavaScriptCore/ChangeLog
>@@ -1,3 +1,16 @@
>+2019-06-07  Yusuke Suzuki  <ysuzuki@apple.com>
>+
>+        [JSC] Use mergePrediction in ValuePow prediction propagation
>+        https://bugs.webkit.org/show_bug.cgi?id=198648
>+
>+        Reviewed by NOBODY (OOPS!).
>+
>+        We are accidentally using setPrediction. This is wrong since prediction propagation (not processInvariant)
>+        must extend the speculation types to ensure we eventually reach to the fixed point. setPrediction can discard
>+        previously configured predictions, can lead to oscillation potentially. Use mergePrediction instead.
>+
>+        * dfg/DFGPredictionPropagationPhase.cpp:
>+
> 2019-06-06  Devin Rousso  <drousso@apple.com>
> 
>         Web Inspector: create CommandLineAPIHost lazily like the other agents
>diff --git a/Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp b/Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp
>index 84d61de6748af73b19953c275d79dc84e423ae5d..9537ce062407c022caa1a87b726101c3075e73c1 100644
>--- a/Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp
>+++ b/Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp
>@@ -286,9 +286,9 @@ class PredictionPropagationPhase : public Phase {
>                     changed |= mergePrediction(SpecBigInt);
>                 else if (isFullNumberOrBooleanSpeculationExpectingDefined(left)
>                     && isFullNumberOrBooleanSpeculationExpectingDefined(right))
>-                    setPrediction(SpecBytecodeDouble);
>+                    changed |= mergePrediction(SpecBytecodeDouble);
>                 else
>-                    setPrediction(SpecBytecodeDouble | SpecBigInt);
>+                    changed |= mergePrediction(SpecBytecodeDouble | SpecBigInt);
>             }
>             break;
>         }
>diff --git a/JSTests/ChangeLog b/JSTests/ChangeLog
>index 59fc2acae67b97158f9c225f6b888e13a953f0fe..ef9eb26f6272e308203ae49db2b7fec24bbc616d 100644
>--- a/JSTests/ChangeLog
>+++ b/JSTests/ChangeLog
>@@ -1,3 +1,12 @@
>+2019-06-07  Yusuke Suzuki  <ysuzuki@apple.com>
>+
>+        [JSC] Use mergePrediction in ValuePow prediction propagation
>+        https://bugs.webkit.org/show_bug.cgi?id=198648
>+
>+        Reviewed by NOBODY (OOPS!).
>+
>+        * stress/prediction-propagation-should-use-merge-prediction-for-value-pow.js: Added.
>+
> 2019-06-05  Justin Michaud  <justin_michaud@apple.com>
> 
>         [WASM-References] Add support for Anyref tables, Table.get and Table.set (for Anyref only).
>diff --git a/JSTests/stress/prediction-propagation-should-use-merge-prediction-for-value-pow.js b/JSTests/stress/prediction-propagation-should-use-merge-prediction-for-value-pow.js
>new file mode 100644
>index 0000000000000000000000000000000000000000..e70325f3c2ad4b6be2a1359de545cbc28e6a876b
>--- /dev/null
>+++ b/JSTests/stress/prediction-propagation-should-use-merge-prediction-for-value-pow.js
>@@ -0,0 +1,3 @@
>+for (let i = 0; i < 100000; i = i + 1 | 0) {
>+    if (i ** 2) {}
>+}

Actions: View | Formatted Diff | Diff

Attachments on bug 198648: 371572 | 371701