Changeset 246237 in webkit

Timestamp:

Jun 9, 2019, 12:09:48 AM (7 years ago)

Author:

ysuzuki@apple.com

Message:

[JSC] Use mergePrediction in ValuePow prediction propagation
​https://bugs.webkit.org/show_bug.cgi?id=198648

Reviewed by Saam Barati.

JSTests:

• stress/prediction-propagation-should-use-merge-prediction-for-value-pow.js: Added.

Source/JavaScriptCore:

We are accidentally using setPrediction. This is wrong since prediction propagation (not processInvariant)
must extend the speculation types to ensure we eventually reach to the fixed point. setPrediction can discard
previously configured predictions, can lead to oscillation potentially. Use mergePrediction instead.

• dfg/DFGPredictionPropagationPhase.cpp:

Location:

trunk

Files:

• JSTests/ChangeLog (modified) (1 diff)
• JSTests/stress/prediction-propagation-should-use-merge-prediction-for-value-pow.js (added)
• Source/JavaScriptCore/ChangeLog (modified) (1 diff)
• Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp (modified) (1 diff)

trunk/JSTests/ChangeLog

@@ +1 @@
+2019-06-09  Yusuke Suzuki  <ysuzuki@apple.com>
+
+        [JSC] Use mergePrediction in ValuePow prediction propagation
+        https://bugs.webkit.org/show_bug.cgi?id=198648
+
+        Reviewed by Saam Barati.
+
+        * stress/prediction-propagation-should-use-merge-prediction-for-value-pow.js: Added.
+
 2019-06-07  Tadeu Zagallo  <tzagallo@apple.com>
 

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2019-06-09  Yusuke Suzuki  <ysuzuki@apple.com>
+
+        [JSC] Use mergePrediction in ValuePow prediction propagation
+        https://bugs.webkit.org/show_bug.cgi?id=198648
+
+        Reviewed by Saam Barati.
+
+        We are accidentally using setPrediction. This is wrong since prediction propagation (not processInvariant)
+        must extend the speculation types to ensure we eventually reach to the fixed point. setPrediction can discard
+        previously configured predictions, can lead to oscillation potentially. Use mergePrediction instead.
+
+        * dfg/DFGPredictionPropagationPhase.cpp:
+
 2019-06-07  Tadeu Zagallo  <tzagallo@apple.com>
 

trunk/Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp

@@ -287 +287 @@
                 else if (isFullNumberOrBooleanSpeculationExpectingDefined(left)
                     && isFullNumberOrBooleanSpeculationExpectingDefined(right))
-                    setPrediction(SpecBytecodeDouble);
+                    changed |= mergePrediction(SpecBytecodeDouble);
                 else
-                    setPrediction(SpecBytecodeDouble | SpecBigInt);
+                    changed |= mergePrediction(SpecBytecodeDouble | SpecBigInt);
             }
             break;