Changeset 240223 in webkit


Ignore:
Timestamp:
Jan 20, 2019 7:54:17 PM (5 years ago)
Author:
sbarati@apple.com
Message:

JSTests:
MovHint must merge NodeBytecodeUsesAsValue for its child
https://bugs.webkit.org/show_bug.cgi?id=186916
<rdar://problem/41396612>

Reviewed by Yusuke Suzuki.

  • stress/arith-abs-to-arith-negate-range-optimizaton.js:
  • stress/movhint-backwards-propagation-must-merge-use-as-value.js: Added.

Source/JavaScriptCore:
MovHint must merge NodeBytecodeUsesAsValue for its child in backwards propagation
https://bugs.webkit.org/show_bug.cgi?id=186916
<rdar://problem/41396612>

Reviewed by Yusuke Suzuki.

Otherwise, we may not think we care about the non-integral part in
a division (or perhaps overflow in an add, etc). Consider a program
like this:

return a / b

That gets compiled to:
`
a: ArithDiv We don't check that the remainder is zero here.
b: MovHint(@a)
c: ForceOSRExit
d: Unreachable
`

If we don't inform @a that we care about its result in full number
accuracy, it will choose to ignore its non-integral remainder. This
makes sense if *everybody* that all uses of the Div only cared about
the integral part. However, OSR exit is not one of those users. OSR
exit cares about the fractional bits in such a Div.

  • dfg/DFGBackwardsPropagationPhase.cpp:

(JSC::DFG::BackwardsPropagationPhase::propagate):

Location:
trunk
Files:
2 added
4 edited

Legend:

Unmodified
Added
Removed
  • trunk/JSTests/ChangeLog

    r240220 r240223  
     12019-01-20  Saam Barati  <sbarati@apple.com>
     2
     3        MovHint must merge NodeBytecodeUsesAsValue for its child
     4        https://bugs.webkit.org/show_bug.cgi?id=186916
     5        <rdar://problem/41396612>
     6
     7        Reviewed by Yusuke Suzuki.
     8
     9        * stress/arith-abs-to-arith-negate-range-optimizaton.js:
     10        * stress/movhint-backwards-propagation-must-merge-use-as-value.js: Added.
     11
    1122019-01-20  Yusuke Suzuki  <ysuzuki@apple.com>
    213
  • trunk/JSTests/stress/arith-abs-to-arith-negate-range-optimizaton.js

    r228513 r240223  
    234234        }
    235235    }
    236     if (numberOfDFGCompiles(opaqueUncheckedBetweenIntMinInclusiveAndZeroExclusive) > 1) {
     236    if (numberOfDFGCompiles(opaqueUncheckedBetweenIntMinInclusiveAndZeroExclusive) > 2) {
    237237        throw "Failed optimizing testUncheckedBetweenIntMinInclusiveAndZeroExclusive(). None of the tested case need to OSR Exit.";
    238238    }
     
    377377        }
    378378    }
    379     if (numberOfDFGCompiles(opaqueUncheckedLessThanZero) > 1) {
     379    if (numberOfDFGCompiles(opaqueUncheckedLessThanZero) > 2) {
    380380        throw "Failed optimizing testUncheckedLessThanZero(). None of the tested case need to OSR Exit.";
    381381    }
     
    421421        }
    422422    }
    423     if (numberOfDFGCompiles(opaqueUncheckedLessThanOrEqualZero) > 1) {
     423    if (numberOfDFGCompiles(opaqueUncheckedLessThanOrEqualZero) > 2) {
    424424        throw "Failed optimizing testUncheckedLessThanOrEqualZero(). None of the tested case need to OSR Exit.";
    425425    }
  • trunk/Source/JavaScriptCore/ChangeLog

    r240220 r240223  
     12019-01-20  Saam Barati  <sbarati@apple.com>
     2
     3        MovHint must merge NodeBytecodeUsesAsValue for its child in backwards propagation
     4        https://bugs.webkit.org/show_bug.cgi?id=186916
     5        <rdar://problem/41396612>
     6
     7        Reviewed by Yusuke Suzuki.
     8
     9        Otherwise, we may not think we care about the non-integral part in
     10        a division (or perhaps overflow in an add, etc). Consider a program
     11        like this:
     12       
     13        ```return a / b```
     14       
     15        That gets compiled to:
     16        ```
     17        a: ArithDiv // We don't check that the remainder is zero here.
     18        b: MovHint(@a)
     19        c: ForceOSRExit
     20        d: Unreachable
     21        ```
     22       
     23        If we don't inform @a that we care about its result in full number
     24        accuracy, it will choose to ignore its non-integral remainder. This
     25        makes sense if *everybody* that all uses of the Div only cared about
     26        the integral part. However, OSR exit is not one of those users. OSR
     27        exit cares about the fractional bits in such a Div.
     28
     29        * dfg/DFGBackwardsPropagationPhase.cpp:
     30        (JSC::DFG::BackwardsPropagationPhase::propagate):
     31
    1322019-01-20  Yusuke Suzuki  <ysuzuki@apple.com>
    233
  • trunk/Source/JavaScriptCore/dfg/DFGBackwardsPropagationPhase.cpp

    r239980 r240223  
    206206        }
    207207           
    208         case MovHint:
    209208        case Check:
    210209        case CheckVarargs:
Note: See TracChangeset for help on using the changeset viewer.