105226 2012-12-17 16:06:25 -0800 DFG is too aggressive with eliding overflow checks in loops 2012-12-17 17:37:23 -0800 1 1 1 Unclassified WebKit JavaScriptCore 528+ (Nightly build) All All RESOLVED FIXED P2 Normal --- 1 fpizlo fpizlo barraclough ggaren mark.lam mhahnenberg msaboff oliver sam oldest_to_newest 793123 0 fpizlo 2012-12-17 16:06:25 -0800 Example: function foo(a) { var x = a; // Make sure that this is the loop where we do OSR entry. for (var i = 0; i < 100000; ++i) x += 1; // Now trigger overflow that is so severe that the floating point result would be different than the bigint result. for (var i = 0; i < 160097152; ++i) x += 2147483647; return x | 0; } Calling foo(0) will return different results in the baseline JIT versus the DFG JIT. The baseline JIT will be right. 793127 1 179822 fpizlo 2012-12-17 16:09:28 -0800 Created attachment 179822 the patch 793203 2 fpizlo 2012-12-17 17:37:23 -0800 Landed in http://trac.webkit.org/changeset/137963 179822 2012-12-17 16:09:28 -0800 2012-12-17 16:10:00 -0800 the patch overflow.patch text/plain 3673 fpizlo SW5kZXg6IFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9DaGFuZ2VMb2cKPT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gU291 cmNlL0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwkocmV2aXNpb24gMTM3OTU1KQorKysgU291cmNl L0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwkod29ya2luZyBjb3B5KQpAQCAtMSwzICsxLDI0IEBA CisyMDEyLTEyLTE3ICBGaWxpcCBQaXpsbyAgPGZwaXpsb0BhcHBsZS5jb20+CisKKyAgICAgICAg REZHIGlzIHRvbyBhZ2dyZXNzaXZlIHdpdGggZWxpZGluZyBvdmVyZmxvdyBjaGVja3MgaW4gbG9v cHMKKyAgICAgICAgaHR0cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTEwNTIy NgorCisgICAgICAgIFJldmlld2VkIGJ5IE5PQk9EWSAoT09QUyEpLgorCisgICAgICAgIElmIHdl IHNlZSBhIHZhcmlhYmxlJ3MgbGl2ZSByYW5nZSBjcm9zcyBiYXNpYyBibG9jayBib3VuZGFyaWVz LCBjb25zZXJ2YXRpdmVseSBhc3N1bWUgdGhhdCBpdCBtYXkKKyAgICAgICAgYmUgcGFydCBvZiBh IGRhdGEtZmxvdyBiYWNrLWVkZ2UsIGFuZCBhcyBhIHJlc3VsdCwgd2UgbWF5IGhhdmUgZW50aXJl bHkgaW50ZWdlciBvcGVyYXRpb25zIHRoYXQKKyAgICAgICAgY291bGQgbGVhZCB0byB0aGUgY3Jl YXRpb24gb2YgYW4gaW50ZWdlciB0aGF0IGlzIG91dCBvZiByYW5nZSBvZiAyXjUyICh0aGUgc2ln bmlmaWNhbmQgb2YgYSBkb3VibGUKKyAgICAgICAgZmxvYXQpLiBUaGlzIGRvZXMgbm90IHNlZW0g dG8gcmVncmVzcyBhbnkgb2YgdGhlIGJlbmNobWFya3Mgd2UgY2FyZSBhYm91dCwgYW5kIGl0IGZp eGVzIHRoZSBidWcuCisgICAgICAgIAorICAgICAgICBJbiBmdXR1cmUgd2UgbWF5IHdhbnQgdG8g YWN0dWFsbHkgbG9vayBhdCB3aGV0aGVyIG9yIG5vdCB0aGVyZSB3YXMgYSBkYXRhLWZsb3cgYmFj ay1lZGdlIGluc3RlYWQKKyAgICAgICAgb2YgYmVpbmcgc3VwZXIgY29uc2VydmF0aXZlIGFib3V0 IGl0LiBCdXQgd2UgaGF2ZSBubyBldmlkZW5jZSwgeWV0LCB0aGF0IHRoaXMgd291bGQgaGVscCB1 cyBvbgorICAgICAgICByZWFsIGNvZGUuCisKKyAgICAgICAgKiBkZmcvREZHTm9kZUZsYWdzLmg6 CisgICAgICAgIChERkcpOgorICAgICAgICAqIGRmZy9ERkdQcmVkaWN0aW9uUHJvcGFnYXRpb25Q aGFzZS5jcHA6CisgICAgICAgIChKU0M6OkRGRzo6UHJlZGljdGlvblByb3BhZ2F0aW9uUGhhc2U6 OnByb3BhZ2F0ZSk6CisKIDIwMTItMTItMTcgIEZpbGlwIFBpemxvICA8ZnBpemxvQGFwcGxlLmNv bT4KIAogICAgICAgICBqYXZhc2NyaXB0IGludGVnZXIgb3ZlcmZsb3cKSW5kZXg6IFNvdXJjZS9K YXZhU2NyaXB0Q29yZS9kZmcvREZHTm9kZUZsYWdzLmgKPT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gU291cmNlL0ph dmFTY3JpcHRDb3JlL2RmZy9ERkdOb2RlRmxhZ3MuaAkocmV2aXNpb24gMTM3OTUxKQorKysgU291 cmNlL0phdmFTY3JpcHRDb3JlL2RmZy9ERkdOb2RlRmxhZ3MuaAkod29ya2luZyBjb3B5KQpAQCAt NTQsNyArNTQsNyBAQCBuYW1lc3BhY2UgSlNDIHsgbmFtZXNwYWNlIERGRyB7CiAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgIAogI2RlZmluZSBOb2RlQmFja1Byb3BNYXNrICAgICAgICAg MHg3QzAwCiAjZGVmaW5lIE5vZGVVc2VCb3R0b20gICAgICAgICAgICAweDAwMDAKLSNkZWZpbmUg Tm9kZVVzZWRBc051bWJlciAgICAgICAgICAweDQwMCAvLyBUaGUgcmVzdWx0IG9mIHRoaXMgY29t cHV0YXRpb24gbWF5IGJlIHVzZWQgaW4gYSBjb250ZXh0IHRoYXQgb2JzZXJ2ZXMgZnJhY3Rpb25h bCByZXN1bHRzLgorI2RlZmluZSBOb2RlVXNlZEFzTnVtYmVyICAgICAgICAgIDB4NDAwIC8vIFRo ZSByZXN1bHQgb2YgdGhpcyBjb21wdXRhdGlvbiBtYXkgYmUgdXNlZCBpbiBhIGNvbnRleHQgdGhh dCBvYnNlcnZlcyBmcmFjdGlvbmFsLCBvciBiaWdnZXItdGhhbi1pbnQzMiwgcmVzdWx0cy4KICNk ZWZpbmUgTm9kZU5lZWRzTmVnWmVybyAgICAgICAgICAweDgwMCAvLyBUaGUgcmVzdWx0IG9mIHRo aXMgY29tcHV0YXRpb24gbWF5IGJlIHVzZWQgaW4gYSBjb250ZXh0IHRoYXQgb2JzZXJ2ZXMgLTAu CiAjZGVmaW5lIE5vZGVVc2VkQXNPdGhlciAgICAgICAgICAweDEwMDAgLy8gVGhlIHJlc3VsdCBv ZiB0aGlzIGNvbXB1dGF0aW9uIG1heSBiZSB1c2VkIGluIGEgY29udGV4dCB0aGF0IGRpc3Rpbmd1 aXNoZXMgYmV0d2VlbiBOYU4gYW5kIG90aGVyIHRoaW5ncyAobGlrZSB1bmRlZmluZWQpLgogI2Rl ZmluZSBOb2RlVXNlZEFzVmFsdWUgICAgICAgICAgKE5vZGVVc2VkQXNOdW1iZXIgfCBOb2RlTmVl ZHNOZWdaZXJvIHwgTm9kZVVzZWRBc090aGVyKQpJbmRleDogU291cmNlL0phdmFTY3JpcHRDb3Jl L2RmZy9ERkdQcmVkaWN0aW9uUHJvcGFnYXRpb25QaGFzZS5jcHAKPT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gU291 cmNlL0phdmFTY3JpcHRDb3JlL2RmZy9ERkdQcmVkaWN0aW9uUHJvcGFnYXRpb25QaGFzZS5jcHAJ KHJldmlzaW9uIDEzNzk1MSkKKysrIFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9kZmcvREZHUHJlZGlj dGlvblByb3BhZ2F0aW9uUGhhc2UuY3BwCSh3b3JraW5nIGNvcHkpCkBAIC0yMTEsNyArMjExLDEz IEBAIHByaXZhdGU6CiAgICAgICAgIGNhc2UgU2V0TG9jYWw6IHsKICAgICAgICAgICAgIFZhcmlh YmxlQWNjZXNzRGF0YSogdmFyaWFibGVBY2Nlc3NEYXRhID0gbm9kZS52YXJpYWJsZUFjY2Vzc0Rh dGEoKTsKICAgICAgICAgICAgIGNoYW5nZWQgfD0gdmFyaWFibGVBY2Nlc3NEYXRhLT5wcmVkaWN0 KG1fZ3JhcGhbbm9kZS5jaGlsZDEoKV0ucHJlZGljdGlvbigpKTsKLSAgICAgICAgICAgIGNoYW5n ZWQgfD0gbV9ncmFwaFtub2RlLmNoaWxkMSgpXS5tZXJnZUZsYWdzKHZhcmlhYmxlQWNjZXNzRGF0 YS0+ZmxhZ3MoKSk7CisKKyAgICAgICAgICAgIC8vIEFzc3VtZSBjb25zZXJ2YXRpdmVseSB0aGF0 IGEgU2V0TG9jYWwgaW1wbGllcyB0aGF0IHRoZSB2YWx1ZSBtYXkgZmxvdyB0aHJvdWdoIGEgbG9v cCwKKyAgICAgICAgICAgIC8vIGFuZCBzbyB3ZSB3b3VsZCBoYXZlIG92ZXJmbG93IGxlYWRpbmcg dG8gdGhlIHByb2dyYW0gIm9ic2VydmluZyIgbnVtYmVycyBldmVuIGlmIGFsbAorICAgICAgICAg ICAgLy8gdXNlcnMgb2YgdGhlIHZhbHVlIGFyZSBkb2luZyB0b0ludDMyLiBJdCBtaWdodCBiZSB3 b3J0aHdoaWxlIHRvIHJldmlzaXQgdGhpcyBhdCBzb21lCisgICAgICAgICAgICAvLyBwb2ludCBh bmQgYWN0dWFsbHkgY2hlY2sgaWYgdGhlIGRhdGEgZmxvdyBpbnZvbHZlcyBsb29wcywgYnV0IHJp Z2h0IG5vdyBJIGRvbid0IHRoaW5rCisgICAgICAgICAgICAvLyB3ZSBoYXZlIGV2aWRlbmNlIHRo YXQgdGhpcyB3b3VsZCBiZSBiZW5lZmljaWFsIGZvciBiZW5jaG1hcmtzLgorICAgICAgICAgICAg Y2hhbmdlZCB8PSBtX2dyYXBoW25vZGUuY2hpbGQxKCldLm1lcmdlRmxhZ3ModmFyaWFibGVBY2Nl c3NEYXRhLT5mbGFncygpIHwgTm9kZVVzZWRBc051bWJlcik7CiAgICAgICAgICAgICBicmVhazsK ICAgICAgICAgfQogICAgICAgICAgICAgCg==