Summary: | DFG's Int52Rep node is inadequate to convert doubles to Int52. | ||
---|---|---|---|
Product: | WebKit | Reporter: | Mark Lam <mark.lam> |
Component: | JavaScriptCore | Assignee: | Mark Lam <mark.lam> |
Status: | RESOLVED INVALID | ||
Severity: | Normal | CC: | benjamin, fpizlo, ggaren, keith_miller, msaboff, saam, webkit-bug-importer |
Priority: | P2 | Keywords: | InRadar |
Version: | WebKit Local Build | ||
Hardware: | Unspecified | ||
OS: | Unspecified | ||
Bug Depends on: | |||
Bug Blocks: | 153019 |
Description
Mark Lam
2016-01-13 22:47:48 PST
I suspect the real problem was that PredictionPropagation was setting absurd values after https://bugs.webkit.org/show_bug.cgi?id=153019. I reverted that change then Filip fixed the whole type prediction some time later. We no longer speculate Int32 for a ArithDiv that produce double. I tried crypto-aes.js on my machine. The only OSR Exit is a legit Overflow on ArithDiv due to a rare int/int producing double. The Div at bc#598 is now producing a double as it should. |