Bug 198648

Summary: [JSC] Use mergePrediction in ValuePow prediction propagation
Product: WebKit Reporter: Yusuke Suzuki <ysuzuki>
Component: JavaScriptCoreAssignee: Yusuke Suzuki <ysuzuki>
Status: RESOLVED FIXED    
Severity: Normal CC: commit-queue, ews-watchlist, keith_miller, mark.lam, msaboff, saam, ticaiolima, webkit-bug-importer
Priority: P2 Keywords: InRadar
Version: WebKit Nightly Build   
Hardware: Unspecified   
OS: Unspecified   
Attachments:
Description Flags
Patch
none
Patch none

Yusuke Suzuki
Reported 2019-06-07 00:44:01 PDT
Currently, we are accidentally using setPrediction. This is wrong since prediction propagation (not processInvariant) must extend the speculation types to ensure we eventually reach to the fixed point. setPrediction can discard previously configured predictions, can lead to oscillation potentially.
Attachments
Patch (3.13 KB, patch)
2019-06-07 00:47 PDT, Yusuke Suzuki 		no flags
DetailsFormatted DiffDiff
Patch (3.20 KB, patch)
2019-06-08 21:42 PDT, Yusuke Suzuki 		no flags
DetailsFormatted DiffDiff
Show Obsolete (1) View All Add attachment proposed patch, testcase, etc.
Yusuke Suzuki
Comment 1 2019-06-07 00:47:14 PDT
Created attachment 371572 [details] Patch
Yusuke Suzuki
Comment 2 2019-06-07 00:49:03 PDT
<rdar://problem/51472985>
Yusuke Suzuki
Comment 3 2019-06-07 01:00:08 PDT
Comment on attachment 371572 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=371572&action=review > Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp:291 > + changed |= mergePrediction(SpecBytecodeDouble | SpecBigInt); And this also does not propagate "change" :)
Caio Lima
Comment 4 2019-06-07 02:01:54 PDT
Comment on attachment 371572 [details] Patch Nice catch! Informal r+.
Yusuke Suzuki
Comment 5 2019-06-08 21:42:17 PDT
Created attachment 371701 [details] Patch
Saam Barati
Comment 6 2019-06-08 23:35:47 PDT
Comment on attachment 371701 [details] Patch r=me
Yusuke Suzuki
Comment 7 2019-06-08 23:39:12 PDT
Comment on attachment 371701 [details] Patch Thanks! :)
WebKit Commit Bot
Comment 8 2019-06-09 00:09:53 PDT
Comment on attachment 371701 [details] Patch Clearing flags on attachment: 371701 Committed r246237: <https://trac.webkit.org/changeset/246237>
WebKit Commit Bot
Comment 9 2019-06-09 00:09:55 PDT
All reviewed patches have been landed. Closing bug.
Note You need to log in before you can comment on or make changes to this bug.