Bug 213176 – Add wasm regresion test for loop

• Component: JavaScriptCore
• Status: RESOLVED FIXED

[Yusuke Suzuki]

https://twitter.com/tkihira/status/1272041643990937600

(module
  (func $test (param f64) (result f64)
    f64.const 1.0
    f64.const 2.0
    
    local.get 0
    i64.reinterpret_f64
    i32.wrap_i64

    i32.const 4096
    i32.lt_u
    select
)
(export "test" (func $test)))

shows bug in iOS11, not in iOS13 according to the above tweet.
It is worth adding this to our stress testing mechanism to ensure this regression does not happen in the future.

[Yusuke Suzuki]

iOS11 => no OSR entry from the loop. There is BBQ & OMG and BBQ uses B3 O1.
iOS13 => there is OSR entry from the loop. There are three tiers, LLInt, BBQ, and OMG. And BBQ uses Air instead of B3 O1.

[Takuo Kihira]

Thanks for filing, Yusuke!

It should return either 1.0 or 2.0 (usually 2.0), but on the Mobile Safari in iOS 11.4.1 it returns 0 always.

When I changed `i32.const 4096` to `i32.const 4095` (or less) it works well suddenly.

[Takuo Kihira]

As far as I checked, any inputs will occur the behavior always.

If you need arguments, 0.5 would a good input to reproduce at least in my env.

[Yusuke Suzuki]

Looked into the test more, and I guess this is https://bugs.webkit.org/show_bug.cgi?id=198106

[Yusuke Suzuki]

(In reply to Yusuke Suzuki from comment #4)
> Looked into the test more, and I guess this is
> https://bugs.webkit.org/show_bug.cgi?id=198106

Yes, I think this is definitely this one. It is nice that we can have one more regression test :)

[Yusuke Suzuki]

Created attachment 401852 [details]
Patch

[EWS]

Committed r263011: <https://trac.webkit.org/changeset/263011>

All reviewed patches have been landed. Closing bug and clearing flags on attachment 401852 [details].

[Radar WebKit Bug Importer]

<rdar://problem/64343185>