Bug 193094 – DFG IntegerRangeOptimization phase exceeding loop limit shouldn't ASSERT

• Status: RESOLVED
• Resolution: FIXED
• Component: JavaScriptCore

[Michael Saboff]

The current value of 50 for giveUpThreshold in DFGIntegerRangeOptimizationPhase.cpp is somewhat arbitrary.  It works for all our current tests, including benchmarks with real world code.  One can construct test cases that will exceed the threshold.  For example the code:

    const theNumber100 = 100;
    function foo() {
        for (var i = 0; i < 1000; ++i) {
            switch (i + 1000) {
            case 0:
            case 2:
            case 23:
            case 26:
            case 29:
            case 32:
            case 35:
            case 38:
            case 41:
            case 44:
            case 46:
            case 49:
            case 52:
            case 55:
            case 58:
            case 61:
            case theNumber100:
                break;
            }
        }
    }

Due to the sequence of compare & branch byte code generated due to the const, this code takes 53 loop iterations to converge.  Add a few more case statements and the loop count grows higher.  B3 has optimizations to handle this kind of compare and branch code even without running the IntegerRangeOptimization phase.

[Michael Saboff]

<rdar://problem/45838655>

[Michael Saboff]

Created attachment 358230 [details]
Patch

[Saam Barati]

Comment on attachment 358230 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=358230&action=review

> Source/JavaScriptCore/dfg/DFGIntegerRangeOptimizationPhase.cpp:1098
>                  // If you hit this assertion for a legitimate case, update the giveUpThreshold
>                  // to the smallest values that converges.

There is no more assertion.

[Michael Saboff]

Comment on attachment 358230 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=358230&action=review

>> Source/JavaScriptCore/dfg/DFGIntegerRangeOptimizationPhase.cpp:1098
>>                  // to the smallest values that converges.
> 
> There is no more assertion.

Fixed.

[Michael Saboff]

Committed r239595: <https://trac.webkit.org/changeset/239595>