RESOLVED FIXED 198648
[JSC] Use mergePrediction in ValuePow prediction propagation
https://bugs.webkit.org/show_bug.cgi?id=198648
Summary [JSC] Use mergePrediction in ValuePow prediction propagation
Yusuke Suzuki
Reported 2019-06-07 00:44:01 PDT
Currently, we are accidentally using setPrediction. This is wrong since prediction propagation (not processInvariant) must extend the speculation types to ensure we eventually reach to the fixed point. setPrediction can discard previously configured predictions, can lead to oscillation potentially.
Attachments
Patch (3.13 KB, patch)
2019-06-07 00:47 PDT, Yusuke Suzuki
no flags
Patch (3.20 KB, patch)
2019-06-08 21:42 PDT, Yusuke Suzuki
no flags
Yusuke Suzuki
Comment 1 2019-06-07 00:47:14 PDT
Yusuke Suzuki
Comment 2 2019-06-07 00:49:03 PDT
Yusuke Suzuki
Comment 3 2019-06-07 01:00:08 PDT
Comment on attachment 371572 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=371572&action=review > Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp:291 > + changed |= mergePrediction(SpecBytecodeDouble | SpecBigInt); And this also does not propagate "change" :)
Caio Lima
Comment 4 2019-06-07 02:01:54 PDT
Comment on attachment 371572 [details] Patch Nice catch! Informal r+.
Yusuke Suzuki
Comment 5 2019-06-08 21:42:17 PDT
Saam Barati
Comment 6 2019-06-08 23:35:47 PDT
Comment on attachment 371701 [details] Patch r=me
Yusuke Suzuki
Comment 7 2019-06-08 23:39:12 PDT
Comment on attachment 371701 [details] Patch Thanks! :)
WebKit Commit Bot
Comment 8 2019-06-09 00:09:53 PDT
Comment on attachment 371701 [details] Patch Clearing flags on attachment: 371701 Committed r246237: <https://trac.webkit.org/changeset/246237>
WebKit Commit Bot
Comment 9 2019-06-09 00:09:55 PDT
All reviewed patches have been landed. Closing bug.
Note You need to log in before you can comment on or make changes to this bug.