[JSC] Use mergePrediction in ValuePow prediction propagation

[Yusuke Suzuki]

Currently, we are accidentally using setPrediction. This is wrong since prediction propagation (not processInvariant) must extend the speculation types to ensure we eventually reach to the fixed point.
setPrediction can discard previously configured predictions, can lead to oscillation potentially.

[Yusuke Suzuki]

Created attachment 371572 [details]
Patch

[Yusuke Suzuki]

<rdar://problem/51472985>

[Yusuke Suzuki]

Comment on attachment 371572 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=371572&action=review

> Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp:291
> +                    changed |= mergePrediction(SpecBytecodeDouble | SpecBigInt);

And this also does not propagate "change" :)

[Caio Lima]

Comment on attachment 371572 [details]
Patch

Nice catch! Informal r+.

[Yusuke Suzuki]

Created attachment 371701 [details]
Patch

[Saam Barati]

Comment on attachment 371701 [details]
Patch

r=me

[Yusuke Suzuki]

Comment on attachment 371701 [details]
Patch

Thanks! :)

[WebKit Commit Bot]

Comment on attachment 371701 [details]
Patch

Clearing flags on attachment: 371701

Committed r246237: <https://trac.webkit.org/changeset/246237>

[WebKit Commit Bot]

All reviewed patches have been landed.  Closing bug.