https://twitter.com/tkihira/status/1272041643990937600 (module (func $test (param f64) (result f64) f64.const 1.0 f64.const 2.0 local.get 0 i64.reinterpret_f64 i32.wrap_i64 i32.const 4096 i32.lt_u select ) (export "test" (func $test))) shows bug in iOS11, not in iOS13 according to the above tweet. It is worth adding this to our stress testing mechanism to ensure this regression does not happen in the future.
iOS11 => no OSR entry from the loop. There is BBQ & OMG and BBQ uses B3 O1. iOS13 => there is OSR entry from the loop. There are three tiers, LLInt, BBQ, and OMG. And BBQ uses Air instead of B3 O1.
Thanks for filing, Yusuke! It should return either 1.0 or 2.0 (usually 2.0), but on the Mobile Safari in iOS 11.4.1 it returns 0 always. When I changed `i32.const 4096` to `i32.const 4095` (or less) it works well suddenly.
As far as I checked, any inputs will occur the behavior always. If you need arguments, 0.5 would a good input to reproduce at least in my env.
Looked into the test more, and I guess this is https://bugs.webkit.org/show_bug.cgi?id=198106
(In reply to Yusuke Suzuki from comment #4) > Looked into the test more, and I guess this is > https://bugs.webkit.org/show_bug.cgi?id=198106 Yes, I think this is definitely this one. It is nice that we can have one more regression test :)
Created attachment 401852 [details] Patch
Committed r263011: <https://trac.webkit.org/changeset/263011> All reviewed patches have been landed. Closing bug and clearing flags on attachment 401852 [details].
<rdar://problem/64343185>