Changeset 137963 in webkit for trunk/Source/JavaScriptCore/dfg/DFGNodeFlags.h

Timestamp:

Dec 17, 2012, 5:35:13 PM (13 years ago)

Author:

[email protected]

Message:

DFG is too aggressive with eliding overflow checks in loops
​https://bugs.webkit.org/show_bug.cgi?id=105226

Reviewed by Mark Hahnenberg and Oliver Hunt.

Source/JavaScriptCore:

If we see a variable's live range cross basic block boundaries, conservatively assume that it may
be part of a data-flow back-edge, and as a result, we may have entirely integer operations that
could lead to the creation of an integer that is out of range of 2<sup>52 (the significand of a double
float). This does not seem to regress any of the benchmarks we care about, and it fixes the bug.

In future we may want to actually look at whether or not there was a data-flow back-edge instead
of being super conservative about it. But we have no evidence, yet, that this would help us on
real code.</sup>

• dfg/DFGNodeFlags.h:

(DFG):

• dfg/DFGPredictionPropagationPhase.cpp:

(JSC::DFG::PredictionPropagationPhase::propagate):

LayoutTests:

• fast/js/dfg-int-overflow-in-loop-expected.txt: Added.
• fast/js/dfg-int-overflow-in-loop.html: Added.
• fast/js/jsc-test-list:
• fast/js/script-tests/dfg-int-overflow-in-loop.js: Added.

(foo):

File:

• trunk/Source/JavaScriptCore/dfg/DFGNodeFlags.h (modified) (1 diff)

trunk/Source/JavaScriptCore/dfg/DFGNodeFlags.h

@@ -55 +55 @@
 #define NodeBackPropMask         0x7C00
 #define NodeUseBottom            0x0000
-#define NodeUsedAsNumber          0x400 // The result of this computation may be used in a context that observes fractional results.
+#define NodeUsedAsNumber          0x400 // The result of this computation may be used in a context that observes fractional, or bigger-than-int32, results.
 #define NodeNeedsNegZero          0x800 // The result of this computation may be used in a context that observes -0.
 #define NodeUsedAsOther          0x1000 // The result of this computation may be used in a context that distinguishes between NaN and other things (like undefined).