Changeset 239595 in webkit for trunk/Source/JavaScriptCore/dfg/DFGIntegerRangeOptimizationPhase.cpp

Timestamp:

Jan 3, 2019, 9:58:32 AM (6 years ago)

Author:

[email protected]

Message:

DFG IntegerRangeOptimization phase exceeding loop limit shouldn't ASSERT
​https://bugs.webkit.org/show_bug.cgi?id=193094

Reviewed by Saam Barati.

Removed this debug only ASSERT as one can construct test cases that will exceed the giveUpThreshold
amount. This can be done with a large switch statement with at least one const or variable case
clause. Such code bytecompiles to compare / jtrue sequences. Increasing the giveUpThreshold count
doesn't help with the eventual code generated as B3 has optimizations to coalesce compare / branch
code sequences even when we don't run the IntegerRangeOptimization phase.

• dfg/DFGIntegerRangeOptimizationPhase.cpp:

File:

• trunk/Source/JavaScriptCore/dfg/DFGIntegerRangeOptimizationPhase.cpp (modified) (1 diff)

trunk/Source/JavaScriptCore/dfg/DFGIntegerRangeOptimizationPhase.cpp

@@ -1093 +1093 @@
             if (m_iterations >= giveUpThreshold) {
                 // This case is not necessarily wrong but it can be a sign that this phase
-                // does not converge.
-                // If you hit this assertion for a legitimate case, update the giveUpThreshold
+                // does not converge. The value giveUpThreshold was chosen emperically based on
+                // current tests and real world JS.
+                // If you hit this case for a legitimate reason, update the giveUpThreshold
                 // to the smallest values that converges.
-                ASSERT_NOT_REACHED();
-
-                // In release, do not risk holding the thread for too long since this phase
-                // is really slow.
+
+                // Do not risk holding the thread for too long since this phase is really slow.
                 return false;
             }