Title: [239595] trunk/Source/_javascript_Core
- Revision
- 239595
- Author
- [email protected]
- Date
- 2019-01-03 09:58:32 -0800 (Thu, 03 Jan 2019)
Log Message
DFG IntegerRangeOptimization phase exceeding loop limit shouldn't ASSERT
https://bugs.webkit.org/show_bug.cgi?id=193094
Reviewed by Saam Barati.
Removed this debug only ASSERT as one can construct test cases that will exceed the giveUpThreshold
amount. This can be done with a large switch statement with at least one const or variable case
clause. Such code bytecompiles to compare / jtrue sequences. Increasing the giveUpThreshold count
doesn't help with the eventual code generated as B3 has optimizations to coalesce compare / branch
code sequences even when we don't run the IntegerRangeOptimization phase.
* dfg/DFGIntegerRangeOptimizationPhase.cpp:
Modified Paths
Diff
Modified: trunk/Source/_javascript_Core/ChangeLog (239594 => 239595)
--- trunk/Source/_javascript_Core/ChangeLog 2019-01-03 17:44:55 UTC (rev 239594)
+++ trunk/Source/_javascript_Core/ChangeLog 2019-01-03 17:58:32 UTC (rev 239595)
@@ -1,3 +1,18 @@
+2019-01-03 Michael Saboff <[email protected]>
+
+ DFG IntegerRangeOptimization phase exceeding loop limit shouldn't ASSERT
+ https://bugs.webkit.org/show_bug.cgi?id=193094
+
+ Reviewed by Saam Barati.
+
+ Removed this debug only ASSERT as one can construct test cases that will exceed the giveUpThreshold
+ amount. This can be done with a large switch statement with at least one const or variable case
+ clause. Such code bytecompiles to compare / jtrue sequences. Increasing the giveUpThreshold count
+ doesn't help with the eventual code generated as B3 has optimizations to coalesce compare / branch
+ code sequences even when we don't run the IntegerRangeOptimization phase.
+
+ * dfg/DFGIntegerRangeOptimizationPhase.cpp:
+
2019-01-02 Devin Rousso <[email protected]>
Web Inspector: Implement `queryObjects` Command Line API
Modified: trunk/Source/_javascript_Core/dfg/DFGIntegerRangeOptimizationPhase.cpp (239594 => 239595)
--- trunk/Source/_javascript_Core/dfg/DFGIntegerRangeOptimizationPhase.cpp 2019-01-03 17:44:55 UTC (rev 239594)
+++ trunk/Source/_javascript_Core/dfg/DFGIntegerRangeOptimizationPhase.cpp 2019-01-03 17:58:32 UTC (rev 239595)
@@ -1092,13 +1092,12 @@
++m_iterations;
if (m_iterations >= giveUpThreshold) {
// This case is not necessarily wrong but it can be a sign that this phase
- // does not converge.
- // If you hit this assertion for a legitimate case, update the giveUpThreshold
+ // does not converge. The value giveUpThreshold was chosen emperically based on
+ // current tests and real world JS.
+ // If you hit this case for a legitimate reason, update the giveUpThreshold
// to the smallest values that converges.
- ASSERT_NOT_REACHED();
- // In release, do not risk holding the thread for too long since this phase
- // is really slow.
+ // Do not risk holding the thread for too long since this phase is really slow.
return false;
}
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
