[Webkit-unassigned] [Bug 193094] New: DFG IntegerRangeOptimization phase exceeding loop limit shouldn't ASSERT

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=193094

            Bug ID: 193094
           Summary: DFG IntegerRangeOptimization phase exceeding loop
                    limit shouldn't ASSERT
           Product: WebKit
           Version: WebKit Nightly Build
          Hardware: Unspecified
                OS: Unspecified
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: JavaScriptCore
          Assignee: webkit-unassigned at lists.webkit.org
          Reporter: msaboff at apple.com

The current value of 50 for giveUpThreshold in DFGIntegerRangeOptimizationPhase.cpp is somewhat arbitrary.  It works for all our current tests, including benchmarks with real world code.  One can construct test cases that will exceed the threshold.  For example the code:

    const theNumber100 = 100;
    function foo() {
        for (var i = 0; i < 1000; ++i) {
            switch (i + 1000) {
            case 0:
            case 2:
            case 23:
            case 26:
            case 29:
            case 32:
            case 35:
            case 38:
            case 41:
            case 44:
            case 46:
            case 49:
            case 52:
            case 55:
            case 58:
            case 61:
            case theNumber100:
                break;
            }
        }
    }

Due to the sequence of compare & branch byte code generated due to the const, this code takes 53 loop iterations to converge.  Add a few more case statements and the loop count grows higher.  B3 has optimizations to handle this kind of compare and branch code even without running the IntegerRangeOptimization phase.

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-unassigned/attachments/20190103/3adab69c/attachment.html>