DFG is too aggressive with eliding overflow checks in loops

https://bugs.webkit.org/show_bug.cgi?id=105226

Reviewed by Mark Hahnenberg and Oliver Hunt.

Source/JavaScriptCore:

If we see a variable's live range cross basic block boundaries, conservatively assume that it may
be part of a data-flow back-edge, and as a result, we may have entirely integer operations that
could lead to the creation of an integer that is out of range of 2^52 (the significand of a double
float). This does not seem to regress any of the benchmarks we care about, and it fixes the bug.

In future we may want to actually look at whether or not there was a data-flow back-edge instead
of being super conservative about it. But we have no evidence, yet, that this would help us on
real code.

* dfg/DFGNodeFlags.h:
(DFG):
* dfg/DFGPredictionPropagationPhase.cpp:
(JSC::DFG::PredictionPropagationPhase::propagate):

LayoutTests:

* fast/js/dfg-int-overflow-in-loop-expected.txt: Added.
* fast/js/dfg-int-overflow-in-loop.html: Added.
* fast/js/jsc-test-list:
* fast/js/script-tests/dfg-int-overflow-in-loop.js: Added.
(foo):

Change-Id: I9df2d6d17ba404802456f4e2da313e47f0f4f62e
git-svn-id: http://svn.webkit.org/repository/webkit/trunk@137963 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Reviewed-by: Jocelyn Turcotte <jocelyn.turcotte@digia.com>

0 files changed, 0 insertions, 0 deletions