799281 - IonMonkey: OSR block ignored for range calculation

Status: NEW

(Core :: JavaScript Engine, defect)

Description

[Sean Stangl [:sstangl]]

In 3d-cube:108, we have the following code:

> [Block 0]
> Constant 0 [range 0,0]
>
> [Block 1]
> Unbox OsrValue [range -inf,inf]
>
> [Block 2]
> Phi(Constant, Unbox) [range 0,0]

which implies that the iteration variable is fixed at 0, when it varies. Range Analysis should give the Phi [-inf,inf], and we should look into asserting some subset of validity for ranges given to phis.

Comment 1

[Hannes Verschore [:h4writer]]

This is done on purpose! A phi that points to an OsrValue is ignored, as it will have the same range as the other operand of the phi. It is not possible for the OsrValue to have another range, because it is derived from the same (JS/bytecode), only it runs in the interpreter/jm.

Comment 2

[Marty Rosenberg [:mjrosenb]]

That is nearly completely correct (unfortunately).  What Sean was pointing out is that the phi where the OSR value gets merged into the code is not in the loop header, but in the loop pre-header, so you can get bounds information which is wrong for the lifetime of the variable defined in the pre-header.