V4 IR: fix type inference.

When a phi-node couldn't be fully typed (e.g., when one of the temps
was not yet typed), VarType was assumed. When a circular dependency
between two phi-nodes occurred, like with a condition inside a loop,
then depending on the ordering of the work-list, the two phi-nodes
could start oscillating between VarType and the correct type.

The fix is to check if one of the temps is not fully typed, and if so,
assume whatever we currently have as the result and have the statement
re-scheduled. Full typing will occur when the temp with the missing
type information is typed.

Change-Id: I950d81fe7fa8272cb37f7eea5b88092d1eb4817e
Reviewed-by: Tor Arne Vestbø <[email protected]>
Reviewed-by: Simon Hausmann <[email protected]>
Reviewed-by: Lars Knoll <[email protected]>

1 files changed, 8 insertions, 0 deletions

diff --git a/src/qml/compiler/qv4ssa.cpp b/src/qml/compiler/qv4ssa.cpp
index a058ed51da..3d6cd442fd 100644
--- a/src/qml/compiler/qv4ssa.cpp
+++ b/src/qml/compiler/qv4ssa.cpp
@@ -1503,11 +1503,19 @@ protected:
         _ty = run(s->d->incoming[0]);
         for (int i = 1, ei = s->d->incoming.size(); i != ei; ++i) {
             TypingResult ty = run(s->d->incoming[i]);
+            if (!ty.fullyTyped && _ty.fullyTyped) {
+                // When one of the temps not fully typed, we already know that we cannot completely type this node.
+                // So, pick the type we calculated upto this point, and wait until the unknown one will be typed.
+                // At that point, this statement will be re-scheduled, and then we can fully type this node.
+                _ty.fullyTyped = false;
+                break;
+            }
             _ty.type |= ty.type;
             _ty.fullyTyped &= ty.fullyTyped;
         }
 
         switch (_ty.type) {
+        case UnknownType:
         case UndefinedType:
         case NullType:
         case BoolType: