[webkit-changes] [227826] branches/safari-605-branch

Tue, 30 Jan 2018 10:51:43 -0800

Title: [227826] branches/safari-605-branch

Diff

Modified: branches/safari-605-branch/JSTests/ChangeLog (227825 => 227826)


--- branches/safari-605-branch/JSTests/ChangeLog	2018-01-30 18:51:18 UTC (rev 227825)
+++ branches/safari-605-branch/JSTests/ChangeLog	2018-01-30 18:51:20 UTC (rev 227826)
@@ -1,3 +1,29 @@
+2018-01-30  Jason Marcell  <[email protected]>
+
+        Cherry-pick r227716. rdar://problem/37019460
+
+    2018-01-27  Yusuke Suzuki  <[email protected]>
+
+            DFG strength reduction fails to convert NumberToStringWithValidRadixConstant for 0 to constant '0'
+            https://bugs.webkit.org/show_bug.cgi?id=182213
+
+            Reviewed by Mark Lam.
+
+            * stress/int32-min-to-string.js: Added.
+            (shouldBe):
+            (test2):
+            (test4):
+            (test8):
+            (test16):
+            (test32):
+            * stress/zero-to-string.js: Added.
+            (shouldBe):
+            (test2):
+            (test4):
+            (test8):
+            (test16):
+            (test32):
+
 2018-01-25  Jason Marcell  <[email protected]>
 
         Cherry-pick r227410. rdar://problem/36873404

Added: branches/safari-605-branch/JSTests/stress/int32-min-to-string.js (0 => 227826)


--- branches/safari-605-branch/JSTests/stress/int32-min-to-string.js	                        (rev 0)
+++ branches/safari-605-branch/JSTests/stress/int32-min-to-string.js	2018-01-30 18:51:20 UTC (rev 227826)
@@ -0,0 +1,43 @@
+function shouldBe(actual, expected)
+{
+    if (actual !== expected)
+        throw new Error('bad value: ' + actual);
+}
+
+function test2()
+{
+    return (-2147483648).toString(2);
+}
+noInline(test2);
+
+function test4()
+{
+    return (-2147483648).toString(4);
+}
+noInline(test4);
+
+function test8()
+{
+    return (-2147483648).toString(8);
+}
+noInline(test8);
+
+function test16()
+{
+    return (-2147483648).toString(16);
+}
+noInline(test16);
+
+function test32()
+{
+    return (-2147483648).toString(32);
+}
+noInline(test32);
+
+for (var i = 0; i < 1e5; ++i) {
+    shouldBe(test2(), '-10000000000000000000000000000000');
+    shouldBe(test4(), '-2000000000000000');
+    shouldBe(test8(), '-20000000000');
+    shouldBe(test16(), '-80000000');
+    shouldBe(test32(), '-2000000');
+}

Added: branches/safari-605-branch/JSTests/stress/zero-to-string.js (0 => 227826)


--- branches/safari-605-branch/JSTests/stress/zero-to-string.js	                        (rev 0)
+++ branches/safari-605-branch/JSTests/stress/zero-to-string.js	2018-01-30 18:51:20 UTC (rev 227826)
@@ -0,0 +1,43 @@
+function shouldBe(actual, expected)
+{
+    if (actual !== expected)
+        throw new Error('bad value: ' + actual);
+}
+
+function test2()
+{
+    return 0..toString(2);
+}
+noInline(test2);
+
+function test4()
+{
+    return 0..toString(4);
+}
+noInline(test4);
+
+function test8()
+{
+    return 0..toString(8);
+}
+noInline(test8);
+
+function test16()
+{
+    return 0..toString(16);
+}
+noInline(test16);
+
+function test32()
+{
+    return 0..toString(32);
+}
+noInline(test32);
+
+for (var i = 0; i < 1e5; ++i) {
+    shouldBe(test2(), '0');
+    shouldBe(test4(), '0');
+    shouldBe(test8(), '0');
+    shouldBe(test16(), '0');
+    shouldBe(test32(), '0');
+}

Modified: branches/safari-605-branch/Source/_javascript_Core/ChangeLog (227825 => 227826)


--- branches/safari-605-branch/Source/_javascript_Core/ChangeLog	2018-01-30 18:51:18 UTC (rev 227825)
+++ branches/safari-605-branch/Source/_javascript_Core/ChangeLog	2018-01-30 18:51:20 UTC (rev 227826)
@@ -1,5 +1,27 @@
 2018-01-30  Jason Marcell  <[email protected]>
 
+        Cherry-pick r227716. rdar://problem/37019460
+
+    2018-01-27  Yusuke Suzuki  <[email protected]>
+
+            DFG strength reduction fails to convert NumberToStringWithValidRadixConstant for 0 to constant '0'
+            https://bugs.webkit.org/show_bug.cgi?id=182213
+
+            Reviewed by Mark Lam.
+
+            toStringWithRadixInternal is originally used for the slow path if the given value is larger than radix or negative.
+            As a result, it does not accept 0 correctly, and produces an empty string. Since DFGStrengthReductionPhase uses
+            this function, it accidentally converts NumberToStringWithValidRadixConstant(0, radix) to an empty string.
+            This patch fixes toStringWithRadixInternal to accept 0. This change fixes twitch.tv's issue.
+
+            We also add a careful cast to avoid `-INT32_MIN`. It does not produce incorrect value in x86 in practice,
+            but it is UB, and a compiler may assume that the given value is never INT32_MIN and could do an incorrect optimization.
+
+            * runtime/NumberPrototype.cpp:
+            (JSC::toStringWithRadixInternal):
+
+2018-01-30  Jason Marcell  <[email protected]>
+
         Cherry-pick r227644. rdar://problem/37019367
 
     2018-01-25  Mark Lam  <[email protected]>

Modified: branches/safari-605-branch/Source/_javascript_Core/runtime/NumberPrototype.cpp (227825 => 227826)


--- branches/safari-605-branch/Source/_javascript_Core/runtime/NumberPrototype.cpp	2018-01-30 18:51:18 UTC (rev 227825)
+++ branches/safari-605-branch/Source/_javascript_Core/runtime/NumberPrototype.cpp	2018-01-30 18:51:20 UTC (rev 227826)
@@ -365,15 +365,17 @@
     uint32_t positiveNumber = number;
     if (number < 0) {
         negative = true;
-        positiveNumber = -number;
+        positiveNumber = static_cast<uint32_t>(-static_cast<int64_t>(number));
     }
 
-    while (positiveNumber) {
+    // Always loop at least once, to emit at least '0'.
+    do {
         uint32_t index = positiveNumber % radix;
         ASSERT(index < sizeof(radixDigits));
         *--p = static_cast<LChar>(radixDigits[index]);
         positiveNumber /= radix;
-    }
+    } while (positiveNumber);
+
     if (negative)
         *--p = '-';
 

_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes

Reply via email to