Title: [244763] trunk/Source/_javascript_Core
- Revision
- 244763
- Author
- [email protected]
- Date
- 2019-04-29 19:54:08 -0700 (Mon, 29 Apr 2019)
Log Message
Unreivewed, fix FTL implementation of r244760
https://bugs.webkit.org/show_bug.cgi?id=197362
Reviewed by Saam Barati.
Looked with Saam. ValueFromBlock from double case block was overridden by NaN thing now.
* ftl/FTLLowerDFGToB3.cpp:
(JSC::FTL::DFG::LowerDFGToB3::compileNormalizeMapKey):
Modified Paths
Diff
Modified: trunk/Source/_javascript_Core/ChangeLog (244762 => 244763)
--- trunk/Source/_javascript_Core/ChangeLog 2019-04-29 23:55:51 UTC (rev 244762)
+++ trunk/Source/_javascript_Core/ChangeLog 2019-04-30 02:54:08 UTC (rev 244763)
@@ -1,5 +1,17 @@
2019-04-29 Yusuke Suzuki <[email protected]>
+ Unreivewed, fix FTL implementation of r244760
+ https://bugs.webkit.org/show_bug.cgi?id=197362
+
+ Reviewed by Saam Barati.
+
+ Looked with Saam. ValueFromBlock from double case block was overridden by NaN thing now.
+
+ * ftl/FTLLowerDFGToB3.cpp:
+ (JSC::FTL::DFG::LowerDFGToB3::compileNormalizeMapKey):
+
+2019-04-29 Yusuke Suzuki <[email protected]>
+
normalizeMapKey should normalize NaN to one PureNaN bit pattern to make MapHash same
https://bugs.webkit.org/show_bug.cgi?id=197362
Modified: trunk/Source/_javascript_Core/ftl/FTLLowerDFGToB3.cpp (244762 => 244763)
--- trunk/Source/_javascript_Core/ftl/FTLLowerDFGToB3.cpp 2019-04-29 23:55:51 UTC (rev 244762)
+++ trunk/Source/_javascript_Core/ftl/FTLLowerDFGToB3.cpp 2019-04-30 02:54:08 UTC (rev 244763)
@@ -9828,6 +9828,7 @@
m_out.appendTo(notNaNCase, convertibleCase);
LValue integerValue = m_out.doubleToInt(doubleValue);
LValue integerValueConvertedToDouble = m_out.intToDouble(integerValue);
+ ValueFromBlock doubleResult = m_out.anchor(key);
m_out.branch(m_out.doubleNotEqualOrUnordered(doubleValue, integerValueConvertedToDouble), unsure(continuation), unsure(convertibleCase));
m_out.appendTo(convertibleCase, continuation);
@@ -9835,7 +9836,7 @@
m_out.jump(continuation);
m_out.appendTo(continuation, lastNext);
- setJSValue(m_out.phi(Int64, fastResult, normalizedNaNResult, boxedIntResult));
+ setJSValue(m_out.phi(Int64, fastResult, normalizedNaNResult, doubleResult, boxedIntResult));
}
void compileGetMapBucket()
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
