Title: [254188] trunk
- Revision
- 254188
- Author
- sbar...@apple.com
- Date
- 2020-01-07 23:23:30 -0800 (Tue, 07 Jan 2020)
Log Message
AI rule for ValueMod/ValueDiv produce constants with the wrong format when the result can be an int32
https://bugs.webkit.org/show_bug.cgi?id=205906
<rdar://problem/56108519>
Reviewed by Yusuke Suzuki.
JSTests:
* stress/ai-value-div-should-result-in-constant-int-where-possible.js: Added.
(foo.bar.f):
(foo.):
(foo):
* stress/ai-value-mod-should-result-in-constant-int-where-possible.js: Added.
(foo.bar.f):
(foo.):
(foo):
Source/_javascript_Core:
The runtime code for ValueMod and ValueDiv produces an int32 when the result
is of int32 value. However, the AI was saying the result is in double format.
This patch fixes AI to produce a JSValue in the right format.
* dfg/DFGAbstractInterpreterInlines.h:
(JSC::DFG::AbstractInterpreter<AbstractStateType>::handleConstantDivOp):
Modified Paths
Added Paths
Diff
Modified: trunk/JSTests/ChangeLog (254187 => 254188)
--- trunk/JSTests/ChangeLog 2020-01-08 06:40:29 UTC (rev 254187)
+++ trunk/JSTests/ChangeLog 2020-01-08 07:23:30 UTC (rev 254188)
@@ -1,3 +1,20 @@
+2020-01-07 Saam Barati <sbar...@apple.com>
+
+ AI rule for ValueMod/ValueDiv produce constants with the wrong format when the result can be an int32
+ https://bugs.webkit.org/show_bug.cgi?id=205906
+ <rdar://problem/56108519>
+
+ Reviewed by Yusuke Suzuki.
+
+ * stress/ai-value-div-should-result-in-constant-int-where-possible.js: Added.
+ (foo.bar.f):
+ (foo.):
+ (foo):
+ * stress/ai-value-mod-should-result-in-constant-int-where-possible.js: Added.
+ (foo.bar.f):
+ (foo.):
+ (foo):
+
2020-01-06 Alexey Shvayka <shvaikal...@gmail.com>
String.prototype.replace() incorrectly handles named references on RegExp w/o named groups
Added: trunk/JSTests/stress/ai-value-div-should-result-in-constant-int-where-possible.js (0 => 254188)
--- trunk/JSTests/stress/ai-value-div-should-result-in-constant-int-where-possible.js (rev 0)
+++ trunk/JSTests/stress/ai-value-div-should-result-in-constant-int-where-possible.js 2020-01-08 07:23:30 UTC (rev 254188)
@@ -0,0 +1,21 @@
+//@ runDefault("--useRandomizingFuzzerAgent=1", "--validateAbstractInterpreterState=1", "--jitPolicyScale=0", "--useConcurrentJIT=0")
+
+function foo() {
+ for (let i = 0; i < 3; i++) {
+ const o = {};
+ function bar(a0) {
+ let x;
+ do {
+ function f() { z; }
+ x = o;
+ const y = typeof x === a0;
+ [a0, 0.1];
+ const z = 0 + y;
+ const c = z / 1.0 + 0;
+ } while (!x);
+ }
+ bar(0);
+ }
+}
+
+foo();
Added: trunk/JSTests/stress/ai-value-mod-should-result-in-constant-int-where-possible.js (0 => 254188)
--- trunk/JSTests/stress/ai-value-mod-should-result-in-constant-int-where-possible.js (rev 0)
+++ trunk/JSTests/stress/ai-value-mod-should-result-in-constant-int-where-possible.js 2020-01-08 07:23:30 UTC (rev 254188)
@@ -0,0 +1,21 @@
+//@ runDefault("--useRandomizingFuzzerAgent=1", "--validateAbstractInterpreterState=1", "--jitPolicyScale=0", "--useConcurrentJIT=0")
+
+function foo() {
+ for (let i = 0; i < 3; i++) {
+ const o = {};
+ function bar(a0) {
+ let x;
+ do {
+ function f() { z; }
+ x = o;
+ const y = typeof x === a0;
+ [a0, 0.1];
+ const z = 0 + y;
+ const c = z / 1.0 + 0;
+ } while (!x);
+ }
+ bar(0);
+ }
+}
+
+foo();
Modified: trunk/Source/_javascript_Core/ChangeLog (254187 => 254188)
--- trunk/Source/_javascript_Core/ChangeLog 2020-01-08 06:40:29 UTC (rev 254187)
+++ trunk/Source/_javascript_Core/ChangeLog 2020-01-08 07:23:30 UTC (rev 254188)
@@ -1,3 +1,18 @@
+2020-01-07 Saam Barati <sbar...@apple.com>
+
+ AI rule for ValueMod/ValueDiv produce constants with the wrong format when the result can be an int32
+ https://bugs.webkit.org/show_bug.cgi?id=205906
+ <rdar://problem/56108519>
+
+ Reviewed by Yusuke Suzuki.
+
+ The runtime code for ValueMod and ValueDiv produces an int32 when the result
+ is of int32 value. However, the AI was saying the result is in double format.
+ This patch fixes AI to produce a JSValue in the right format.
+
+ * dfg/DFGAbstractInterpreterInlines.h:
+ (JSC::DFG::AbstractInterpreter<AbstractStateType>::handleConstantDivOp):
+
2020-01-07 Said Abou-Hallawa <sabouhall...@apple.com>
Implement css3-images image-orientation
Modified: trunk/Source/_javascript_Core/dfg/DFGAbstractInterpreterInlines.h (254187 => 254188)
--- trunk/Source/_javascript_Core/dfg/DFGAbstractInterpreterInlines.h 2020-01-08 06:40:29 UTC (rev 254187)
+++ trunk/Source/_javascript_Core/dfg/DFGAbstractInterpreterInlines.h 2020-01-08 07:23:30 UTC (rev 254188)
@@ -323,10 +323,17 @@
if (isClobbering)
didFoldClobberWorld();
- if (isDivOperation)
- setConstant(node, jsDoubleNumber(left.asNumber() / right.asNumber()));
- else
- setConstant(node, jsDoubleNumber(fmod(left.asNumber(), right.asNumber())));
+ if (isDivOperation) {
+ if (op == ValueDiv)
+ setConstant(node, jsNumber(left.asNumber() / right.asNumber()));
+ else
+ setConstant(node, jsDoubleNumber(left.asNumber() / right.asNumber()));
+ } else {
+ if (op == ValueMod)
+ setConstant(node, jsNumber(fmod(left.asNumber(), right.asNumber())));
+ else
+ setConstant(node, jsDoubleNumber(fmod(left.asNumber(), right.asNumber())));
+ }
return true;
}
_______________________________________________
webkit-changes mailing list
webkit-changes@lists.webkit.org
https://lists.webkit.org/mailman/listinfo/webkit-changes
