Title: [267636] branches/safari-610-branch
- Revision
- 267636
- Author
- [email protected]
- Date
- 2020-09-26 14:08:55 -0700 (Sat, 26 Sep 2020)
Log Message
Cherry-pick r267135. rdar://problem/69586651
JSImmutableButterfly::get needs to return jsDoubleNumber for double arrays
https://bugs.webkit.org/show_bug.cgi?id=216589
<rdar://problem/68061245>
Reviewed by Yusuke Suzuki.
JSTests:
* stress/jsimmutablebutterfly-get-must-return-double-boxed-value.js: Added.
Source/_javascript_Core:
We are using JSImmutableButterfly::get in AI to constant fold GetByVal,
but we were failing to always return a boxed double value for double loads.
We were calling jsNumber instead of jsDooubleNumber. This is in contrast to
the runtime, which always returns a double boxed value. This would lead AI
to disagree with the runtime, and miscompile code.
* runtime/JSImmutableButterfly.h:
(JSC::JSImmutableButterfly::get const):
git-svn-id: https://svn.webkit.org/repository/webkit/trunk@267135 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Modified Paths
Added Paths
Diff
Modified: branches/safari-610-branch/JSTests/ChangeLog (267635 => 267636)
--- branches/safari-610-branch/JSTests/ChangeLog 2020-09-26 21:08:52 UTC (rev 267635)
+++ branches/safari-610-branch/JSTests/ChangeLog 2020-09-26 21:08:55 UTC (rev 267636)
@@ -1,5 +1,43 @@
2020-09-25 Alan Coon <[email protected]>
+ Cherry-pick r267135. rdar://problem/69586651
+
+ JSImmutableButterfly::get needs to return jsDoubleNumber for double arrays
+ https://bugs.webkit.org/show_bug.cgi?id=216589
+ <rdar://problem/68061245>
+
+ Reviewed by Yusuke Suzuki.
+
+ JSTests:
+
+ * stress/jsimmutablebutterfly-get-must-return-double-boxed-value.js: Added.
+
+ Source/_javascript_Core:
+
+ We are using JSImmutableButterfly::get in AI to constant fold GetByVal,
+ but we were failing to always return a boxed double value for double loads.
+ We were calling jsNumber instead of jsDooubleNumber. This is in contrast to
+ the runtime, which always returns a double boxed value. This would lead AI
+ to disagree with the runtime, and miscompile code.
+
+ * runtime/JSImmutableButterfly.h:
+ (JSC::JSImmutableButterfly::get const):
+
+
+ git-svn-id: https://svn.webkit.org/repository/webkit/trunk@267135 268f45cc-cd09-0410-ab3c-d52691b4dbfc
+
+ 2020-09-15 Saam Barati <[email protected]>
+
+ JSImmutableButterfly::get needs to return jsDoubleNumber for double arrays
+ https://bugs.webkit.org/show_bug.cgi?id=216589
+ <rdar://problem/68061245>
+
+ Reviewed by Yusuke Suzuki.
+
+ * stress/jsimmutablebutterfly-get-must-return-double-boxed-value.js: Added.
+
+2020-09-25 Alan Coon <[email protected]>
+
Cherry-pick r267113. rdar://problem/69586723
CustomFunctionEquivalence PropertyCondition needs to check if the structure has the property
Added: branches/safari-610-branch/JSTests/stress/jsimmutablebutterfly-get-must-return-double-boxed-value.js (0 => 267636)
--- branches/safari-610-branch/JSTests/stress/jsimmutablebutterfly-get-must-return-double-boxed-value.js (rev 0)
+++ branches/safari-610-branch/JSTests/stress/jsimmutablebutterfly-get-must-return-double-boxed-value.js 2020-09-26 21:08:55 UTC (rev 267636)
@@ -0,0 +1,14 @@
+const a0 = [ 2, 0.3 ];
+const o = {};
+function foo(arg) {
+ for (const c of '123456') {
+ let b = arg instanceof Array;
+ let cond = a0[-b] < 1;
+ do {} while (cond);
+ o[arg] = undefined;
+ }
+}
+foo([]);
+foo('');
+foo('');
+foo('');
Modified: branches/safari-610-branch/Source/_javascript_Core/ChangeLog (267635 => 267636)
--- branches/safari-610-branch/Source/_javascript_Core/ChangeLog 2020-09-26 21:08:52 UTC (rev 267635)
+++ branches/safari-610-branch/Source/_javascript_Core/ChangeLog 2020-09-26 21:08:55 UTC (rev 267636)
@@ -1,5 +1,50 @@
2020-09-25 Alan Coon <[email protected]>
+ Cherry-pick r267135. rdar://problem/69586651
+
+ JSImmutableButterfly::get needs to return jsDoubleNumber for double arrays
+ https://bugs.webkit.org/show_bug.cgi?id=216589
+ <rdar://problem/68061245>
+
+ Reviewed by Yusuke Suzuki.
+
+ JSTests:
+
+ * stress/jsimmutablebutterfly-get-must-return-double-boxed-value.js: Added.
+
+ Source/_javascript_Core:
+
+ We are using JSImmutableButterfly::get in AI to constant fold GetByVal,
+ but we were failing to always return a boxed double value for double loads.
+ We were calling jsNumber instead of jsDooubleNumber. This is in contrast to
+ the runtime, which always returns a double boxed value. This would lead AI
+ to disagree with the runtime, and miscompile code.
+
+ * runtime/JSImmutableButterfly.h:
+ (JSC::JSImmutableButterfly::get const):
+
+
+ git-svn-id: https://svn.webkit.org/repository/webkit/trunk@267135 268f45cc-cd09-0410-ab3c-d52691b4dbfc
+
+ 2020-09-15 Saam Barati <[email protected]>
+
+ JSImmutableButterfly::get needs to return jsDoubleNumber for double arrays
+ https://bugs.webkit.org/show_bug.cgi?id=216589
+ <rdar://problem/68061245>
+
+ Reviewed by Yusuke Suzuki.
+
+ We are using JSImmutableButterfly::get in AI to constant fold GetByVal,
+ but we were failing to always return a boxed double value for double loads.
+ We were calling jsNumber instead of jsDooubleNumber. This is in contrast to
+ the runtime, which always returns a double boxed value. This would lead AI
+ to disagree with the runtime, and miscompile code.
+
+ * runtime/JSImmutableButterfly.h:
+ (JSC::JSImmutableButterfly::get const):
+
+2020-09-25 Alan Coon <[email protected]>
+
Cherry-pick r267113. rdar://problem/69586723
CustomFunctionEquivalence PropertyCondition needs to check if the structure has the property
Modified: branches/safari-610-branch/Source/_javascript_Core/runtime/JSImmutableButterfly.h (267635 => 267636)
--- branches/safari-610-branch/Source/_javascript_Core/runtime/JSImmutableButterfly.h 2020-09-26 21:08:52 UTC (rev 267635)
+++ branches/safari-610-branch/Source/_javascript_Core/runtime/JSImmutableButterfly.h 2020-09-26 21:08:55 UTC (rev 267636)
@@ -142,7 +142,7 @@
double value = toButterfly()->contiguousDouble().at(this, index);
// Holes are not supported yet.
ASSERT(!std::isnan(value));
- return jsNumber(value);
+ return jsDoubleNumber(value);
}
static void visitChildren(JSCell*, SlotVisitor&);
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
