Title: [281933] trunk/Source/_javascript_Core
- Revision
- 281933
- Author
- [email protected]
- Date
- 2021-09-02 10:20:42 -0700 (Thu, 02 Sep 2021)
Log Message
Fix IndexedDoubleStore InlineAccess for 32 bits
https://bugs.webkit.org/show_bug.cgi?id=229772
Patch by Mikhail R. Gadelha <[email protected]> on 2021-09-02
Reviewed by Caio Araujo Neponoceno de Lima.
In IndexedDoubleStore inline access, the path if the value is NaN
is only being handled in 64 bits, thus introducing some wrong
results in 32 bits. This patch fixes:
stress/double-add-sub-mul-can-produce-nan.js
stress/pow-stable-results.js
stress/math-pow-stable-results.js
* bytecode/AccessCase.cpp:
(JSC::AccessCase::generateWithGuard):
Modified Paths
Diff
Modified: trunk/Source/_javascript_Core/ChangeLog (281932 => 281933)
--- trunk/Source/_javascript_Core/ChangeLog 2021-09-02 16:42:55 UTC (rev 281932)
+++ trunk/Source/_javascript_Core/ChangeLog 2021-09-02 17:20:42 UTC (rev 281933)
@@ -1,3 +1,21 @@
+2021-09-02 Mikhail R. Gadelha <[email protected]>
+
+ Fix IndexedDoubleStore InlineAccess for 32 bits
+ https://bugs.webkit.org/show_bug.cgi?id=229772
+
+ Reviewed by Caio Araujo Neponoceno de Lima.
+
+ In IndexedDoubleStore inline access, the path if the value is NaN
+ is only being handled in 64 bits, thus introducing some wrong
+ results in 32 bits. This patch fixes:
+
+ stress/double-add-sub-mul-can-produce-nan.js
+ stress/pow-stable-results.js
+ stress/math-pow-stable-results.js
+
+ * bytecode/AccessCase.cpp:
+ (JSC::AccessCase::generateWithGuard):
+
2021-09-02 Ross Kirsling <[email protected]>
[JSC] Fix invalid exception checks in Temporal classes
Modified: trunk/Source/_javascript_Core/bytecode/AccessCase.cpp (281932 => 281933)
--- trunk/Source/_javascript_Core/bytecode/AccessCase.cpp 2021-09-02 16:42:55 UTC (rev 281932)
+++ trunk/Source/_javascript_Core/bytecode/AccessCase.cpp 2021-09-02 17:20:42 UTC (rev 281933)
@@ -1484,11 +1484,10 @@
notInt.link(&jit);
#if USE(JSVALUE64)
jit.unboxDoubleWithoutAssertions(valueRegs.payloadGPR(), scratch2GPR, state.scratchFPR);
- failAndRepatch.append(jit.branchIfNaN(state.scratchFPR));
#else
- failAndRepatch.append(jit.branch32(CCallHelpers::Above, valueRegs.tagGPR(), CCallHelpers::TrustedImm32(JSValue::LowestTag)));
jit.unboxDouble(valueRegs, state.scratchFPR);
#endif
+ failAndRepatch.append(jit.branchIfNaN(state.scratchFPR));
ready.link(&jit);
jit.zeroExtend32ToWord(propertyGPR, scratch2GPR);
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
