Title: [184100] releases/WebKitGTK/webkit-2.8/Source/_javascript_Core
- Revision
- 184100
- Author
- [email protected]
- Date
- 2015-05-11 08:18:07 -0700 (Mon, 11 May 2015)
Log Message
Merge r183291 - [JSC] When inserting a NaN into a Int32 array, we convert it to DoubleArray then to ContiguousArray
https://bugs.webkit.org/show_bug.cgi?id=144169
Patch by Benjamin Poulain <[email protected]> on 2015-04-24
Reviewed by Geoffrey Garen.
* runtime/JSObject.cpp:
(JSC::JSObject::convertInt32ForValue):
DoubleArray do not store NaN, they are used for holes.
What happened was:
1) We fail to insert the NaN in the Int32 array because it is a double.
2) We were converting the array to DoubleArray.
3) We were trying to insert the value again. We would fail again because
DoubleArray does not store NaN.
4) We would convert the DoubleArrayt to Contiguous Array, converting the values
to boxed values.
* tests/stress/int32array-transition-on-nan.js: Added.
The behavior is not really observable. This only test nothing crashes in those
cases.
(insertNaNWhileFilling):
(testInsertNaNWhileFilling):
(insertNaNAfterFilling):
(testInsertNaNAfterFilling):
(pushNaNWhileFilling):
(testPushNaNWhileFilling):
Modified Paths
Added Paths
Diff
Modified: releases/WebKitGTK/webkit-2.8/Source/_javascript_Core/ChangeLog (184099 => 184100)
--- releases/WebKitGTK/webkit-2.8/Source/_javascript_Core/ChangeLog 2015-05-11 15:15:18 UTC (rev 184099)
+++ releases/WebKitGTK/webkit-2.8/Source/_javascript_Core/ChangeLog 2015-05-11 15:18:07 UTC (rev 184100)
@@ -1,3 +1,32 @@
+2015-04-24 Benjamin Poulain <[email protected]>
+
+ [JSC] When inserting a NaN into a Int32 array, we convert it to DoubleArray then to ContiguousArray
+ https://bugs.webkit.org/show_bug.cgi?id=144169
+
+ Reviewed by Geoffrey Garen.
+
+ * runtime/JSObject.cpp:
+ (JSC::JSObject::convertInt32ForValue):
+ DoubleArray do not store NaN, they are used for holes.
+ What happened was:
+ 1) We fail to insert the NaN in the Int32 array because it is a double.
+ 2) We were converting the array to DoubleArray.
+ 3) We were trying to insert the value again. We would fail again because
+ DoubleArray does not store NaN.
+ 4) We would convert the DoubleArrayt to Contiguous Array, converting the values
+ to boxed values.
+
+ * tests/stress/int32array-transition-on-nan.js: Added.
+ The behavior is not really observable. This only test nothing crashes in those
+ cases.
+
+ (insertNaNWhileFilling):
+ (testInsertNaNWhileFilling):
+ (insertNaNAfterFilling):
+ (testInsertNaNAfterFilling):
+ (pushNaNWhileFilling):
+ (testPushNaNWhileFilling):
+
2015-04-24 Matthew Mirman <[email protected]>
Made Object.prototype.__proto__ native getter and setter check that this object not null or undefined
Modified: releases/WebKitGTK/webkit-2.8/Source/_javascript_Core/runtime/JSObject.cpp (184099 => 184100)
--- releases/WebKitGTK/webkit-2.8/Source/_javascript_Core/runtime/JSObject.cpp 2015-05-11 15:15:18 UTC (rev 184099)
+++ releases/WebKitGTK/webkit-2.8/Source/_javascript_Core/runtime/JSObject.cpp 2015-05-11 15:18:07 UTC (rev 184100)
@@ -968,7 +968,7 @@
{
ASSERT(!value.isInt32());
- if (value.isDouble()) {
+ if (value.isDouble() && !std::isnan(value.asDouble())) {
convertInt32ToDouble(vm);
return;
}
Added: releases/WebKitGTK/webkit-2.8/Source/_javascript_Core/tests/stress/int32array-transition-on-nan.js (0 => 184100)
--- releases/WebKitGTK/webkit-2.8/Source/_javascript_Core/tests/stress/int32array-transition-on-nan.js (rev 0)
+++ releases/WebKitGTK/webkit-2.8/Source/_javascript_Core/tests/stress/int32array-transition-on-nan.js 2015-05-11 15:18:07 UTC (rev 184100)
@@ -0,0 +1,88 @@
+function insertNaNWhileFilling()
+{
+ var array = new Array(6);
+ for (var i = 0; i < 4; ++i)
+ array[i] = i;
+ array[5] = NaN;
+ return array;
+}
+noInline(insertNaNWhileFilling);
+
+function testInsertNaNWhileFilling()
+{
+ var array = insertNaNWhileFilling();
+ for (var i = 0; i < 4; ++i) {
+ var value = array[i];
+ if (value !== i) {
+ throw "Failed testInsertNaNWhileFilling, value = " + value + " instead of " + i;
+ }
+ }
+ var nan = array[5];
+ if (!Number.isNaN(nan))
+ throw "Failed testInsertNaNWhileFilling, array[5] is " + nan + " instead of NaN";
+}
+noInline(testInsertNaNWhileFilling);
+
+for (var i = 0; i < 1e4; ++i) {
+ testInsertNaNWhileFilling();
+}
+
+
+function insertNaNAfterFilling()
+{
+ var array = new Array(6);
+ for (var i = 0; i < 5; ++i)
+ array[i] = i;
+ array[5] = NaN;
+ return array;
+}
+noInline(insertNaNAfterFilling);
+
+function testInsertNaNAfterFilling()
+{
+ var array = insertNaNAfterFilling();
+ for (var i = 0; i < 4; ++i) {
+ var value = array[i];
+ if (value !== i) {
+ throw "Failed testInsertNaNAfterFilling, value = " + value + " instead of " + i;
+ }
+ }
+ var nan = array[5];
+ if (!Number.isNaN(nan))
+ throw "Failed testInsertNaNAfterFilling, array[5] is " + nan + " instead of NaN";
+}
+noInline(testInsertNaNAfterFilling);
+
+for (var i = 0; i < 1e4; ++i) {
+ testInsertNaNAfterFilling();
+}
+
+
+function pushNaNWhileFilling()
+{
+ var array = [];
+ for (var i = 0; i < 5; ++i)
+ array.push(i);
+ array.push(NaN);
+ return array;
+}
+noInline(pushNaNWhileFilling);
+
+function testPushNaNWhileFilling()
+{
+ var array = pushNaNWhileFilling();
+ for (var i = 0; i < 4; ++i) {
+ var value = array[i];
+ if (value !== i) {
+ throw "Failed testPushNaNWhileFilling, value = " + value + " instead of " + i;
+ }
+ }
+ var nan = array[5];
+ if (!Number.isNaN(nan))
+ throw "Failed testPushNaNWhileFilling, array[5] is " + nan + " instead of NaN";
+}
+noInline(testPushNaNWhileFilling);
+
+for (var i = 0; i < 1e4; ++i) {
+ testPushNaNWhileFilling();
+}
\ No newline at end of file
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
