Title: [184541] trunk/Source/_javascript_Core
- Revision
- 184541
- Author
- [email protected]
- Date
- 2015-05-18 20:39:14 -0700 (Mon, 18 May 2015)
Log Message
<rdar://problem/21003555> cloberrize() is wrong for ArithRound because it doesn't account for the arith mode
https://bugs.webkit.org/show_bug.cgi?id=145147
Patch by Benjamin Poulain <[email protected]> on 2015-05-18
Reviewed by Filip Pizlo.
Really stupid bug: ArithRound nodes with different rounding modes
were not distinguished and CSE would happily unify with a node of
a different rounding mode.
DFG::clobberize() already support additional data but I was not using it.
* dfg/DFGClobberize.h:
(JSC::DFG::clobberize):
* tests/stress/math-round-arith-rounding-mode.js: Added.
(firstCareAboutZeroSecondDoesNot):
(firstDoNotCareAboutZeroSecondDoes):
(warmup):
(verifyNegativeZeroIsPreserved):
Modified Paths
Added Paths
Diff
Modified: trunk/Source/_javascript_Core/ChangeLog (184540 => 184541)
--- trunk/Source/_javascript_Core/ChangeLog 2015-05-19 02:30:00 UTC (rev 184540)
+++ trunk/Source/_javascript_Core/ChangeLog 2015-05-19 03:39:14 UTC (rev 184541)
@@ -1,3 +1,24 @@
+2015-05-18 Benjamin Poulain <[email protected]>
+
+ <rdar://problem/21003555> cloberrize() is wrong for ArithRound because it doesn't account for the arith mode
+ https://bugs.webkit.org/show_bug.cgi?id=145147
+
+ Reviewed by Filip Pizlo.
+
+ Really stupid bug: ArithRound nodes with different rounding modes
+ were not distinguished and CSE would happily unify with a node of
+ a different rounding mode.
+
+ DFG::clobberize() already support additional data but I was not using it.
+
+ * dfg/DFGClobberize.h:
+ (JSC::DFG::clobberize):
+ * tests/stress/math-round-arith-rounding-mode.js: Added.
+ (firstCareAboutZeroSecondDoesNot):
+ (firstDoNotCareAboutZeroSecondDoes):
+ (warmup):
+ (verifyNegativeZeroIsPreserved):
+
2015-05-18 Filip Pizlo <[email protected]>
Add SpecBoolInt32 type that means "I'm an int and I'm either 0 or 1"
Modified: trunk/Source/_javascript_Core/dfg/DFGClobberize.h (184540 => 184541)
--- trunk/Source/_javascript_Core/dfg/DFGClobberize.h 2015-05-19 02:30:00 UTC (rev 184540)
+++ trunk/Source/_javascript_Core/dfg/DFGClobberize.h 2015-05-19 03:39:14 UTC (rev 184541)
@@ -134,7 +134,6 @@
case ArithPow:
case ArithSqrt:
case ArithFRound:
- case ArithRound:
case ArithSin:
case ArithCos:
case ArithLog:
@@ -255,7 +254,11 @@
case UInt32ToNumber:
def(PureValue(node, node->arithMode()));
return;
-
+
+ case ArithRound:
+ def(PureValue(node, static_cast<uintptr_t>(node->arithRoundingMode())));
+ return;
+
case CheckCell:
def(PureValue(CheckCell, AdjacencyList(AdjacencyList::Fixed, node->child1()), node->cellOperand()));
return;
Added: trunk/Source/_javascript_Core/tests/stress/math-round-arith-rounding-mode.js (0 => 184541)
--- trunk/Source/_javascript_Core/tests/stress/math-round-arith-rounding-mode.js (rev 0)
+++ trunk/Source/_javascript_Core/tests/stress/math-round-arith-rounding-mode.js 2015-05-19 03:39:14 UTC (rev 184541)
@@ -0,0 +1,44 @@
+function firstCareAboutZeroSecondDoesNot(a) {
+ var resultA = Math.round(a);
+ var resultB = Math.round(a)|0;
+ return { resultA:resultA, resultB:resultB };
+}
+noInline(firstCareAboutZeroSecondDoesNot);
+
+function firstDoNotCareAboutZeroSecondDoes(a) {
+ var resultA = Math.round(a)|0;
+ var resultB = Math.round(a);
+ return { resultA:resultA, resultB:resultB };
+}
+noInline(firstDoNotCareAboutZeroSecondDoes);
+
+// Warmup with doubles, but nothing that would round to -0 to ensure we never
+// see a double as result. The result must be integers, the input is kept to small values.
+function warmup() {
+ for (var i = 0; i < 1e4; ++i) {
+ firstCareAboutZeroSecondDoesNot(42.6 + i);
+ firstDoNotCareAboutZeroSecondDoes(42.4 + i);
+ }
+}
+warmup();
+
+function verifyNegativeZeroIsPreserved() {
+ for (var i = 0; i < 1e4; ++i) {
+ var result1 = firstCareAboutZeroSecondDoesNot(-0.1);
+ if (1 / result1.resultA !== -Infinity) {
+ throw "Failed firstCareAboutZeroSecondDoesNot(-0.1), resultA = " + result1.resultA;
+ }
+ if (1 / result1.resultB !== Infinity) {
+ throw "Failed firstCareAboutZeroSecondDoesNot(-0.1), resultB = " + result1.resultB;
+ }
+ var result2 = firstDoNotCareAboutZeroSecondDoes(-0.1);
+ if (1 / result2.resultA !== Infinity) {
+ throw "Failed firstDoNotCareAboutZeroSecondDoes(-0.1), resultA = " + result1.resultA;
+ }
+ if (1 / result2.resultB !== -Infinity) {
+ throw "Failed firstDoNotCareAboutZeroSecondDoes(-0.1), resultB = " + result1.resultB;
+ }
+
+ }
+}
+verifyNegativeZeroIsPreserved();
\ No newline at end of file
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
