Title: [186458] releases/WebKitGTK/webkit-2.8/Source/_javascript_Core
- Revision
- 186458
- Author
- [email protected]
- Date
- 2015-07-07 05:38:39 -0700 (Tue, 07 Jul 2015)
Log Message
Merge r183692 - Math.abs() returns negative
https://bugs.webkit.org/show_bug.cgi?id=137827
Reviewed by Michael Saboff.
Math.abs() on doubles was mistakenly assumed by the DFG AI to be the
identity function.
* dfg/DFGAbstractInterpreterInlines.h:
(JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
* tests/stress/math-abs-positive.js: Added, was previously failing.
(foo):
Modified Paths
Added Paths
Diff
Modified: releases/WebKitGTK/webkit-2.8/Source/_javascript_Core/ChangeLog (186457 => 186458)
--- releases/WebKitGTK/webkit-2.8/Source/_javascript_Core/ChangeLog 2015-07-07 12:33:54 UTC (rev 186457)
+++ releases/WebKitGTK/webkit-2.8/Source/_javascript_Core/ChangeLog 2015-07-07 12:38:39 UTC (rev 186458)
@@ -1,3 +1,18 @@
+2015-05-01 Basile Clement <[email protected]>
+
+ Math.abs() returns negative
+ https://bugs.webkit.org/show_bug.cgi?id=137827
+
+ Reviewed by Michael Saboff.
+
+ Math.abs() on doubles was mistakenly assumed by the DFG AI to be the
+ identity function.
+
+ * dfg/DFGAbstractInterpreterInlines.h:
+ (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+ * tests/stress/math-abs-positive.js: Added, was previously failing.
+ (foo):
+
2015-06-19 Geoffrey Garen <[email protected]>
WebKit crash while loading nytimes at _javascript_Core: JSC::ExecutableAllocator::allocate + 276
Modified: releases/WebKitGTK/webkit-2.8/Source/_javascript_Core/dfg/DFGAbstractInterpreterInlines.h (186457 => 186458)
--- releases/WebKitGTK/webkit-2.8/Source/_javascript_Core/dfg/DFGAbstractInterpreterInlines.h 2015-07-07 12:33:54 UTC (rev 186457)
+++ releases/WebKitGTK/webkit-2.8/Source/_javascript_Core/dfg/DFGAbstractInterpreterInlines.h 2015-07-07 12:38:39 UTC (rev 186458)
@@ -699,7 +699,7 @@
break;
case DoubleRepUse:
if (child && child.isNumber()) {
- setConstant(node, jsDoubleNumber(child.asNumber()));
+ setConstant(node, jsDoubleNumber(fabs(child.asNumber())));
break;
}
forNode(node).setType(typeOfDoubleAbs(forNode(node->child1()).m_type));
Added: releases/WebKitGTK/webkit-2.8/Source/_javascript_Core/tests/stress/math-abs-positive.js (0 => 186458)
--- releases/WebKitGTK/webkit-2.8/Source/_javascript_Core/tests/stress/math-abs-positive.js (rev 0)
+++ releases/WebKitGTK/webkit-2.8/Source/_javascript_Core/tests/stress/math-abs-positive.js 2015-07-07 12:38:39 UTC (rev 186458)
@@ -0,0 +1,11 @@
+var minus_three_quarters = -0.75;
+
+function foo() {
+ return Math.abs(minus_three_quarters);
+}
+
+for (var i = 0; i < 10000; i++) {
+ var result = foo();
+ if (result < 0)
+ throw "Error: Math.abs returned a negative value.";
+}
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
