Title: [199638] trunk/Source/_javascript_Core
- Revision
- 199638
- Author
- [email protected]
- Date
- 2016-04-16 20:44:52 -0700 (Sat, 16 Apr 2016)
Log Message
[JSC] FRound/Negate can produce an impure NaN out of a pure NaN
https://bugs.webkit.org/show_bug.cgi?id=156528
Patch by Benjamin Poulain <[email protected]> on 2016-04-16
Reviewed by Filip Pizlo.
If you fround a double with the bits 0xfff7000000000000
you get 0xfffe000000000000. The first is a pure NaN, the second isn't.
This is without test because I could not find a way to create a 0xfff7000000000000
while convincing DFG that its pure.
When we purify NaNs from typed array, we use a specific value of NaN if the input
is any NaN, making testing tricky.
* bytecode/SpeculatedType.cpp:
(JSC::typeOfDoubleNegation):
Modified Paths
Diff
Modified: trunk/Source/_javascript_Core/ChangeLog (199637 => 199638)
--- trunk/Source/_javascript_Core/ChangeLog 2016-04-17 02:39:19 UTC (rev 199637)
+++ trunk/Source/_javascript_Core/ChangeLog 2016-04-17 03:44:52 UTC (rev 199638)
@@ -1,3 +1,21 @@
+2016-04-16 Benjamin Poulain <[email protected]>
+
+ [JSC] FRound/Negate can produce an impure NaN out of a pure NaN
+ https://bugs.webkit.org/show_bug.cgi?id=156528
+
+ Reviewed by Filip Pizlo.
+
+ If you fround a double with the bits 0xfff7000000000000
+ you get 0xfffe000000000000. The first is a pure NaN, the second isn't.
+
+ This is without test because I could not find a way to create a 0xfff7000000000000
+ while convincing DFG that its pure.
+ When we purify NaNs from typed array, we use a specific value of NaN if the input
+ is any NaN, making testing tricky.
+
+ * bytecode/SpeculatedType.cpp:
+ (JSC::typeOfDoubleNegation):
+
2016-04-16 Konstantin Tokarev <[email protected]>
JS::DFG::nodeValuePairListDump does not compile with libstdc++ 4.8
Modified: trunk/Source/_javascript_Core/bytecode/SpeculatedType.cpp (199637 => 199638)
--- trunk/Source/_javascript_Core/bytecode/SpeculatedType.cpp 2016-04-17 02:39:19 UTC (rev 199637)
+++ trunk/Source/_javascript_Core/bytecode/SpeculatedType.cpp 2016-04-17 03:44:52 UTC (rev 199638)
@@ -522,9 +522,10 @@
SpeculatedType typeOfDoubleNegation(SpeculatedType value)
{
- // Impure NaN could become pure NaN because bits might get cleared.
- if (value & SpecDoubleImpureNaN)
- value |= SpecDoublePureNaN;
+ // Changing bits can make pure NaN impure and vice versa:
+ // 0xefff000000000000 (pure) - 0xffff000000000000 (impure)
+ if (value & SpecDoubleNaN)
+ value |= SpecDoubleNaN;
// We could get negative zero, which mixes SpecInt52AsDouble and SpecNotIntAsDouble.
// We could also overflow a large negative int into something that is no longer
// representable as an int.
@@ -540,9 +541,10 @@
SpeculatedType typeOfDoubleRounding(SpeculatedType value)
{
- // We might lose bits, which leads to a NaN being purified.
- if (value & SpecDoubleImpureNaN)
- value |= SpecDoublePureNaN;
+ // Double Pure NaN can becomes impure when converted back from Float.
+ // and vice versa.
+ if (value & SpecDoubleNaN)
+ value |= SpecDoubleNaN;
// We might lose bits, which leads to a value becoming integer-representable.
if (value & SpecNonIntAsDouble)
value |= SpecInt52AsDouble;
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
