Changeset 199638 in webkit

Timestamp:

Apr 16, 2016, 8:44:52 PM (10 years ago)

Author:

commit-queue@webkit.org

Message:

[JSC] FRound/Negate can produce an impure NaN out of a pure NaN
​https://bugs.webkit.org/show_bug.cgi?id=156528

Patch by Benjamin Poulain <​bpoulain@apple.com> on 2016-04-16
Reviewed by Filip Pizlo.

If you fround a double with the bits 0xfff7000000000000
you get 0xfffe000000000000. The first is a pure NaN, the second isn't.

This is without test because I could not find a way to create a 0xfff7000000000000
while convincing DFG that its pure.
When we purify NaNs from typed array, we use a specific value of NaN if the input
is any NaN, making testing tricky.

• bytecode/SpeculatedType.cpp:

(JSC::typeOfDoubleNegation):

Location:

trunk/Source/JavaScriptCore

Files:

• ChangeLog (modified) (1 diff)
• bytecode/SpeculatedType.cpp (modified) (2 diffs)

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2016-04-16  Benjamin Poulain  <bpoulain@apple.com>
+
+        [JSC] FRound/Negate can produce an impure NaN out of a pure NaN
+        https://bugs.webkit.org/show_bug.cgi?id=156528
+
+        Reviewed by Filip Pizlo.
+
+        If you fround a double with the bits 0xfff7000000000000
+        you get 0xfffe000000000000. The first is a pure NaN, the second isn't.
+
+        This is without test because I could not find a way to create a 0xfff7000000000000
+        while convincing DFG that its pure.
+        When we purify NaNs from typed array, we use a specific value of NaN if the input
+        is any NaN, making testing tricky.
+
+        * bytecode/SpeculatedType.cpp:
+        (JSC::typeOfDoubleNegation):
+
 2016-04-16  Konstantin Tokarev  <annulen@yandex.ru>
 

trunk/Source/JavaScriptCore/bytecode/SpeculatedType.cpp

@@ -523 +523 @@
 SpeculatedType typeOfDoubleNegation(SpeculatedType value)
 {
-    // Impure NaN could become pure NaN because bits might get cleared.
-    if (value & SpecDoubleImpureNaN)
-        value |= SpecDoublePureNaN;
+    // Changing bits can make pure NaN impure and vice versa:
+    // 0xefff000000000000 (pure) - 0xffff000000000000 (impure)
+    if (value & SpecDoubleNaN)
+        value |= SpecDoubleNaN;
     // We could get negative zero, which mixes SpecInt52AsDouble and SpecNotIntAsDouble.
     // We could also overflow a large negative int into something that is no longer
@@ -541 +542 @@
 SpeculatedType typeOfDoubleRounding(SpeculatedType value)
 {
-    // We might lose bits, which leads to a NaN being purified.
-    if (value & SpecDoubleImpureNaN)
-        value |= SpecDoublePureNaN;
+    // Double Pure NaN can becomes impure when converted back from Float.
+    // and vice versa.
+    if (value & SpecDoubleNaN)
+        value |= SpecDoubleNaN;
     // We might lose bits, which leads to a value becoming integer-representable.
     if (value & SpecNonIntAsDouble)