Changeset 243596 in webkit

Timestamp:

Mar 27, 2019, 6:06:01 PM (7 years ago)

Author:

sbarati@apple.com

Message:

validateOSREntryValue with Int52 should box the value being checked into double format
​https://bugs.webkit.org/show_bug.cgi?id=196313
<rdar://problem/49306703>

Reviewed by Yusuke Suzuki.

JSTests:

• stress/validate-int-52-ai-state.js: Added.

Source/JavaScriptCore:

• dfg/DFGOSREntry.cpp:

(JSC::DFG::prepareOSREntry):

• ftl/FTLLowerDFGToB3.cpp:

(JSC::FTL::DFG::LowerDFGToB3::validateAIState):

Location:

trunk

Files:

• JSTests/ChangeLog (modified) (1 diff)
• JSTests/stress/validate-int-52-ai-state.js (added)
• Source/JavaScriptCore/ChangeLog (modified) (1 diff)
• Source/JavaScriptCore/dfg/DFGOSREntry.cpp (modified) (1 diff)
• Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp (modified) (1 diff)

trunk/JSTests/ChangeLog

@@ +1 @@
+2019-03-27  Saam Barati  <sbarati@apple.com>
+
+        validateOSREntryValue with Int52 should box the value being checked into double format
+        https://bugs.webkit.org/show_bug.cgi?id=196313
+        <rdar://problem/49306703>
+
+        Reviewed by Yusuke Suzuki.
+
+        * stress/validate-int-52-ai-state.js: Added.
+
 2019-03-27  Yusuke Suzuki  <ysuzuki@apple.com>
 

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2019-03-27  Saam Barati  <sbarati@apple.com>
+
+        validateOSREntryValue with Int52 should box the value being checked into double format
+        https://bugs.webkit.org/show_bug.cgi?id=196313
+        <rdar://problem/49306703>
+
+        Reviewed by Yusuke Suzuki.
+
+        * dfg/DFGOSREntry.cpp:
+        (JSC::DFG::prepareOSREntry):
+        * ftl/FTLLowerDFGToB3.cpp:
+        (JSC::FTL::DFG::LowerDFGToB3::validateAIState):
+
 2019-03-27  Yusuke Suzuki  <ysuzuki@apple.com>
 

trunk/Source/JavaScriptCore/dfg/DFGOSREntry.cpp

@@ -215 +215 @@
                 return nullptr;
             }
-            // Constant AnyInt value is stored as usual boxed value in AbstractValue.
+            value = jsDoubleNumber(value.asAnyInt());
             format = FlushedInt52;
         }

trunk/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp

@@ -650 +650 @@
                     } else {
                         input = JSValue::decode(context.gpr(reg)); 
+                        if (flushFormat == FlushedInt52) {
+                            RELEASE_ASSERT(input.isAnyInt());
+                            input = jsDoubleNumber(input.asAnyInt());
+                        }
                         if (!value.validateOSREntryValue(input, flushFormat))
                             dumpAndCrash();