Changeset 259556 in webkit

Timestamp:

Apr 5, 2020, 3:59:45 PM (6 years ago)

Author:

mark.lam@apple.com

Message:

ARM64 moveConditionallyDouble() for DoubleNotEqualAndOrdered is wrong.
​https://bugs.webkit.org/show_bug.cgi?id=210039
<rdar://problem/61321778>

Reviewed by Yusuke Suzuki.

For the scenario where the dest register is same as the then case register, there
is one csel instruction that should be checking the overflow condition to test
for unordered operands. Instead, we were testing for the not equal condition.
This patch fixes it to check for the overflow condition.

This bug was caught by testmasm.

• assembler/MacroAssemblerARM64.h:

(JSC::MacroAssemblerARM64::moveConditionallyAfterFloatingPointCompare):

Location:

trunk/Source/JavaScriptCore

Files:

• ChangeLog (modified) (1 diff)
• assembler/MacroAssemblerARM64.h (modified) (1 diff)

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2020-04-05  Mark Lam  <mark.lam@apple.com>
+
+        ARM64 moveConditionallyDouble() for DoubleNotEqualAndOrdered is wrong.
+        https://bugs.webkit.org/show_bug.cgi?id=210039
+        <rdar://problem/61321778>
+
+        Reviewed by Yusuke Suzuki.
+
+        For the scenario where the dest register is same as the then case register, there
+        is one csel instruction that should be checking the overflow condition to test
+        for unordered operands.  Instead, we were testing for the not equal condition.
+        This patch fixes it to check for the overflow condition.
+
+        This bug was caught by testmasm.
+
+        * assembler/MacroAssemblerARM64.h:
+        (JSC::MacroAssemblerARM64::moveConditionallyAfterFloatingPointCompare):
+
 2020-04-05  David Kilzer  <ddkilzer@apple.com>
 

trunk/Source/JavaScriptCore/assembler/MacroAssemblerARM64.h

@@ -2034 +2034 @@
                 // If the compare is ordered, dest is unchanged and NE decides
                 // what value to set.
-                m_assembler.csel<datasize>(thenCase, elseCase, thenCase, Assembler::ConditionNE);
+                m_assembler.csel<datasize>(thenCase, elseCase, thenCase, Assembler::ConditionVS);
                 m_assembler.csel<datasize>(dest, thenCase, elseCase, Assembler::ConditionNE);
             } else {