Changeset 267636 in webkit

Timestamp:

Sep 26, 2020, 2:08:55 PM (6 years ago)

Author:

Alan Coon

Message:

Cherry-pick r267135. rdar://problem/69586651

JSImmutableButterfly::get needs to return jsDoubleNumber for double arrays
​https://bugs.webkit.org/show_bug.cgi?id=216589
<rdar://problem/68061245>

Reviewed by Yusuke Suzuki.

JSTests:

• stress/jsimmutablebutterfly-get-must-return-double-boxed-value.js: Added.

Source/JavaScriptCore:

We are using JSImmutableButterfly::get in AI to constant fold GetByVal,
but we were failing to always return a boxed double value for double loads.
We were calling jsNumber instead of jsDooubleNumber. This is in contrast to
the runtime, which always returns a double boxed value. This would lead AI
to disagree with the runtime, and miscompile code.

• runtime/JSImmutableButterfly.h: (JSC::JSImmutableButterfly::get const):

git-svn-id: ​https://svn.webkit.org/repository/webkit/trunk@267135 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Location:

branches/safari-610-branch

Files:

• JSTests/ChangeLog (modified) (1 diff)
• JSTests/stress/jsimmutablebutterfly-get-must-return-double-boxed-value.js (added)
• Source/JavaScriptCore/ChangeLog (modified) (1 diff)
• Source/JavaScriptCore/runtime/JSImmutableButterfly.h (modified) (1 diff)

branches/safari-610-branch/JSTests/ChangeLog

@@ +1 @@
+2020-09-25  Alan Coon  <alancoon@apple.com>
+
+        Cherry-pick r267135. rdar://problem/69586651
+
+    JSImmutableButterfly::get needs to return jsDoubleNumber for double arrays
+    https://bugs.webkit.org/show_bug.cgi?id=216589
+    <rdar://problem/68061245>
+    
+    Reviewed by Yusuke Suzuki.
+    
+    JSTests:
+    
+    * stress/jsimmutablebutterfly-get-must-return-double-boxed-value.js: Added.
+    
+    Source/JavaScriptCore:
+    
+    We are using JSImmutableButterfly::get in AI to constant fold GetByVal,
+    but we were failing to always return a boxed double value for double loads.
+    We were calling jsNumber instead of jsDooubleNumber. This is in contrast to
+    the runtime, which always returns a double boxed value. This would lead AI
+    to disagree with the runtime, and miscompile code.
+    
+    * runtime/JSImmutableButterfly.h:
+    (JSC::JSImmutableButterfly::get const):
+    
+    
+    git-svn-id: https://svn.webkit.org/repository/webkit/trunk@267135 268f45cc-cd09-0410-ab3c-d52691b4dbfc
+
+    2020-09-15  Saam Barati  <sbarati@apple.com>
+
+            JSImmutableButterfly::get needs to return jsDoubleNumber for double arrays
+            https://bugs.webkit.org/show_bug.cgi?id=216589
+            <rdar://problem/68061245>
+
+            Reviewed by Yusuke Suzuki.
+
+            * stress/jsimmutablebutterfly-get-must-return-double-boxed-value.js: Added.
+
 2020-09-25  Alan Coon  <alancoon@apple.com>
 

branches/safari-610-branch/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2020-09-25  Alan Coon  <alancoon@apple.com>
+
+        Cherry-pick r267135. rdar://problem/69586651
+
+    JSImmutableButterfly::get needs to return jsDoubleNumber for double arrays
+    https://bugs.webkit.org/show_bug.cgi?id=216589
+    <rdar://problem/68061245>
+    
+    Reviewed by Yusuke Suzuki.
+    
+    JSTests:
+    
+    * stress/jsimmutablebutterfly-get-must-return-double-boxed-value.js: Added.
+    
+    Source/JavaScriptCore:
+    
+    We are using JSImmutableButterfly::get in AI to constant fold GetByVal,
+    but we were failing to always return a boxed double value for double loads.
+    We were calling jsNumber instead of jsDooubleNumber. This is in contrast to
+    the runtime, which always returns a double boxed value. This would lead AI
+    to disagree with the runtime, and miscompile code.
+    
+    * runtime/JSImmutableButterfly.h:
+    (JSC::JSImmutableButterfly::get const):
+    
+    
+    git-svn-id: https://svn.webkit.org/repository/webkit/trunk@267135 268f45cc-cd09-0410-ab3c-d52691b4dbfc
+
+    2020-09-15  Saam Barati  <sbarati@apple.com>
+
+            JSImmutableButterfly::get needs to return jsDoubleNumber for double arrays
+            https://bugs.webkit.org/show_bug.cgi?id=216589
+            <rdar://problem/68061245>
+
+            Reviewed by Yusuke Suzuki.
+
+            We are using JSImmutableButterfly::get in AI to constant fold GetByVal,
+            but we were failing to always return a boxed double value for double loads.
+            We were calling jsNumber instead of jsDooubleNumber. This is in contrast to
+            the runtime, which always returns a double boxed value. This would lead AI
+            to disagree with the runtime, and miscompile code.
+
+            * runtime/JSImmutableButterfly.h:
+            (JSC::JSImmutableButterfly::get const):
+
 2020-09-25  Alan Coon  <alancoon@apple.com>
 

branches/safari-610-branch/Source/JavaScriptCore/runtime/JSImmutableButterfly.h

@@ -143 +143 @@
         // Holes are not supported yet.
         ASSERT(!std::isnan(value));
-        return jsNumber(value);
+        return jsDoubleNumber(value);
     }