Changeset 170109 in webkit

Timestamp:

Jun 18, 2014 11:57:12 AM (10 years ago)

Author:

mark.lam@apple.com

Message:

DFGGraph::m_doubleConstantMap will not map 0 values correctly.
<​https://webkit.org/b/133994>

Reviewed by Geoffrey Garen.

DFGGraph::m_doubleConstantsMap should not use a double as a key to its HashMap,
because it means two unfortunate things:

• It will probably break for zero.
• It will think that -0 is the same as +0 under some circumstances, size -0==+0 even though they are distinct values (for example 1/-0 != 1/+0).

The fix is to use std::unordered_map which does not require special empty
and deleted values, and to use the raw bits instead of the double value as
the key.

• dfg/DFGGraph.h:
• dfg/DFGJITCompiler.cpp:

(JSC::DFG::JITCompiler::addressOfDoubleConstant):

Location:

trunk/Source/JavaScriptCore

Files:

• ChangeLog (modified) (1 diff)
• dfg/DFGGraph.h (modified) (2 diffs)
• dfg/DFGJITCompiler.cpp (modified) (2 diffs)

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2014-06-18  Mark Lam  <mark.lam@apple.com>
+
+        DFGGraph::m_doubleConstantMap will not map 0 values correctly.
+        <https://webkit.org/b/133994>
+
+        Reviewed by Geoffrey Garen.
+
+        DFGGraph::m_doubleConstantsMap should not use a double as a key to its HashMap,
+        because it means two unfortunate things:
+        - It will probably break for zero.
+        - It will think that -0 is the same as +0 under some circumstances, size
+          -0==+0 even though they are distinct values (for example 1/-0 != 1/+0).
+
+        The fix is to use std::unordered_map which does not require special empty
+        and deleted values, and to use the raw bits instead of the double value as
+        the key.
+
+        * dfg/DFGGraph.h:
+        * dfg/DFGJITCompiler.cpp:
+        (JSC::DFG::JITCompiler::addressOfDoubleConstant):
+
 2014-06-18  Alex Christensen  <achristensen@webkit.org>
 

trunk/Source/JavaScriptCore/dfg/DFGGraph.h

@@ -42 +42 @@
 #include "JSStack.h"
 #include "MethodOfGettingAValueProfile.h"
+#include <unordered_map>
 #include <wtf/BitVector.h>
 #include <wtf/HashMap.h>
@@ -855 +856 @@
 
 #if USE(JSVALUE32_64)
-    HashMap<double, double*> m_doubleConstantsMap;
+    std::unordered_map<int64_t, double*> m_doubleConstantsMap;
     std::unique_ptr<Bag<double>> m_doubleConstants;
 #endif

trunk/Source/JavaScriptCore/dfg/DFGJITCompiler.cpp

@@ -445 +445 @@
 
     double value = jsvalue.asDouble();
-    auto it = m_graph.m_doubleConstantsMap.find(value);
+    int64_t valueBits = bitwise_cast<int64_t>(value);
+    auto it = m_graph.m_doubleConstantsMap.find(valueBits);
     if (it != m_graph.m_doubleConstantsMap.end())
-        return it->value;
+        return it->second;
 
     if (!m_graph.m_doubleConstants)
@@ -454 +455 @@
     double* addressInConstantPool = m_graph.m_doubleConstants->add();
     *addressInConstantPool = value;
-    m_graph.m_doubleConstantsMap.add(value, addressInConstantPool);
+    m_graph.m_doubleConstantsMap[valueBits] = addressInConstantPool;
     return addressInConstantPool;
 }