Changeset 280060 in webkit

Timestamp:

Jul 19, 2021, 5:48:54 PM (4 years ago)

Author:

mark.lam@apple.com

Message:

DFG's parseIntResult() should check for negative zero.
​https://bugs.webkit.org/show_bug.cgi?id=228068
rdar://80788603

Reviewed by Yusuke Suzuki.

JSTests:

• stress/dfg-parseIntResult-should-check-for-negative-zero.js: Added.

Source/JavaScriptCore:

We have to check for negative zero explicitly because C++ evaluates 0.0 == -0.0
as true.

• dfg/DFGOperations.cpp:

(JSC::DFG::parseIntResult):

Location:

trunk

Files:

• JSTests/ChangeLog (modified) (1 diff)
• JSTests/stress/dfg-parseIntResult-should-check-for-negative-zero.js (added)
• Source/JavaScriptCore/ChangeLog (modified) (1 diff)
• Source/JavaScriptCore/dfg/DFGOperations.cpp (modified) (1 diff)

trunk/JSTests/ChangeLog

@@ +1 @@
+2021-07-19  Mark Lam  <mark.lam@apple.com>
+
+        DFG's parseIntResult() should check for negative zero.
+        https://bugs.webkit.org/show_bug.cgi?id=228068
+        rdar://80788603
+
+        Reviewed by Yusuke Suzuki.
+
+        * stress/dfg-parseIntResult-should-check-for-negative-zero.js: Added.
+
 2021-07-19  Yusuke Suzuki  <ysuzuki@apple.com>
 

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2021-07-19  Mark Lam  <mark.lam@apple.com>
+
+        DFG's parseIntResult() should check for negative zero.
+        https://bugs.webkit.org/show_bug.cgi?id=228068
+        rdar://80788603
+
+        Reviewed by Yusuke Suzuki.
+
+        We have to check for negative zero explicitly because C++ evaluates 0.0 == -0.0
+        as true.
+
+        * dfg/DFGOperations.cpp:
+        (JSC::DFG::parseIntResult):
+
 2021-07-19  Yusuke Suzuki  <ysuzuki@apple.com>
 

trunk/Source/JavaScriptCore/dfg/DFGOperations.cpp

@@ -203 +203 @@
 {
     int asInt = static_cast<int>(input);
-    if (static_cast<double>(asInt) == input)
+    if (LIKELY(static_cast<double>(asInt) == input && (asInt || !std::signbit(input))))
         return JSValue::encode(jsNumber(asInt));
     return JSValue::encode(jsNumber(input));