Changeset 244760 in webkit
- Timestamp:
- Apr 29, 2019 3:25:03 PM (5 years ago)
- Location:
- trunk
- Files:
-
- 2 added
- 5 edited
Legend:
- Unmodified
- Added
- Removed
-
trunk/JSTests/ChangeLog
r244713 r244760 1 2019-04-29 Yusuke Suzuki <ysuzuki@apple.com> 2 3 normalizeMapKey should normalize NaN to one PureNaN bit pattern to make MapHash same 4 https://bugs.webkit.org/show_bug.cgi?id=197362 5 6 Reviewed by Saam Barati. 7 8 * stress/map-with-nan.js: Added. 9 (shouldBe): 10 (div): 11 (NaN1): 12 (NaN2): 13 (NaN3): 14 (NaN4): 15 (NaN1NoInline): 16 (NaN2NoInline): 17 (NaN3NoInline): 18 (NaN4NoInline): 19 (test1): 20 (test2): 21 (test3): 22 (test4): 23 * stress/set-with-nan.js: Added. 24 (shouldBe): 25 (div): 26 (NaN1): 27 (NaN2): 28 (NaN3): 29 (NaN4): 30 (NaN1NoInline): 31 (NaN2NoInline): 32 (NaN3NoInline): 33 (NaN4NoInline): 34 (test2): 35 (test4): 36 1 37 2019-04-26 Commit Queue <commit-queue@webkit.org> 2 38 -
trunk/Source/JavaScriptCore/ChangeLog
r244756 r244760 1 2019-04-29 Yusuke Suzuki <ysuzuki@apple.com> 2 3 normalizeMapKey should normalize NaN to one PureNaN bit pattern to make MapHash same 4 https://bugs.webkit.org/show_bug.cgi?id=197362 5 6 Reviewed by Saam Barati. 7 8 Our Map/Set's hash algorithm relies on the bit pattern of JSValue. So our Map/Set has 9 normalization of the key, which normalizes Int32 / Double etc. But we did not normalize 10 pure NaNs into one canonicalized pure NaN. So we end up having multiple different pure NaNs 11 in one Map/Set. This patch normalizes NaN into one jsNaN(), which uses PNaN for the representation. 12 13 * dfg/DFGSpeculativeJIT.cpp: 14 (JSC::DFG::SpeculativeJIT::compileNormalizeMapKey): 15 * ftl/FTLLowerDFGToB3.cpp: 16 (JSC::FTL::DFG::LowerDFGToB3::compileNormalizeMapKey): 17 * runtime/HashMapImpl.h: 18 (JSC::normalizeMapKey): 19 1 20 2019-04-29 Alex Christensen <achristensen@webkit.org> 2 21 -
trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp
r244193 r244760 11715 11715 11716 11716 CCallHelpers::JumpList passThroughCases; 11717 CCallHelpers::JumpList doneCases; 11717 11718 11718 11719 passThroughCases.append(m_jit.branchIfNotNumber(keyRegs, scratchGPR)); … … 11724 11725 unboxDouble(keyRegs.tagGPR(), keyRegs.payloadGPR(), doubleValueFPR, tempFPR); 11725 11726 #endif 11726 passThroughCases.append(m_jit.branchIfNaN(doubleValueFPR)); 11727 11727 auto notNaN = m_jit.branchIfNotNaN(doubleValueFPR); 11728 m_jit.moveTrustedValue(jsNaN(), resultRegs); 11729 doneCases.append(m_jit.jump()); 11730 11731 notNaN.link(&m_jit); 11728 11732 m_jit.truncateDoubleToInt32(doubleValueFPR, scratchGPR); 11729 11733 m_jit.convertInt32ToDouble(scratchGPR, tempFPR); … … 11731 11735 11732 11736 m_jit.boxInt32(scratchGPR, resultRegs); 11733 auto done = m_jit.jump();11737 doneCases.append(m_jit.jump()); 11734 11738 11735 11739 passThroughCases.link(&m_jit); 11736 11740 m_jit.moveValueRegs(keyRegs, resultRegs); 11737 11741 11738 done .link(&m_jit);11742 doneCases.link(&m_jit); 11739 11743 jsValueResult(resultRegs, node); 11740 11744 } -
trunk/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp
r244079 r244760 9823 9823 m_out.appendTo(notInt32NumberCase, notNaNCase); 9824 9824 LValue doubleValue = unboxDouble(key); 9825 ValueFromBlock normalizedNaNResult = m_out.anchor(m_out.constInt64(JSValue::encode(jsNaN()))); 9825 9826 m_out.branch(m_out.doubleNotEqualOrUnordered(doubleValue, doubleValue), unsure(continuation), unsure(notNaNCase)); 9826 9827 … … 9831 9832 9832 9833 m_out.appendTo(convertibleCase, continuation); 9833 ValueFromBlock slowResult = m_out.anchor(boxInt32(integerValue));9834 ValueFromBlock boxedIntResult = m_out.anchor(boxInt32(integerValue)); 9834 9835 m_out.jump(continuation); 9835 9836 9836 9837 m_out.appendTo(continuation, lastNext); 9837 setJSValue(m_out.phi(Int64, fastResult, slowResult));9838 setJSValue(m_out.phi(Int64, fastResult, normalizedNaNResult, boxedIntResult)); 9838 9839 } 9839 9840 -
trunk/Source/JavaScriptCore/runtime/HashMapImpl.h
r239427 r244760 27 27 28 28 #include "ExceptionHelpers.h" 29 #include "JSCJSValueInlines.h" 29 30 #include "JSObject.h" 30 31 … … 246 247 double d = key.asDouble(); 247 248 if (std::isnan(d)) 248 return key;249 return jsNaN(); 249 250 250 251 int i = static_cast<int>(d);
Note: See TracChangeset
for help on using the changeset viewer.