Changeset 267135 in webkit

Timestamp:

Sep 15, 2020 11:07:36 PM (4 years ago)

Author:

sbarati@apple.com

Message:

JSImmutableButterfly::get needs to return jsDoubleNumber for double arrays
​https://bugs.webkit.org/show_bug.cgi?id=216589
<rdar://problem/68061245>

Reviewed by Yusuke Suzuki.

JSTests:

• stress/jsimmutablebutterfly-get-must-return-double-boxed-value.js: Added.

Source/JavaScriptCore:

We are using JSImmutableButterfly::get in AI to constant fold GetByVal,
but we were failing to always return a boxed double value for double loads.
We were calling jsNumber instead of jsDooubleNumber. This is in contrast to
the runtime, which always returns a double boxed value. This would lead AI
to disagree with the runtime, and miscompile code.

• runtime/JSImmutableButterfly.h:

(JSC::JSImmutableButterfly::get const):

Location:

trunk

Files:

• JSTests/ChangeLog (modified) (1 diff)
• JSTests/stress/jsimmutablebutterfly-get-must-return-double-boxed-value.js (added)
• Source/JavaScriptCore/ChangeLog (modified) (1 diff)
• Source/JavaScriptCore/runtime/JSImmutableButterfly.h (modified) (1 diff)

trunk/JSTests/ChangeLog

@@ +1 @@
+2020-09-15  Saam Barati  <sbarati@apple.com>
+
+        JSImmutableButterfly::get needs to return jsDoubleNumber for double arrays
+        https://bugs.webkit.org/show_bug.cgi?id=216589
+        <rdar://problem/68061245>
+
+        Reviewed by Yusuke Suzuki.
+
+        * stress/jsimmutablebutterfly-get-must-return-double-boxed-value.js: Added.
+
 2020-09-15  Yusuke Suzuki  <ysuzuki@apple.com>
 

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2020-09-15  Saam Barati  <sbarati@apple.com>
+
+        JSImmutableButterfly::get needs to return jsDoubleNumber for double arrays
+        https://bugs.webkit.org/show_bug.cgi?id=216589
+        <rdar://problem/68061245>
+
+        Reviewed by Yusuke Suzuki.
+
+        We are using JSImmutableButterfly::get in AI to constant fold GetByVal,
+        but we were failing to always return a boxed double value for double loads.
+        We were calling jsNumber instead of jsDooubleNumber. This is in contrast to
+        the runtime, which always returns a double boxed value. This would lead AI
+        to disagree with the runtime, and miscompile code.
+
+        * runtime/JSImmutableButterfly.h:
+        (JSC::JSImmutableButterfly::get const):
+
 2020-09-15  Yusuke Suzuki  <ysuzuki@apple.com>
 

trunk/Source/JavaScriptCore/runtime/JSImmutableButterfly.h

@@ -143 +143 @@
         // Holes are not supported yet.
         ASSERT(!std::isnan(value));
-        return jsNumber(value);
+        return jsDoubleNumber(value);
     }