Title: [208496] trunk
- Revision
- 208496
- Author
- sbar...@apple.com
- Date
- 2016-11-09 15:23:21 -0800 (Wed, 09 Nov 2016)
Log Message
Math.min()/Math.max() with no arguments is lowered incorrectly in the BytecodeParser
https://bugs.webkit.org/show_bug.cgi?id=164464
<rdar://problem/29131452>
Reviewed by Darin Adler.
JSTests:
* stress/math-max-min-no-arguments.js: Added.
(assert):
(min):
(max):
(test):
Source/_javascript_Core:
We were incorrectly matching this pattern inside the bytecode parser
to return NaN. Instead, we must return:
Infinity for Math.min()
-Infinity for Math.max()
* dfg/DFGByteCodeParser.cpp:
(JSC::DFG::ByteCodeParser::handleMinMax):
Modified Paths
Added Paths
Diff
Modified: trunk/JSTests/ChangeLog (208495 => 208496)
--- trunk/JSTests/ChangeLog 2016-11-09 23:18:19 UTC (rev 208495)
+++ trunk/JSTests/ChangeLog 2016-11-09 23:23:21 UTC (rev 208496)
@@ -1,5 +1,19 @@
2016-11-09 Saam Barati <sbar...@apple.com>
+ Math.min()/Math.max() with no arguments is lowered incorrectly in the BytecodeParser
+ https://bugs.webkit.org/show_bug.cgi?id=164464
+ <rdar://problem/29131452>
+
+ Reviewed by Darin Adler.
+
+ * stress/math-max-min-no-arguments.js: Added.
+ (assert):
+ (min):
+ (max):
+ (test):
+
+2016-11-09 Saam Barati <sbar...@apple.com>
+
TypeProfiler and running GC collection on another thread don't play nicely with each other
https://bugs.webkit.org/show_bug.cgi?id=164441
<rdar://problem/29132174>
Added: trunk/JSTests/stress/math-max-min-no-arguments.js (0 => 208496)
--- trunk/JSTests/stress/math-max-min-no-arguments.js (rev 0)
+++ trunk/JSTests/stress/math-max-min-no-arguments.js 2016-11-09 23:23:21 UTC (rev 208496)
@@ -0,0 +1,20 @@
+function assert(b) {
+ if (!b)
+ throw new Error("Bad!")
+}
+
+function min() {
+ return Math.min();
+}
+
+function max() {
+ return Math.max();
+}
+
+function test() {
+ for (let i = 0; i < 10000; i++) {
+ assert(min() === Infinity);
+ assert(max() === -Infinity);
+ }
+}
+test();
Modified: trunk/Source/_javascript_Core/ChangeLog (208495 => 208496)
--- trunk/Source/_javascript_Core/ChangeLog 2016-11-09 23:18:19 UTC (rev 208495)
+++ trunk/Source/_javascript_Core/ChangeLog 2016-11-09 23:23:21 UTC (rev 208496)
@@ -1,5 +1,21 @@
2016-11-09 Saam Barati <sbar...@apple.com>
+ Math.min()/Math.max() with no arguments is lowered incorrectly in the BytecodeParser
+ https://bugs.webkit.org/show_bug.cgi?id=164464
+ <rdar://problem/29131452>
+
+ Reviewed by Darin Adler.
+
+ We were incorrectly matching this pattern inside the bytecode parser
+ to return NaN. Instead, we must return:
+ Infinity for Math.min()
+ -Infinity for Math.max()
+
+ * dfg/DFGByteCodeParser.cpp:
+ (JSC::DFG::ByteCodeParser::handleMinMax):
+
+2016-11-09 Saam Barati <sbar...@apple.com>
+
TypeProfiler and running GC collection on another thread don't play nicely with each other
https://bugs.webkit.org/show_bug.cgi?id=164441
<rdar://problem/29132174>
Modified: trunk/Source/_javascript_Core/dfg/DFGByteCodeParser.cpp (208495 => 208496)
--- trunk/Source/_javascript_Core/dfg/DFGByteCodeParser.cpp 2016-11-09 23:18:19 UTC (rev 208495)
+++ trunk/Source/_javascript_Core/dfg/DFGByteCodeParser.cpp 2016-11-09 23:23:21 UTC (rev 208496)
@@ -2111,13 +2111,16 @@
template<typename ChecksFunctor>
bool ByteCodeParser::handleMinMax(int resultOperand, NodeType op, int registerOffset, int argumentCountIncludingThis, const ChecksFunctor& insertChecks)
{
- if (argumentCountIncludingThis == 1) { // Math.min()
+ ASSERT(op == ArithMin || op == ArithMax);
+
+ if (argumentCountIncludingThis == 1) {
insertChecks();
- set(VirtualRegister(resultOperand), addToGraph(JSConstant, OpInfo(m_constantNaN)));
+ double result = op == ArithMax ? -std::numeric_limits<double>::infinity() : +std::numeric_limits<double>::infinity();
+ set(VirtualRegister(resultOperand), addToGraph(JSConstant, OpInfo(m_graph.freeze(jsDoubleNumber(result)))));
return true;
}
- if (argumentCountIncludingThis == 2) { // Math.min(x)
+ if (argumentCountIncludingThis == 2) {
insertChecks();
Node* result = get(VirtualRegister(virtualRegisterForArgument(1, registerOffset)));
addToGraph(Phantom, Edge(result, NumberUse));
@@ -2125,7 +2128,7 @@
return true;
}
- if (argumentCountIncludingThis == 3) { // Math.min(x, y)
+ if (argumentCountIncludingThis == 3) {
insertChecks();
set(VirtualRegister(resultOperand), addToGraph(op, get(virtualRegisterForArgument(1, registerOffset)), get(virtualRegisterForArgument(2, registerOffset))));
return true;
_______________________________________________
webkit-changes mailing list
webkit-changes@lists.webkit.org
https://lists.webkit.org/mailman/listinfo/webkit-changes
