Title: [183692] trunk/Source/_javascript_Core
- Revision
- 183692
- Author
- [email protected]
- Date
- 2015-05-01 15:35:36 -0700 (Fri, 01 May 2015)
Log Message
Math.abs() returns negative
https://bugs.webkit.org/show_bug.cgi?id=137827
Reviewed by Michael Saboff.
Math.abs() on doubles was mistakenly assumed by the DFG AI to be the
identity function.
* dfg/DFGAbstractInterpreterInlines.h:
(JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
* tests/stress/math-abs-positive.js: Added, was previously failing.
(foo):
Modified Paths
Added Paths
Diff
Modified: trunk/Source/_javascript_Core/ChangeLog (183691 => 183692)
--- trunk/Source/_javascript_Core/ChangeLog 2015-05-01 22:33:32 UTC (rev 183691)
+++ trunk/Source/_javascript_Core/ChangeLog 2015-05-01 22:35:36 UTC (rev 183692)
@@ -1,5 +1,20 @@
2015-05-01 Basile Clement <[email protected]>
+ Math.abs() returns negative
+ https://bugs.webkit.org/show_bug.cgi?id=137827
+
+ Reviewed by Michael Saboff.
+
+ Math.abs() on doubles was mistakenly assumed by the DFG AI to be the
+ identity function.
+
+ * dfg/DFGAbstractInterpreterInlines.h:
+ (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+ * tests/stress/math-abs-positive.js: Added, was previously failing.
+ (foo):
+
+2015-05-01 Basile Clement <[email protected]>
+
Function allocation sinking shouldn't be performed on singleton functions
https://bugs.webkit.org/show_bug.cgi?id=144166
Modified: trunk/Source/_javascript_Core/dfg/DFGAbstractInterpreterInlines.h (183691 => 183692)
--- trunk/Source/_javascript_Core/dfg/DFGAbstractInterpreterInlines.h 2015-05-01 22:33:32 UTC (rev 183691)
+++ trunk/Source/_javascript_Core/dfg/DFGAbstractInterpreterInlines.h 2015-05-01 22:35:36 UTC (rev 183692)
@@ -732,7 +732,7 @@
break;
case DoubleRepUse:
if (child && child.isNumber()) {
- setConstant(node, jsDoubleNumber(child.asNumber()));
+ setConstant(node, jsDoubleNumber(fabs(child.asNumber())));
break;
}
forNode(node).setType(typeOfDoubleAbs(forNode(node->child1()).m_type));
Added: trunk/Source/_javascript_Core/tests/stress/math-abs-positive.js (0 => 183692)
--- trunk/Source/_javascript_Core/tests/stress/math-abs-positive.js (rev 0)
+++ trunk/Source/_javascript_Core/tests/stress/math-abs-positive.js 2015-05-01 22:35:36 UTC (rev 183692)
@@ -0,0 +1,11 @@
+var minus_three_quarters = -0.75;
+
+function foo() {
+ return Math.abs(minus_three_quarters);
+}
+
+for (var i = 0; i < 10000; i++) {
+ var result = foo();
+ if (result < 0)
+ throw "Error: Math.abs returned a negative value.";
+}
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
