Attachment 340263 Details for Bug 182214 – Patch

[patch] Patch

bug-182214-20180513122940.patch (text/plain), 45.75 KB, created by Caio Lima on 2018-05-13 08:29:43 PDT

(hide)

Description:

Filename:

MIME Type:

Creator: Caio Lima

Created: 2018-05-13 08:29:43 PDT

Size: 45.75 KB

patch

obsolete

>Subversion Revision: 231740
>diff --git a/Source/JavaScriptCore/ChangeLog b/Source/JavaScriptCore/ChangeLog
>index 01f57c79a7c5bc9685ac11b96536a47e51d44d17..9b642beef28df54ef6b6d91be39ecd9b1588f15e 100644
>--- a/Source/JavaScriptCore/ChangeLog
>+++ b/Source/JavaScriptCore/ChangeLog
>@@ -1,3 +1,90 @@
>+2018-05-13  Caio Lima  <ticaiolima@gmail.com>
>+
>+        [ESNext][BigInt] Implement "+" and "-" unary operation
>+        https://bugs.webkit.org/show_bug.cgi?id=182214
>+
>+        Reviewed by NOBODY (OOPS!).
>+
>+        This Patch is implementing support to "-" unary operation on BigInt.
>+        It is also changing the logic of ASTBuilder::makeNegateNode to
>+        calculate BigInt literals with properly sign, avoiding
>+        unecessary operation. It required a refactoring into
>+        JSBigInt::parseInt to consider the sign as parameter.
>+
>+        We are also introducing a new DFG Node called ValueNegate to handle BigInt negate
>+        operations. With the introduction of BigInt, it is not true
>+        that every negate operation returns a Number. As ArithNegate is a
>+        node that considers its result is always a Number, like all other
>+        Arith<Operation>, we decided to keep this consistency and use ValueNegate when
>+        speculation indicates that the operand is a BigInt.
>+        This design is following the same distinction between ArithAdd and
>+        ValueAdd. Also, this new node will make simpler the introduction of
>+        optimizations when we create speculation paths for BigInt in future
>+        patches.
>+
>+        In the case of "+" unary operation on BigInt, the current semantic we already have
>+        is correctly, since it needs to throw TypeError because of ToNumber call[1].
>+        In such case, we are adding tests to verify other edge cases.
>+
>+        [1] - https://tc39.github.io/proposal-bigint/#sec-unary-plus-operator
>+
>+        * bytecompiler/BytecodeGenerator.cpp:
>+        (JSC::BytecodeGenerator::addBigIntConstant):
>+        * bytecompiler/BytecodeGenerator.h:
>+        * bytecompiler/NodesCodegen.cpp:
>+        (JSC::BigIntNode::jsValue const):
>+        * dfg/DFGAbstractInterpreterInlines.h:
>+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
>+        * dfg/DFGBackwardsPropagationPhase.cpp:
>+        (JSC::DFG::BackwardsPropagationPhase::propagate):
>+        * dfg/DFGByteCodeParser.cpp:
>+        (JSC::DFG::ByteCodeParser::makeSafe):
>+        (JSC::DFG::ByteCodeParser::parseBlock):
>+        * dfg/DFGClobberize.h:
>+        (JSC::DFG::clobberize):
>+        * dfg/DFGConstantFoldingPhase.cpp:
>+        (JSC::DFG::ConstantFoldingPhase::foldConstants):
>+        * dfg/DFGDoesGC.cpp:
>+        (JSC::DFG::doesGC):
>+        * dfg/DFGFixupPhase.cpp:
>+        (JSC::DFG::FixupPhase::fixupNode):
>+        * dfg/DFGNode.h:
>+        (JSC::DFG::Node::arithNodeFlags):
>+        * dfg/DFGNodeType.h:
>+        * dfg/DFGPredictionPropagationPhase.cpp:
>+        * dfg/DFGSafeToExecute.h:
>+        (JSC::DFG::safeToExecute):
>+        * dfg/DFGSpeculativeJIT.cpp:
>+        (JSC::DFG::SpeculativeJIT::compileValueNegate):
>+        * dfg/DFGSpeculativeJIT.h:
>+        * dfg/DFGSpeculativeJIT32_64.cpp:
>+        (JSC::DFG::SpeculativeJIT::compile):
>+        * dfg/DFGSpeculativeJIT64.cpp:
>+        (JSC::DFG::SpeculativeJIT::compile):
>+        * ftl/FTLCapabilities.cpp:
>+        (JSC::FTL::canCompile):
>+        * ftl/FTLLowerDFGToB3.cpp:
>+        (JSC::FTL::DFG::LowerDFGToB3::compileNode):
>+        (JSC::FTL::DFG::LowerDFGToB3::compileValueNegate):
>+        * jit/JITOperations.cpp:
>+        * parser/ASTBuilder.h:
>+        (JSC::ASTBuilder::createBigIntWithSign):
>+        (JSC::ASTBuilder::createBigIntFromUnaryOperation):
>+        (JSC::ASTBuilder::makeNegateNode):
>+        * parser/NodeConstructors.h:
>+        (JSC::BigIntNode::BigIntNode):
>+        * parser/Nodes.h:
>+        * runtime/CommonSlowPaths.cpp:
>+        (JSC::updateArithProfileForUnaryArithOp):
>+        (JSC::SLOW_PATH_DECL):
>+        * runtime/JSBigInt.cpp:
>+        (JSC::JSBigInt::parseInt):
>+        (JSC::JSBigInt::copy):
>+        (JSC::JSBigInt::unaryMinus):
>+        * runtime/JSBigInt.h:
>+        * runtime/JSCJSValueInlines.h:
>+        (JSC::JSValue::strictEqualSlowCaseInline):
>+
> 2018-05-13  Andy VanWagoner  <andy@vanwagoner.family>
> 
>         [INTL] Improve spec & test262 compliance for Intl APIs
>diff --git a/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp b/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp
>index 6d6449b30e278c3efae7082ee9e7005efd0b59b6..d67ff40fca79a6fe1a6be59faf2f1b071c075520 100644
>--- a/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp
>+++ b/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp
>@@ -3141,11 +3141,12 @@ RegisterID* BytecodeGenerator::emitNewObject(RegisterID* dst)
>     return dst;
> }
> 
>-JSValue BytecodeGenerator::addBigIntConstant(const Identifier& identifier, uint8_t radix)
>+JSValue BytecodeGenerator::addBigIntConstant(const Identifier& identifier, uint8_t radix, bool sign)
> {
>-    return m_bigIntMap.ensure(BigIntMapEntry(identifier.impl(), radix), [&] {
>+    return m_bigIntMap.ensure(BigIntMapEntry(identifier.impl(), radix, sign), [&] {
>         auto scope = DECLARE_CATCH_SCOPE(*vm());
>-        JSBigInt* bigIntInMap = JSBigInt::parseInt(nullptr, *vm(), identifier.string(), radix);
>+        auto parseIntSign = sign ? JSBigInt::ParseIntSign::Signed : JSBigInt::ParseIntSign::Unsigned;
>+        JSBigInt* bigIntInMap = JSBigInt::parseInt(nullptr, *vm(), identifier.string(), radix, JSBigInt::ErrorParseMode::ThrowExceptions, parseIntSign);
>         // FIXME: [ESNext] Enables a way to throw an error on ByteCodeGenerator step
>         // https://bugs.webkit.org/show_bug.cgi?id=180139
>         scope.assertNoException();
>diff --git a/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.h b/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.h
>index b7255ac6216e09dce1ad4d7c669ec546a2cb4673..f6e6eb0a9c1971e43503b52dfd50e9001248689b 100644
>--- a/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.h
>+++ b/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.h
>@@ -1023,7 +1023,7 @@ namespace JSC {
>         void allocateCalleeSaveSpace();
>         void allocateAndEmitScope();
> 
>-        using BigIntMapEntry = std::pair<UniquedStringImpl*, uint8_t>;
>+        using BigIntMapEntry = std::tuple<UniquedStringImpl*, uint8_t, bool>;
> 
>         using NumberMap = HashMap<double, JSValue>;
>         using IdentifierStringMap = HashMap<UniquedStringImpl*, JSString*, IdentifierRepHash>;
>@@ -1112,7 +1112,7 @@ namespace JSC {
> 
>     public:
>         JSString* addStringConstant(const Identifier&);
>-        JSValue addBigIntConstant(const Identifier&, uint8_t radix);
>+        JSValue addBigIntConstant(const Identifier&, uint8_t radix, bool sign);
>         RegisterID* addTemplateObjectConstant(Ref<TemplateObjectDescriptor>&&);
> 
>         Vector<UnlinkedInstruction, 0, UnsafeVectorOverflow>& instructions() { return m_instructions; }
>diff --git a/Source/JavaScriptCore/bytecompiler/NodesCodegen.cpp b/Source/JavaScriptCore/bytecompiler/NodesCodegen.cpp
>index 07a9c907a7e2130a4244dfa0011f7ca52b06e8a6..6cbaeff62798f11d72c709a9fd90379c4f72bf73 100644
>--- a/Source/JavaScriptCore/bytecompiler/NodesCodegen.cpp
>+++ b/Source/JavaScriptCore/bytecompiler/NodesCodegen.cpp
>@@ -124,7 +124,7 @@ JSValue StringNode::jsValue(BytecodeGenerator& generator) const
> 
> JSValue BigIntNode::jsValue(BytecodeGenerator& generator) const
> {
>-    return generator.addBigIntConstant(m_value, m_radix);
>+    return generator.addBigIntConstant(m_value, m_radix, m_sign);
> }
> 
> // ------------------------------ NumberNode ----------------------------------
>diff --git a/Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h b/Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h
>index 84844e4191026a6573dc8e82e0b5199d692c4dc7..120ec2402a6980fa2dfc126c35dd51b33ecfd787 100644
>--- a/Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h
>+++ b/Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h
>@@ -761,6 +761,12 @@ bool AbstractInterpreter<AbstractStateType>::executeEffects(unsigned clobberLimi
>         break;
>     }
>         
>+    case ValueNegate: {
>+        clobberWorld();
>+        forNode(node).setType(m_graph, SpecBytecodeNumber | SpecBigInt);
>+        break;
>+    }
>+
>     case ArithNegate: {
>         JSValue child = forNode(node->child1()).value();
>         switch (node->child1().useKind()) {
>diff --git a/Source/JavaScriptCore/dfg/DFGBackwardsPropagationPhase.cpp b/Source/JavaScriptCore/dfg/DFGBackwardsPropagationPhase.cpp
>index 9547f89661a25a1fa762d69c8c76769d3861b879..0eae1293c82d0fae5810467e8a27a827107c1307 100644
>--- a/Source/JavaScriptCore/dfg/DFGBackwardsPropagationPhase.cpp
>+++ b/Source/JavaScriptCore/dfg/DFGBackwardsPropagationPhase.cpp
>@@ -307,7 +307,7 @@ private:
>             node->child2()->mergeFlags(flags);
>             break;
>         }
>-            
>+
>         case ArithNegate: {
>             flags &= ~NodeBytecodeUsesAsOther;
> 
>diff --git a/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp b/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp
>index 4059022f0ceba51d305b5ecdd238fa969f0d5018..9132300de93229d2efa3a1bfb75aaef2656fba20 100644
>--- a/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp
>+++ b/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp
>@@ -935,17 +935,19 @@ private:
>                         node->mergeFlags(NodeMayHaveNonNumberResult);
>                     break;
>                 }
>+                case ValueNegate:
>                 case ArithNegate: {
>-                    // We'd like to assert here that the arith profile for the result of negate never
>-                    // sees a non-number, but we can't. It's true that negate never produces a non-number.
>-                    // But sometimes we'll end up grabbing the wrong ArithProfile during OSR exit, and
>-                    // profiling the wrong value, leading the ArithProfile to think it observed a non-number result.
>                     if (arithProfile->lhsObservedType().sawNumber() || arithProfile->didObserveDouble())
>                         node->mergeFlags(NodeMayHaveDoubleResult);
>                     if (arithProfile->didObserveNegZeroDouble() || m_inlineStackTop->m_exitProfile.hasExitSite(m_currentIndex, NegativeZero))
>                         node->mergeFlags(NodeMayNegZeroInBaseline);
>                     if (arithProfile->didObserveInt32Overflow() || m_inlineStackTop->m_exitProfile.hasExitSite(m_currentIndex, Overflow))
>                         node->mergeFlags(NodeMayOverflowInt32InBaseline);
>+                    if (arithProfile->didObserveNonNumber()) {
>+                        // FIXME: We should add support to BigInt into speculation
>+                        // https://bugs.webkit.org/show_bug.cgi?id=182470
>+                        node->mergeFlags(NodeMayHaveNonNumberResult);
>+                    }
>                     break;
>                 }
>                 
>@@ -4709,7 +4711,10 @@ void ByteCodeParser::parseBlock(unsigned limit)
> 
>         case op_negate: {
>             Node* op1 = get(VirtualRegister(currentInstruction[2].u.operand));
>-            set(VirtualRegister(currentInstruction[1].u.operand), makeSafe(addToGraph(ArithNegate, op1)));
>+            if (op1->hasNumberResult())
>+                set(VirtualRegister(currentInstruction[1].u.operand), makeSafe(addToGraph(ArithNegate, op1)));
>+            else
>+                set(VirtualRegister(currentInstruction[1].u.operand), makeSafe(addToGraph(ValueNegate, op1)));
>             NEXT_OPCODE(op_negate);
>         }
> 
>diff --git a/Source/JavaScriptCore/dfg/DFGClobberize.h b/Source/JavaScriptCore/dfg/DFGClobberize.h
>index ceeced85d9e7766c0da886a8d43aed336da9370e..939c8e923b1c34d3d9582e77f11b1e54c5604dc8 100644
>--- a/Source/JavaScriptCore/dfg/DFGClobberize.h
>+++ b/Source/JavaScriptCore/dfg/DFGClobberize.h
>@@ -623,6 +623,7 @@ void clobberize(Graph& graph, Node* node, const ReadFunctor& read, const WriteFu
>     case ToPrimitive:
>     case In:
>     case HasOwnProperty:
>+    case ValueNegate:
>     case ValueAdd:
>     case SetFunctionName:
>     case GetDynamicVar:
>diff --git a/Source/JavaScriptCore/dfg/DFGDoesGC.cpp b/Source/JavaScriptCore/dfg/DFGDoesGC.cpp
>index 974d971366ffd8b79786fbb26ded3ac25b687fda..c4f3db4acde40adc1dc2fa99cec84f932ce7866f 100644
>--- a/Source/JavaScriptCore/dfg/DFGDoesGC.cpp
>+++ b/Source/JavaScriptCore/dfg/DFGDoesGC.cpp
>@@ -97,6 +97,7 @@ bool doesGC(Graph& graph, Node* node)
>     case ArithFRound:
>     case ArithUnary:
>     case ValueAdd:
>+    case ValueNegate:
>     case TryGetById:
>     case GetById:
>     case GetByIdFlush:
>diff --git a/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp b/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp
>index 1e6c13695b96a3219a8d5a70a35810b7528b5a11..31181e4236628de5c57c1371cc23e3897282e3ae 100644
>--- a/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp
>+++ b/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp
>@@ -146,7 +146,45 @@ private:
>             }
>             break;
>         }
>+
>+        case ValueNegate: {
>+            if (node->child1()->shouldSpeculateInt32OrBoolean() && node->canSpeculateInt32(FixupPass)) {
>+                node->setOp(ArithNegate);
>+                fixIntOrBooleanEdge(node->child1());
>+                if (bytecodeCanTruncateInteger(node->arithNodeFlags()))
>+                    node->setArithMode(Arith::Unchecked);
>+                else if (bytecodeCanIgnoreNegativeZero(node->arithNodeFlags()))
>+                    node->setArithMode(Arith::CheckOverflow);
>+                else
>+                    node->setArithMode(Arith::CheckOverflowAndNegativeZero);
>+                node->setResult(NodeResultInt32);
>+                node->clearFlags(NodeMustGenerate);
>+                break;
>+            }
>             
>+            if (m_graph.unaryArithShouldSpeculateAnyInt(node, FixupPass)) {
>+                node->setOp(ArithNegate);
>+                fixEdge<Int52RepUse>(node->child1());
>+                if (bytecodeCanIgnoreNegativeZero(node->arithNodeFlags()))
>+                    node->setArithMode(Arith::CheckOverflow);
>+                else
>+                    node->setArithMode(Arith::CheckOverflowAndNegativeZero);
>+                node->setResult(NodeResultInt52);
>+                node->clearFlags(NodeMustGenerate);
>+                break;
>+            }
>+            if (node->child1()->shouldSpeculateNotCell()) {
>+                node->setOp(ArithNegate);
>+                fixDoubleOrBooleanEdge(node->child1());
>+                node->setResult(NodeResultDouble);
>+                node->clearFlags(NodeMustGenerate);
>+            } else {
>+                fixEdge<UntypedUse>(node->child1());
>+                node->setResult(NodeResultJS);
>+            }
>+            break;
>+        }
>+
>         case ValueAdd: {
>             if (attemptToMakeIntegerAdd(node)) {
>                 node->setOp(ArithAdd);
>diff --git a/Source/JavaScriptCore/dfg/DFGNode.h b/Source/JavaScriptCore/dfg/DFGNode.h
>index 4d97cd3ab127d30bbf46ac739edbf1bea85c130d..6fea62e35d08780e8172a949fe670cfeb609aea1 100644
>--- a/Source/JavaScriptCore/dfg/DFGNode.h
>+++ b/Source/JavaScriptCore/dfg/DFGNode.h
>@@ -1088,7 +1088,7 @@ public:
>     NodeFlags arithNodeFlags()
>     {
>         NodeFlags result = m_flags & NodeArithFlagsMask;
>-        if (op() == ArithMul || op() == ArithDiv || op() == ArithMod || op() == ArithNegate || op() == ArithPow || op() == ArithRound || op() == ArithFloor || op() == ArithCeil || op() == ArithTrunc || op() == DoubleAsInt32)
>+        if (op() == ArithMul || op() == ArithDiv || op() == ArithMod || op() == ArithNegate || op() == ArithPow || op() == ArithRound || op() == ArithFloor || op() == ArithCeil || op() == ArithTrunc || op() == DoubleAsInt32 || op() == ValueNegate)
>             return result;
>         return result & ~NodeBytecodeNeedsNegZero;
>     }
>diff --git a/Source/JavaScriptCore/dfg/DFGNodeType.h b/Source/JavaScriptCore/dfg/DFGNodeType.h
>index 48e0d996aae2df3cbe8f6701361251deed71552f..8c3437790a8741492c1e299e76ee4314e4d9616f 100644
>--- a/Source/JavaScriptCore/dfg/DFGNodeType.h
>+++ b/Source/JavaScriptCore/dfg/DFGNodeType.h
>@@ -162,6 +162,9 @@ namespace JSC { namespace DFG {
>     macro(ArithSqrt, NodeResultDouble | NodeMustGenerate) \
>     macro(ArithUnary, NodeResultDouble | NodeMustGenerate) \
>     \
>+    /* BigInt is a valid operand for negate operations */\
>+    macro(ValueNegate, NodeResultJS | NodeMustGenerate) \
>+    \
>     /* Add of values may either be arithmetic, or result in string concatenation. */\
>     macro(ValueAdd, NodeResultJS | NodeMustGenerate) \
>     \
>diff --git a/Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp b/Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp
>index 4bcb02c6085ca100685f3f5917f3855f1a1cb431..4a0db207d289de6d76aea73a35c4eba06ceb114f 100644
>--- a/Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp
>+++ b/Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp
>@@ -245,6 +245,7 @@ private:
>             break;
>         }
> 
>+        case ValueNegate:
>         case ArithNegate: {
>             SpeculatedType prediction = node->child1()->prediction();
>             if (prediction) {
>@@ -256,6 +257,8 @@ private:
>                     changed |= mergePrediction(speculatedDoubleTypeForPrediction(node->child1()->prediction()));
>                 else {
>                     changed |= mergePrediction(SpecInt32Only);
>+                    if (node->op() == ValueNegate && node->mayHaveNonNumberResult())
>+                        changed |= mergePrediction(SpecBigInt);
>                     if (node->mayHaveDoubleResult())
>                         changed |= mergePrediction(SpecBytecodeDouble);
>                 }
>@@ -1036,6 +1039,7 @@ private:
>         case GetLocal:
>         case SetLocal:
>         case UInt32ToNumber:
>+        case ValueNegate:
>         case ValueAdd:
>         case ArithAdd:
>         case ArithSub:
>diff --git a/Source/JavaScriptCore/dfg/DFGSafeToExecute.h b/Source/JavaScriptCore/dfg/DFGSafeToExecute.h
>index f183ae949e4457e6b394b61d8e4f47f326d49e9c..7a48dce72c672ecf7126a9c40ccf698ab67f9274 100644
>--- a/Source/JavaScriptCore/dfg/DFGSafeToExecute.h
>+++ b/Source/JavaScriptCore/dfg/DFGSafeToExecute.h
>@@ -219,6 +219,7 @@ bool safeToExecute(AbstractStateType& state, Graph& graph, Node* node)
>     case ArithCeil:
>     case ArithTrunc:
>     case ArithUnary:
>+    case ValueNegate:
>     case ValueAdd:
>     case TryGetById:
>     case DeleteById:
>diff --git a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp
>index 6653642951eeb3bbd2aa0ee8e21b8df36f6c5494..c4c46619e0d45393cabbceae25aae4c168761505 100644
>--- a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp
>+++ b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp
>@@ -4520,6 +4520,19 @@ void SpeculativeJIT::compileArithSub(Node* node)
>     }
> }
> 
>+void SpeculativeJIT::compileValueNegate(Node* node)
>+{
>+    CodeBlock* baselineCodeBlock = m_jit.graph().baselineCodeBlockFor(node->origin.semantic);
>+    ArithProfile* arithProfile = baselineCodeBlock->arithProfileForBytecodeOffset(node->origin.semantic.bytecodeIndex);
>+    Instruction* instruction = &baselineCodeBlock->instructions()[node->origin.semantic.bytecodeIndex];
>+    JITNegIC* negIC = m_jit.codeBlock()->addJITNegIC(arithProfile, instruction);
>+    auto repatchingFunction = operationArithNegateOptimize;
>+    auto nonRepatchingFunction = operationArithNegate;
>+    bool needsScratchGPRReg = true;
>+    compileMathIC(node, negIC, needsScratchGPRReg, repatchingFunction, nonRepatchingFunction);
>+    return;
>+}
>+
> void SpeculativeJIT::compileArithNegate(Node* node)
> {
>     switch (node->child1().useKind()) {
>diff --git a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h
>index 055ff4ed240bd24a9f3c1fb56123949aa4964257..19ba3c73907ff067d198b0768cdbbabae09d8756 100644
>--- a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h
>+++ b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h
>@@ -1347,6 +1347,7 @@ public:
>     void compileArithAbs(Node*);
>     void compileArithClz32(Node*);
>     void compileArithSub(Node*);
>+    void compileValueNegate(Node*);
>     void compileArithNegate(Node*);
>     void compileArithMul(Node*);
>     void compileArithDiv(Node*);
>diff --git a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp
>index c9fc1570733e7799a663cbe7fd47323d679a3d3c..872be49205b7a8f25f6e1da851c45e6d4e7c7e2f 100644
>--- a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp
>+++ b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp
>@@ -2015,6 +2015,10 @@ void SpeculativeJIT::compile(Node* node)
>         break;
>     }
> 
>+    case ValueNegate:
>+        compileValueNegate(node);
>+        break;
>+
>     case ValueAdd:
>         compileValueAdd(node);
>         break;
>diff --git a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp
>index 5db9859523d51c1b3faaa2591a5f12496e799649..95e923194d3ef13f71a52b6f1eb17bef17ff3033 100644
>--- a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp
>+++ b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp
>@@ -2167,6 +2167,10 @@ void SpeculativeJIT::compile(Node* node)
>         break;
>     }
> 
>+    case ValueNegate:
>+        compileValueNegate(node);
>+        break;
>+
>     case ValueAdd:
>         compileValueAdd(node);
>         break;
>diff --git a/Source/JavaScriptCore/ftl/FTLCapabilities.cpp b/Source/JavaScriptCore/ftl/FTLCapabilities.cpp
>index 06863d0e22d64e6a1b13373bb13b0b743a5cc2ed..d21afb3f36eafc66f38ab05d52366e8dc21623a5 100644
>--- a/Source/JavaScriptCore/ftl/FTLCapabilities.cpp
>+++ b/Source/JavaScriptCore/ftl/FTLCapabilities.cpp
>@@ -86,6 +86,7 @@ inline CapabilityLevel canCompile(Node* node)
>     case GetGlobalVar:
>     case GetGlobalLexicalVariable:
>     case PutGlobalVariable:
>+    case ValueNegate:
>     case ValueAdd:
>     case StrCat:
>     case ArithAdd:
>diff --git a/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp b/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp
>index 1a92f0604cb34516e65a67eb46f64309ca24f738..f3ef8930bac35dea52f65f9e9b60f601b8422c41 100644
>--- a/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp
>+++ b/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp
>@@ -583,6 +583,9 @@ private:
>         case ToThis:
>             compileToThis();
>             break;
>+        case ValueNegate:
>+            compileValueNegate();
>+            break;
>         case ValueAdd:
>             compileValueAdd();
>             break;
>@@ -2702,7 +2705,18 @@ private:
>         LValue result = vmCall(Double, m_out.operation(operationArithFRound), m_callFrame, argument);
>         setDouble(result);
>     }
>-    
>+
>+    void compileValueNegate()
>+    {
>+        DFG_ASSERT(m_graph, m_node, m_node->child1().useKind() == UntypedUse);
>+        CodeBlock* baselineCodeBlock = m_ftlState.graph.baselineCodeBlockFor(m_node->origin.semantic);
>+        ArithProfile* arithProfile = baselineCodeBlock->arithProfileForBytecodeOffset(m_node->origin.semantic.bytecodeIndex);
>+        Instruction* instruction = &baselineCodeBlock->instructions()[m_node->origin.semantic.bytecodeIndex];
>+        auto repatchingFunction = operationArithNegateOptimize;
>+        auto nonRepatchingFunction = operationArithNegate;
>+        compileUnaryMathIC<JITNegGenerator>(arithProfile, instruction, repatchingFunction, nonRepatchingFunction);
>+    }
>+
>     void compileArithNegate()
>     {
>         switch (m_node->child1().useKind()) {
>diff --git a/Source/JavaScriptCore/jit/JITOperations.cpp b/Source/JavaScriptCore/jit/JITOperations.cpp
>index b288d1e2bc31cbf499c40eeca6570ee1f4f9ceff..e08f3aaefd45fab8d29f18933d7eb5c07bcc8997 100644
>--- a/Source/JavaScriptCore/jit/JITOperations.cpp
>+++ b/Source/JavaScriptCore/jit/JITOperations.cpp
>@@ -2655,7 +2655,14 @@ ALWAYS_INLINE static EncodedJSValue unprofiledNegate(ExecState* exec, EncodedJSV
>     NativeCallFrameTracer tracer(&vm, exec);
>     
>     JSValue operand = JSValue::decode(encodedOperand);
>-    double number = operand.toNumber(exec);
>+    
>+    JSValue primValue = operand.toPrimitive(exec, PreferNumber);
>+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
>+    
>+    if (primValue.isBigInt())
>+        return JSValue::encode(JSValue(JSBigInt::unaryMinus(exec, asBigInt(primValue))));
>+    
>+    double number = primValue.toNumber(exec);
>     RETURN_IF_EXCEPTION(scope, encodedJSValue());
>     return JSValue::encode(jsNumber(-number));
> }
>@@ -2668,9 +2675,19 @@ ALWAYS_INLINE static EncodedJSValue profiledNegate(ExecState* exec, EncodedJSVal
> 
>     JSValue operand = JSValue::decode(encodedOperand);
>     arithProfile.observeLHS(operand);
>-    double number = operand.toNumber(exec);
>+    
>+    JSValue primValue = operand.toPrimitive(exec);
>     RETURN_IF_EXCEPTION(scope, encodedJSValue());
>+    
>+    if (primValue.isBigInt()) {
>+        JSValue result = JSValue(JSBigInt::unaryMinus(exec, asBigInt(primValue)));
>+        arithProfile.observeResult(result);
>+
>+        return JSValue::encode(result);
>+    }
> 
>+    double number = primValue.toNumber(exec);
>+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
>     JSValue result = jsNumber(-number);
>     arithProfile.observeResult(result);
>     return JSValue::encode(result);
>@@ -2704,7 +2721,16 @@ EncodedJSValue JIT_OPERATION operationArithNegateProfiledOptimize(ExecState* exe
>     exec->codeBlock()->dumpMathICStats();
> #endif
>     
>-    double number = operand.toNumber(exec);
>+    JSValue primValue = operand.toPrimitive(exec);
>+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
>+    
>+    if (primValue.isBigInt()) {
>+        JSValue result = JSValue(JSBigInt::unaryMinus(exec, asBigInt(primValue)));
>+        arithProfile->observeResult(result);
>+        return JSValue::encode(result);
>+    }
>+
>+    double number = primValue.toNumber(exec);
>     RETURN_IF_EXCEPTION(scope, encodedJSValue());
>     JSValue result = jsNumber(-number);
>     arithProfile->observeResult(result);
>@@ -2727,7 +2753,15 @@ EncodedJSValue JIT_OPERATION operationArithNegateOptimize(ExecState* exec, Encod
>     exec->codeBlock()->dumpMathICStats();
> #endif
> 
>-    double number = operand.toNumber(exec);
>+    JSValue primValue = operand.toPrimitive(exec);
>+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
>+    
>+    if (primValue.isBigInt()) {
>+        JSValue result = JSValue(JSBigInt::unaryMinus(exec, asBigInt(primValue)));
>+        return JSValue::encode(result);
>+    }
>+
>+    double number = primValue.toNumber(exec);
>     RETURN_IF_EXCEPTION(scope, encodedJSValue());
>     return JSValue::encode(jsNumber(-number));
> }
>diff --git a/Source/JavaScriptCore/parser/ASTBuilder.h b/Source/JavaScriptCore/parser/ASTBuilder.h
>index 5c6dd33198ca2f94505358cdf94b605c9be7e812..65ad1070fbb2203dc73c5fe73971c778471747a5 100644
>--- a/Source/JavaScriptCore/parser/ASTBuilder.h
>+++ b/Source/JavaScriptCore/parser/ASTBuilder.h
>@@ -1072,6 +1072,10 @@ private:
>     {
>         return new (m_parserArena) DoubleNode(location, d);
>     }
>+    ExpressionNode* createBigIntWithSign(const JSTokenLocation& location, const Identifier& bigInt, uint8_t radix, bool sign)
>+    {
>+        return new (m_parserArena) BigIntNode(location, bigInt, radix, sign);
>+    }
>     ExpressionNode* createNumberFromBinaryOperation(const JSTokenLocation& location, double value, const NumberNode& originalNodeA, const NumberNode& originalNodeB)
>     {
>         if (originalNodeA.isIntegerNode() && originalNodeB.isIntegerNode())
>@@ -1084,6 +1088,10 @@ private:
>             return createIntegerLikeNumber(location, value);
>         return createDoubleLikeNumber(location, value);
>     }
>+    ExpressionNode* createBigIntFromUnaryOperation(const JSTokenLocation& location, bool sign, const BigIntNode& originalNode)
>+    {
>+        return createBigIntWithSign(location, originalNode.identifier(), originalNode.radix(), sign);
>+    }
> 
>     void tryInferNameInPattern(DestructuringPattern pattern, ExpressionNode* defaultValue)
>     {
>@@ -1156,6 +1164,11 @@ ExpressionNode* ASTBuilder::makeNegateNode(const JSTokenLocation& location, Expr
>         return createNumberFromUnaryOperation(location, -numberNode.value(), numberNode);
>     }
> 
>+    if (n->isBigInt()) {
>+        const BigIntNode& bigIntNode = static_cast<const BigIntNode&>(*n);
>+        return createBigIntFromUnaryOperation(location, !bigIntNode.sign(), bigIntNode);
>+    }
>+
>     return new (m_parserArena) NegateNode(location, n);
> }
> 
>diff --git a/Source/JavaScriptCore/parser/NodeConstructors.h b/Source/JavaScriptCore/parser/NodeConstructors.h
>index e6f03b65b75d00252f043ec9931fbba504b93cde..573a6628cf3b00415d2c7e6d313f812a94775c1a 100644
>--- a/Source/JavaScriptCore/parser/NodeConstructors.h
>+++ b/Source/JavaScriptCore/parser/NodeConstructors.h
>@@ -97,6 +97,15 @@ namespace JSC {
>         : ConstantNode(location, ResultType::bigIntType())
>         , m_value(value)
>         , m_radix(radix)
>+        , m_sign(false)
>+    {
>+    }
>+    
>+    inline BigIntNode::BigIntNode(const JSTokenLocation& location, const Identifier& value, uint8_t radix, bool sign)
>+        : ConstantNode(location, ResultType::bigIntType())
>+        , m_value(value)
>+        , m_radix(radix)
>+        , m_sign(sign)
>     {
>     }
> 
>diff --git a/Source/JavaScriptCore/parser/Nodes.h b/Source/JavaScriptCore/parser/Nodes.h
>index 6c0f2dbd0c11adb42c0dec69e4d0dee1adc71cd1..4365637c882155b0ccca99c2fc2e5587740fc783 100644
>--- a/Source/JavaScriptCore/parser/Nodes.h
>+++ b/Source/JavaScriptCore/parser/Nodes.h
>@@ -345,14 +345,20 @@ namespace JSC {
>     class BigIntNode final : public ConstantNode {
>     public:
>         BigIntNode(const JSTokenLocation&, const Identifier&, uint8_t radix);
>+        BigIntNode(const JSTokenLocation&, const Identifier&, uint8_t radix, bool sign);
>         const Identifier& value() { return m_value; }
> 
>+        const Identifier& identifier() const { return m_value; }
>+        uint8_t radix() const { return m_radix; }
>+        bool sign() const { return m_sign; }
>+
>     private:
>         bool isBigInt() const final { return true; }
>         JSValue jsValue(BytecodeGenerator&) const final;
> 
>         const Identifier& m_value;
>         const uint8_t m_radix;
>+        const bool m_sign;
>     };
> 
>     class ThrowableExpressionData {
>diff --git a/Source/JavaScriptCore/runtime/CommonSlowPaths.cpp b/Source/JavaScriptCore/runtime/CommonSlowPaths.cpp
>index a8a5681dc96e8802ebad812af9a075af9a61763f..33e925b0e423de3db7b8e0000a1cf418b4cee366 100644
>--- a/Source/JavaScriptCore/runtime/CommonSlowPaths.cpp
>+++ b/Source/JavaScriptCore/runtime/CommonSlowPaths.cpp
>@@ -367,26 +367,29 @@ static void updateArithProfileForUnaryArithOp(Instruction* pc, JSValue result, J
> {
>     ArithProfile& profile = *bitwise_cast<ArithProfile*>(&pc[3].u.operand);
>     profile.observeLHS(operand);
>-    ASSERT(result.isNumber());
>-    if (!result.isInt32()) {
>-        if (operand.isInt32())
>-            profile.setObservedInt32Overflow();
>-
>-        double doubleVal = result.asNumber();
>-        if (!doubleVal && std::signbit(doubleVal))
>-            profile.setObservedNegZeroDouble();
>-        else {
>-            profile.setObservedNonNegZeroDouble();
>-
>-            // The Int52 overflow check here intentionally omits 1ll << 51 as a valid negative Int52 value.
>-            // Therefore, we will get a false positive if the result is that value. This is intentionally
>-            // done to simplify the checking algorithm.
>-            static const int64_t int52OverflowPoint = (1ll << 51);
>-            int64_t int64Val = static_cast<int64_t>(std::abs(doubleVal));
>-            if (int64Val >= int52OverflowPoint)
>-                profile.setObservedInt52Overflow();
>+    ASSERT(result.isNumber() || result.isBigInt());
>+    if (result.isNumber()) {
>+        if (!result.isInt32()) {
>+            if (operand.isInt32())
>+                profile.setObservedInt32Overflow();
>+            
>+            double doubleVal = result.asNumber();
>+            if (!doubleVal && std::signbit(doubleVal))
>+                profile.setObservedNegZeroDouble();
>+            else {
>+                profile.setObservedNonNegZeroDouble();
>+                
>+                // The Int52 overflow check here intentionally omits 1ll << 51 as a valid negative Int52 value.
>+                // Therefore, we will get a false positive if the result is that value. This is intentionally
>+                // done to simplify the checking algorithm.
>+                static const int64_t int52OverflowPoint = (1ll << 51);
>+                int64_t int64Val = static_cast<int64_t>(std::abs(doubleVal));
>+                if (int64Val >= int52OverflowPoint)
>+                    profile.setObservedInt52Overflow();
>+            }
>         }
>-    }
>+    } else
>+        profile.setObservedNonNumber();
> }
> #else
> static void updateArithProfileForUnaryArithOp(Instruction*, JSValue, JSValue) { }
>@@ -396,7 +399,18 @@ SLOW_PATH_DECL(slow_path_negate)
> {
>     BEGIN();
>     JSValue operand = OP_C(2).jsValue();
>-    JSValue result = jsNumber(-operand.toNumber(exec));
>+    JSValue primValue = operand.toPrimitive(exec, PreferNumber);
>+    CHECK_EXCEPTION();
>+
>+    if (primValue.isBigInt()) {
>+        JSValue result = JSValue(JSBigInt::unaryMinus(exec, asBigInt(primValue)));
>+        RETURN_WITH_PROFILING(result, {
>+            updateArithProfileForUnaryArithOp(pc, result, operand);
>+        });
>+    }
>+    
>+    JSValue result = jsNumber(-primValue.toNumber(exec));
>+    CHECK_EXCEPTION();
>     RETURN_WITH_PROFILING(result, {
>         updateArithProfileForUnaryArithOp(pc, result, operand);
>     });
>diff --git a/Source/JavaScriptCore/runtime/JSBigInt.cpp b/Source/JavaScriptCore/runtime/JSBigInt.cpp
>index fd8e9af2a1d40213b62dafe048047823d6c59e4e..71aacbe017e0606d0f64b9147ed6acc874b3bc95 100644
>--- a/Source/JavaScriptCore/runtime/JSBigInt.cpp
>+++ b/Source/JavaScriptCore/runtime/JSBigInt.cpp
>@@ -215,11 +215,11 @@ JSBigInt* JSBigInt::parseInt(ExecState* state, StringView s, ErrorParseMode pars
>     return parseInt(state, s.characters16(), s.length(), parserMode);
> }
> 
>-JSBigInt* JSBigInt::parseInt(ExecState* state, VM& vm, StringView s, uint8_t radix, ErrorParseMode parserMode)
>+JSBigInt* JSBigInt::parseInt(ExecState* state, VM& vm, StringView s, uint8_t radix, ErrorParseMode parserMode, ParseIntSign sign)
> {
>     if (s.is8Bit())
>-        return parseInt(state, vm, s.characters8(), s.length(), 0, radix, parserMode, false);
>-    return parseInt(state, vm, s.characters16(), s.length(), 0, radix, parserMode, false);
>+        return parseInt(state, vm, s.characters8(), s.length(), 0, radix, parserMode, sign, DisallowEmptyString);
>+    return parseInt(state, vm, s.characters16(), s.length(), 0, radix, parserMode, sign, DisallowEmptyString);
> }
> 
> JSBigInt* JSBigInt::stringToBigInt(ExecState* state, StringView s)
>@@ -250,6 +250,27 @@ inline void JSBigInt::inplaceMultiplyAdd(uintptr_t factor, uintptr_t summand)
>     internalMultiplyAdd(this, factor, summand, length(), this);
> }
> 
>+JSBigInt* JSBigInt::copy(ExecState* state, JSBigInt* x)
>+{
>+    ASSERT(!x->isZero());
>+
>+    VM& vm = state->vm();
>+    JSBigInt* result = JSBigInt::createWithLength(vm, x->length());
>+    memcpy(result->dataStorage(), x->dataStorage(), x->length() * sizeof(Digit));
>+    result->setSign(x->sign());
>+    return result;
>+}
>+
>+JSBigInt* JSBigInt::unaryMinus(ExecState* state, JSBigInt* x)
>+{
>+    if (x->isZero())
>+        return x;
>+
>+    JSBigInt* result = copy(state, x);
>+    result->setSign(!x->sign());
>+    return result;
>+}
>+
> JSBigInt* JSBigInt::multiply(ExecState* state, JSBigInt* x, JSBigInt* y)
> {
>     VM& vm = state->vm();
>@@ -780,26 +801,26 @@ JSBigInt* JSBigInt::parseInt(ExecState* state, CharType*  data, unsigned length,
>     // Check Radix from frist characters
>     if (static_cast<unsigned>(p) + 1 < static_cast<unsigned>(length) && data[p] == '0') {
>         if (isASCIIAlphaCaselessEqual(data[p + 1], 'b'))
>-            return parseInt(state, vm, data, length, p + 2, 2, errorParseMode, false);
>+            return parseInt(state, vm, data, length, p + 2, 2, errorParseMode, Unsigned, DisallowEmptyString);
>         
>         if (isASCIIAlphaCaselessEqual(data[p + 1], 'x'))
>-            return parseInt(state, vm, data, length, p + 2, 16, errorParseMode, false);
>+            return parseInt(state, vm, data, length, p + 2, 16, errorParseMode, Unsigned, DisallowEmptyString);
>         
>         if (isASCIIAlphaCaselessEqual(data[p + 1], 'o'))
>-            return parseInt(state, vm, data, length, p + 2, 8, errorParseMode, false);
>+            return parseInt(state, vm, data, length, p + 2, 8, errorParseMode, Unsigned, DisallowEmptyString);
>     }
> 
>-    bool sign = false;
>+    ParseIntSign sign = Unsigned;
>     if (p < length) {
>         if (data[p] == '+')
>             ++p;
>         else if (data[p] == '-') {
>-            sign = true;
>+            sign = Signed;
>             ++p;
>         }
>     }
> 
>-    JSBigInt* result = parseInt(state, vm, data, length, p, 10, errorParseMode);
>+    JSBigInt* result = parseInt(state, vm, data, length, p, 10, errorParseMode, sign);
> 
>     if (result && !result->isZero())
>         result->setSign(sign);
>@@ -808,14 +829,14 @@ JSBigInt* JSBigInt::parseInt(ExecState* state, CharType*  data, unsigned length,
> }
> 
> template <typename CharType>
>-JSBigInt* JSBigInt::parseInt(ExecState* state, VM& vm, CharType* data, unsigned length, unsigned startIndex, unsigned radix, ErrorParseMode errorParseMode, bool allowEmptyString)
>+JSBigInt* JSBigInt::parseInt(ExecState* state, VM& vm, CharType* data, unsigned length, unsigned startIndex, unsigned radix, ErrorParseMode errorParseMode, ParseIntSign sign, ParseIntMode parseMode)
> {
>     ASSERT(length >= 0);
>     unsigned p = startIndex;
> 
>     auto scope = DECLARE_THROW_SCOPE(vm);
> 
>-    if (!allowEmptyString && startIndex == length) {
>+    if (parseMode != ParseIntMode::AllowEmptyString && startIndex == length) {
>         ASSERT(state);
>         if (errorParseMode == ErrorParseMode::ThrowExceptions)
>             throwVMError(state, scope, createSyntaxError(state, "Failed to parse String to BigInt"));
>@@ -859,6 +880,7 @@ JSBigInt* JSBigInt::parseInt(ExecState* state, VM& vm, CharType* data, unsigned
>         result->inplaceMultiplyAdd(static_cast<Digit>(radix), static_cast<Digit>(digit));
>     }
> 
>+    result->setSign(sign == ParseIntSign::Signed ? true : false);
>     if (p == length)
>         return result->rightTrim(vm);
> 
>diff --git a/Source/JavaScriptCore/runtime/JSBigInt.h b/Source/JavaScriptCore/runtime/JSBigInt.h
>index 0244cbb4954c8efe49809638873d1a7fc1f65dd7..d1c16efcdfb56e8d6adee93610427393c057f89e 100644
>--- a/Source/JavaScriptCore/runtime/JSBigInt.h
>+++ b/Source/JavaScriptCore/runtime/JSBigInt.h
>@@ -77,7 +77,10 @@ public:
>         IgnoreExceptions
>     };
> 
>-    static JSBigInt* parseInt(ExecState*, VM&, StringView, uint8_t radix, ErrorParseMode = ThrowExceptions);
>+    enum ParseIntMode { DisallowEmptyString, AllowEmptyString };
>+    enum ParseIntSign { Unsigned, Signed };
>+
>+    static JSBigInt* parseInt(ExecState*, VM&, StringView, uint8_t radix, ErrorParseMode = ThrowExceptions, ParseIntSign = Unsigned);
>     static JSBigInt* parseInt(ExecState*, StringView, ErrorParseMode = ThrowExceptions);
>     static JSBigInt* stringToBigInt(ExecState*, StringView);
> 
>@@ -94,6 +97,8 @@ public:
> 
>     static JSBigInt* multiply(ExecState*, JSBigInt* x, JSBigInt* y);
>     
>+    static JSBigInt* unaryMinus(ExecState*, JSBigInt* x);
>+    
> private:
> 
>     enum ComparisonResult {
>@@ -139,10 +144,12 @@ private:
>     static JSBigInt* parseInt(ExecState*, CharType*  data, unsigned length, ErrorParseMode);
> 
>     template <typename CharType>
>-    static JSBigInt* parseInt(ExecState*, VM&, CharType* data, unsigned length, unsigned startIndex, unsigned radix, ErrorParseMode, bool allowEmptyString = true);
>+    static JSBigInt* parseInt(ExecState*, VM&, CharType* data, unsigned length, unsigned startIndex, unsigned radix, ErrorParseMode, ParseIntSign = Signed, ParseIntMode = AllowEmptyString);
> 
>     static JSBigInt* allocateFor(ExecState*, VM&, unsigned radix, unsigned charcount);
> 
>+    static JSBigInt* copy(ExecState*, JSBigInt*);
>+
>     JSBigInt* rightTrim(VM&);
> 
>     void inplaceMultiplyAdd(Digit multiplier, Digit part);
>diff --git a/Source/JavaScriptCore/runtime/JSCJSValueInlines.h b/Source/JavaScriptCore/runtime/JSCJSValueInlines.h
>index 3aee0c47e6334168cd02309b646a24357814f1f5..5affd3981190eb997ed21440e4c0ca9f3af3e6f7 100644
>--- a/Source/JavaScriptCore/runtime/JSCJSValueInlines.h
>+++ b/Source/JavaScriptCore/runtime/JSCJSValueInlines.h
>@@ -1109,7 +1109,7 @@ ALWAYS_INLINE bool JSValue::strictEqualSlowCaseInline(ExecState* exec, JSValue v
>     if (v1.asCell()->isString() && v2.asCell()->isString())
>         return asString(v1)->equal(exec, asString(v2));
>     if (v1.isBigInt() && v2.isBigInt())
>-        return JSBigInt::equals(asBigInt(v1.asCell()), asBigInt(v2.asCell()));
>+        return JSBigInt::equals(asBigInt(v1), asBigInt(v2));
>     return v1 == v2;
> }
> 
>diff --git a/JSTests/ChangeLog b/JSTests/ChangeLog
>index 018348aa491e5a2a015dbe53ca51df7383ba6d6e..2aff56a9e2d2c9bed23365b1d4050d3338e713e8 100644
>--- a/JSTests/ChangeLog
>+++ b/JSTests/ChangeLog
>@@ -1,3 +1,14 @@
>+2018-05-13  Caio Lima  <ticaiolima@gmail.com>
>+
>+        [ESNext][BigInt] Implement "+" and "-" unary operation
>+        https://bugs.webkit.org/show_bug.cgi?id=182214
>+
>+        Reviewed by NOBODY (OOPS!).
>+
>+        * stress/big-int-negate-basic.js: Added.
>+        * stress/big-int-negate-jit.js: Added.
>+        * stress/big-int-unary-plus.js: Added.
>+
> 2018-05-13  Andy VanWagoner  <andy@vanwagoner.family>
> 
>         [INTL] Improve spec & test262 compliance for Intl APIs
>diff --git a/JSTests/stress/big-int-negate-basic.js b/JSTests/stress/big-int-negate-basic.js
>new file mode 100644
>index 0000000000000000000000000000000000000000..59ba3c4724dbf01089afd58360a1b5fa72c8b72f
>--- /dev/null
>+++ b/JSTests/stress/big-int-negate-basic.js
>@@ -0,0 +1,71 @@
>+//@ runBigIntEnabled
>+// Original tests from https://github.com/tc39/test262/blob/master/test/language/expressions/unary-minus/bigint.js
>+
>+function assert(a, b, message) {
>+    if (a !== b)
>+        throw new Error(message);
>+}
>+
>+function assertNotEqual(a, b, message) {
>+    if (a === b)
>+        throw new Error(message);
>+}
>+
>+assert(-0n, 0n, "-0n === 0n");
>+assert(-(0n), 0n, "-(0n) === 0n");
>+assertNotEqual(-1n, 1n, "-1n !== 1n");
>+assert(-(1n), -1n, "-(1n) === -1n");
>+assertNotEqual(-(1n), 1n, "-(1n) !== 1n");
>+assert(-(-1n), 1n, "-(-1n) === 1n");
>+assertNotEqual(-(-1n), -1n, "-(-1n) !== -1n");
>+assert(- - 1n, 1n, "- - 1n === 1n");
>+assertNotEqual(- - 1n, -1n, "- - 1n !== -1n");
>+assert(-(0x1fffffffffffff01n), -0x1fffffffffffff01n, "-(0x1fffffffffffff01n) === -0x1fffffffffffff01n");
>+assertNotEqual(-(0x1fffffffffffff01n), 0x1fffffffffffff01n, "-(0x1fffffffffffff01n) !== 0x1fffffffffffff01n");
>+assertNotEqual(-(0x1fffffffffffff01n), -0x1fffffffffffff00n, "-(0x1fffffffffffff01n) !== -0x1fffffffffffff00n");
>+
>+// Non-primitive cases
>+
>+assert(-Object(1n), -1n, "-Object(1n) === -1n");
>+assertNotEqual(-Object(1n), 1n, "-Object(1n) !== 1n");
>+assertNotEqual(-Object(1n), Object(-1n), "-Object(1n) !== Object(-1n)");
>+assert(-Object(-1n), 1n, "-Object(-1n) === 1n");
>+assertNotEqual(-Object(-1n), -1n, "-Object(-1n) !== -1n");
>+assertNotEqual(-Object(-1n), Object(1n), "-Object(-1n) !== Object(1n)");
>+
>+let obj = {
>+    [Symbol.toPrimitive]: function() {
>+        return 1n;
>+    },
>+    valueOf: function() {
>+        throw new Error("Should never be called");
>+    },
>+    toString: function() {
>+        throw new Error("Should never be called");
>+    }
>+};
>+assert(-obj, -1n, "@@toPrimitive not called properly");
>+
>+obj = {
>+    valueOf: function() {
>+        return 1n;
>+    },
>+    toString: function() {
>+        throw new Error("Should never be called");
>+    }
>+}
>+assert(-obj, -1n, "valueOf not called properly");
>+
>+obj = {
>+    toString: function() {
>+        return 1n;
>+    }
>+};
>+
>+assert(-obj, -1n, "-{toString: function() { return 1n; }} === -1n");
>+
>+let x = 1n;
>+let y = -x;
>+let z = -y;
>+assert(x, z, "-(-x) !== z");
>+
>diff --git a/JSTests/stress/big-int-negate-jit.js b/JSTests/stress/big-int-negate-jit.js
>new file mode 100644
>index 0000000000000000000000000000000000000000..ab497831c965e87436ab904078bedb0269b58ca0
>--- /dev/null
>+++ b/JSTests/stress/big-int-negate-jit.js
>@@ -0,0 +1,48 @@
>+//@ skip if not $jitTests
>+//@ runBigIntEnabled
>+
>+function assert(a, b) {
>+    if (a !== b)
>+        throw new Error("Bad!");
>+}
>+
>+function negateBigInt(n) {
>+    return -n;
>+}
>+noInline(negateBigInt);
>+
>+for (let i = 0; i < 100000; i++) {
>+    assert(negateBigInt(100n), -100n);
>+    assert(negateBigInt(-0x1fffffffffffff01n), 0x1fffffffffffff01n);
>+}
>+
>+if (numberOfDFGCompiles(negateBigInt) > 1)
>+    throw "Failed negateBigInt(). We should have compiled a single negate for the BigInt type.";
>+
>+function negateBigIntSpecializedToInt(n) {
>+    return -n;
>+}
>+noInline(negateBigIntSpecializedToInt);
>+
>+for (let i = 0; i < 100000; i++) {
>+    negateBigIntSpecializedToInt(100);
>+}
>+
>+assert(negateBigIntSpecializedToInt(100n), -100n);
>+
>+// Testing case mixing int and BigInt speculations
>+function mixedSpeculationNegateBigInt(n, arr) {
>+    return -(-(-n));
>+}
>+noInline(mixedSpeculationNegateBigInt);
>+
>+for (let i = 0; i < 100000; i++) {
>+    if (i % 2)
>+        assert(mixedSpeculationNegateBigInt(100), -100);
>+    else
>+        assert(mixedSpeculationNegateBigInt(-0x1fffffffffffff01n), 0x1fffffffffffff01n);
>+}
>+
>+if (numberOfDFGCompiles(mixedSpeculationNegateBigInt) > 1)
>+    throw "Failed negateBigInt(). We should have compiled a single negate for the BigInt type.";
>+
>diff --git a/JSTests/stress/big-int-unary-plus.js b/JSTests/stress/big-int-unary-plus.js
>new file mode 100644
>index 0000000000000000000000000000000000000000..4d4ac37b9e5373e6b18b91983cdd372e55396240
>--- /dev/null
>+++ b/JSTests/stress/big-int-unary-plus.js
>@@ -0,0 +1,51 @@
>+//@ runBigIntEnabled
>+
>+function assert(a) {
>+    if (!a)
>+        throw new Error("Bad!")
>+}
>+
>+function assertTypeError(input) {
>+    try {
>+        let a = +input;
>+        assert(false);
>+    } catch(e) {
>+        assert(e instanceof TypeError);
>+    }
>+}
>+
>+assertTypeError(10n);
>+assertTypeError(-10n);
>+assertTypeError(Object(10n));
>+assertTypeError(Object(-10n));
>+
>+let obj = {
>+    [Symbol.toPrimitive]: function() {
>+        return 1n;
>+    },
>+    valueOf: function() {
>+        throw new Error("Should never be called");
>+    },
>+    toString: function() {
>+        throw new Error("Should never be called");
>+    }
>+};
>+assertTypeError(obj);
>+
>+obj = {
>+    valueOf: function() {
>+        return 1n;
>+    },
>+    toString: function() {
>+        throw new Error("Should never be called");
>+    }
>+};
>+assertTypeError(obj);
>+
>+obj = {
>+    toString: function() {
>+        return 1n;
>+    }
>+};
>+assertTypeError(obj);
>+

Actions: View | Formatted Diff | Diff

Attachments on bug 182214: 332473 | 332485 | 332486 | 333018 | 333056 | 335475 | 337703 | 337718 | 338072 | 338075 | 338579 | 338956 | 339233 | 339241 | 339254 | 339646 | 340157 | 340263 | 340265 | 340270 | 340808 | 340812 | 341279 | 341440