158368 2016-06-03 16:12:00 -0700 Eager FTL failure for strict comparison of NaN with number check 2016-06-03 20:27:42 -0700 1 1 1 Unclassified WebKit JavaScriptCore WebKit Nightly Build Unspecified Unspecified RESOLVED FIXED InRadar P2 Normal --- 1 joepeck benjamin benjamin commit-queue fpizlo ggaren keith_miller mark.lam msaboff saam webkit-bug-importer oldest_to_newest 1199100 0 280480 joepeck 2016-06-03 16:12:00 -0700 Created attachment 280480 [TEST] JS Reduction * SUMMARY Eager FTL failure for strict comparison of NaN with number check * TEST function isNaNOnDouble(value) { return (+value) !== value; } noInline(isNaNOnDouble); function testIsNaNOnDoubles() { var value = isNaNOnDouble(-0); if (value) throw "isNaNOnDouble(-0) = " + value; var value = isNaNOnDouble(NaN); if (!value) throw "isNaNOnDouble(NaN) = " + value; var value = isNaNOnDouble(Number.POSITIVE_INFINITY); if (value) throw "isNaNOnDouble(Number.POSITIVE_INFINITY) = " + value; } noInline(testIsNaNOnDoubles); for (var i = 0; i < 1e6; ++i) { testIsNaNOnDoubles(); } * STEPS TO REPRODUCE 1. $ DYLD_FRAMEWORK_PATH=$build/Release $build/Release/jsc --useFTLJIT=true --useConcurrentJIT=false --thresholdForJITAfterWarmUp=100 --thresholdForJITAfterWarmUp=10 --thresholdForJITSoon=10 --thresholdForOptimizeAfterWarmUp=20 --thresholdForOptimizeAfterLongWarmUp=20 --thresholdForOptimizeSoon=20 --thresholdForFTLOptimizeAfterWarmUp=20 --thresholdForFTLOptimizeSoon=20 number-compare-strict.js Exception: isNaNOnDouble(NaN) = false * NOTES - The issue only reproduces if --useConcurrentJIT=false 1199148 1 benjamin 2016-06-03 17:44:08 -0700 I'll take it. Scary stuff. 1199151 2 webkit-bug-importer 2016-06-03 17:45:26 -0700 <rdar://problem/26634629> 1199184 3 280501 benjamin 2016-06-03 18:55:11 -0700 Created attachment 280501 Patch 1199210 4 280501 commit-queue 2016-06-03 20:27:35 -0700 Comment on attachment 280501 Patch Clearing flags on attachment: 280501 Committed r201678: <http://trac.webkit.org/changeset/201678> 1199211 5 commit-queue 2016-06-03 20:27:42 -0700 All reviewed patches have been landed. Closing bug. 280480 2016-06-03 16:12:00 -0700 2016-06-03 16:12:00 -0700 [TEST] JS Reduction number-compare-strict.js application/x-javascript 553 joepeck ZnVuY3Rpb24gaXNOYU5PbkRvdWJsZSh2YWx1ZSkKewogICAgcmV0dXJuICgrdmFsdWUpICE9PSB2 YWx1ZTsKfQpub0lubGluZShpc05hTk9uRG91YmxlKTsKCmZ1bmN0aW9uIHRlc3RJc05hTk9uRG91 YmxlcygpCnsKICAgIHZhciB2YWx1ZSA9IGlzTmFOT25Eb3VibGUoLTApOwogICAgaWYgKHZhbHVl KQogICAgICAgIHRocm93ICJpc05hTk9uRG91YmxlKC0wKSA9ICIgKyB2YWx1ZTsKCiAgICB2YXIg dmFsdWUgPSBpc05hTk9uRG91YmxlKE5hTik7CiAgICBpZiAoIXZhbHVlKQogICAgICAgIHRocm93 ICJpc05hTk9uRG91YmxlKE5hTikgPSAiICsgdmFsdWU7CgogICAgdmFyIHZhbHVlID0gaXNOYU5P bkRvdWJsZShOdW1iZXIuUE9TSVRJVkVfSU5GSU5JVFkpOwogICAgaWYgKHZhbHVlKQogICAgICAg IHRocm93ICJpc05hTk9uRG91YmxlKE51bWJlci5QT1NJVElWRV9JTkZJTklUWSkgPSAiICsgdmFs dWU7Cn0Kbm9JbmxpbmUodGVzdElzTmFOT25Eb3VibGVzKTsKCmZvciAodmFyIGkgPSAwOyBpIDwg MWU2OyArK2kpIHsKICAgIHRlc3RJc05hTk9uRG91YmxlcygpOwp9Cg== 280501 2016-06-03 18:55:11 -0700 2016-06-03 20:27:35 -0700 Patch bug-158368-20160603185632.patch text/plain 4188 benjamin U3VidmVyc2lvbiBSZXZpc2lvbjogMjAxNjcxCmRpZmYgLS1naXQgYS9Tb3VyY2UvSmF2YVNjcmlw dENvcmUvQ2hhbmdlTG9nIGIvU291cmNlL0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwppbmRleCBi M2JmZWQ1NmZjYzc2ZjU2NDAxMzAzMDJhYzBmNGNhNDgyMmM1YzgzLi4wZTIzYjFiOTI3YmE3NWUy YWUyNDljMmNhNDMwMTE0Zjg5NzZkOTJiIDEwMDY0NAotLS0gYS9Tb3VyY2UvSmF2YVNjcmlwdENv cmUvQ2hhbmdlTG9nCisrKyBiL1NvdXJjZS9KYXZhU2NyaXB0Q29yZS9DaGFuZ2VMb2cKQEAgLTEs MyArMSwzMyBAQAorMjAxNi0wNi0wMyAgQmVuamFtaW4gUG91bGFpbiAgPGJwb3VsYWluQGFwcGxl LmNvbT4KKworICAgICAgICBFYWdlciBGVEwgZmFpbHVyZSBmb3Igc3RyaWN0IGNvbXBhcmlzb24g b2YgTmFOIHdpdGggbnVtYmVyIGNoZWNrCisgICAgICAgIGh0dHBzOi8vYnVncy53ZWJraXQub3Jn L3Nob3dfYnVnLmNnaT9pZD0xNTgzNjgKKworICAgICAgICBSZXZpZXdlZCBieSBOT0JPRFkgKE9P UFMhKS4KKworICAgICAgICBEb3VwbGVSZXAgd2l0aCBhIFJlYWxOdW1iZXJVc2Ugc3RhcnRzIGJ5 IGhhbmRsaW5nIGRvdWJsZQorICAgICAgICB0aGVuIGZhbGxzIGJhY2sgdG8gSW50MzIgaWYgdGhl IHVuYm94ZWQgZG91YmxlIGlzIE5hTi4KKworICAgICAgICBCZWZvcmUgaGFuZGxpbmcgaW50ZWdl cnMsIHRoZSBjb2RlIGlzIGNoZWNraW5nIGlmIHRoZSBpbnB1dAorICAgICAgICBpcyBpbmRlZWQg YW4gaW50MzIuIFRoZSBwcm9ibGVtIHdhcyB0aGF0IHRoaXMgY2hlY2sgZmFpbGVkCisgICAgICAg IHRvIGFjY291bnQgZm9yIE5hTiBhcyBhbiBvcmlnaW5hbCBpbnB1dCBvZiB0aGUgRG91YmxlUmVw LgorCisgICAgICAgIFRoZSBjYWxsIHRvIGlzTm90SW50MzIoKSBmaWx0ZXIgdGhlIGRvdWJsZXMg Y2hlY2tzIGJlY2F1c2UKKyAgICAgICAgdGhhdCB3YXMgaGFuZGxlZCBieSB0aGUgcHJldmlvdXMg YmxvY2suCisgICAgICAgIFRoZSBwcm9ibGVtIGlzIHRoZSBwcmV2aW91cyBibG9jayBoYW5kbGVz IGFueSBkb3VibGUgZXhjZXB0IE5hTi4KKyAgICAgICAgSWYgdGhlIG9yaWdpbmFsIGlucHV0IHdh cyBOYU4sIHRoZSBtYXNraW5nIGJ5ICJ+U3BlY0Z1bGxEb3VibGUiCisgICAgICAgIGZpbHRlciB0 aGF0IHBvc3NpYmlsaXR5IGFuZCBpc05vdEludDMyKCkgZmFpbHMgdG8gdGVzdCB0aGF0IGNhc2Uu CisKKyAgICAgICAgVGhpcyBwYXRjaCBmaXhlcyB0aGUgaXNzdWUgYnkgY2hhbmdpbmcgdGhlIGZp bHRlciB0byBTcGVjRG91YmxlUmVhbC4KKyAgICAgICAgVGhlIHR5cGUgU3BlY0RvdWJsZVJlYWwg ZG9lcyBub3QgaW5jbHVkZSB0aGUgTmFOIHR5cGVzLgorCisgICAgICAgICogZnRsL0ZUTExvd2Vy REZHVG9CMy5jcHA6CisgICAgICAgIChKU0M6OkZUTDo6REZHOjpMb3dlckRGR1RvQjM6OmNvbXBp bGVEb3VibGVSZXApOgorICAgICAgICAqIHRlc3RzL3N0cmVzcy9kb3VibGUtcmVwLXJlYWwtbnVt YmVyLXVzZS1vbi1uYW4uanM6IEFkZGVkLgorICAgICAgICBUbyBlbnN1cmUgdGhlIGlzTm90SW50 MzIoKSBkb2VzIG5vdCB0ZXN0IGFueXRoaW5nLCB3ZSB3YW50CisgICAgICAgIHByb3ZlbiBudW1i ZXJzIGFzIGlucHV0LiBUaGUgKCt2YWx1ZSkgYXJlIHRoZXJlIHRvIGVuZm9yY2UKKyAgICAgICAg YSBUb051bWJlcigpIHdoaWNoIGluIHR1cm4gZ2l2ZSB1cyBhIHByb3ZlbiBOdW1iZXIgdHlwZS4K KwogMjAxNi0wNi0wMyAgU2FhbSBiYXJhdGkgIDxzYmFyYXRpQGFwcGxlLmNvbT4KIAogICAgICAg ICBTb21lIHNoYWRvdyBjaGlja2VuIGNvZGUgaXMgd3Jvbmcgd2hlbiBydW4gb24gYSBiaWcgZW5k aWFuIENQVQpkaWZmIC0tZ2l0IGEvU291cmNlL0phdmFTY3JpcHRDb3JlL2Z0bC9GVExMb3dlckRG R1RvQjMuY3BwIGIvU291cmNlL0phdmFTY3JpcHRDb3JlL2Z0bC9GVExMb3dlckRGR1RvQjMuY3Bw CmluZGV4IDc0NTY0NjJlMThkOGI3YjMyM2E2MzRiZWMxOTNiMWU2MGJlNmExMDkuLmVhY2YyNGE2 MGMzMjk2NDUxODFiODRlNDZkYzM1MDllOGZlYmY5Y2UgMTAwNjQ0Ci0tLSBhL1NvdXJjZS9KYXZh U2NyaXB0Q29yZS9mdGwvRlRMTG93ZXJERkdUb0IzLmNwcAorKysgYi9Tb3VyY2UvSmF2YVNjcmlw dENvcmUvZnRsL0ZUTExvd2VyREZHVG9CMy5jcHAKQEAgLTExMzgsMTAgKzExMzgsMTAgQEAgcHJp dmF0ZToKICAgICAgICAgICAgICAgICB1c3VhbGx5KGNvbnRpbnVhdGlvbiksIHJhcmVseShpbnRD YXNlKSk7CiAgICAgICAgICAgICAKICAgICAgICAgICAgIExCYXNpY0Jsb2NrIGxhc3ROZXh0ID0g bV9vdXQuYXBwZW5kVG8oaW50Q2FzZSwgY29udGludWF0aW9uKTsKLSAgICAgICAgICAgIAorCiAg ICAgICAgICAgICBGVExfVFlQRV9DSEVDSygKICAgICAgICAgICAgICAgICBqc1ZhbHVlVmFsdWUo dmFsdWUpLCBtX25vZGUtPmNoaWxkMSgpLCBTcGVjQnl0ZWNvZGVSZWFsTnVtYmVyLAotICAgICAg ICAgICAgICAgIGlzTm90SW50MzIodmFsdWUsIHByb3ZlblR5cGUobV9ub2RlLT5jaGlsZDEoKSkg JiB+U3BlY0Z1bGxEb3VibGUpKTsKKyAgICAgICAgICAgICAgICBpc05vdEludDMyKHZhbHVlLCBw cm92ZW5UeXBlKG1fbm9kZS0+Y2hpbGQxKCkpICYgflNwZWNEb3VibGVSZWFsKSk7CiAgICAgICAg ICAgICBWYWx1ZUZyb21CbG9jayBzbG93UmVzdWx0ID0gbV9vdXQuYW5jaG9yKG1fb3V0LmludFRv RG91YmxlKHVuYm94SW50MzIodmFsdWUpKSk7CiAgICAgICAgICAgICBtX291dC5qdW1wKGNvbnRp bnVhdGlvbik7CiAgICAgICAgICAgICAKZGlmZiAtLWdpdCBhL1NvdXJjZS9KYXZhU2NyaXB0Q29y ZS90ZXN0cy9zdHJlc3MvZG91YmxlLXJlcC1yZWFsLW51bWJlci11c2Utb24tbmFuLmpzIGIvU291 cmNlL0phdmFTY3JpcHRDb3JlL3Rlc3RzL3N0cmVzcy9kb3VibGUtcmVwLXJlYWwtbnVtYmVyLXVz ZS1vbi1uYW4uanMKbmV3IGZpbGUgbW9kZSAxMDA2NDQKaW5kZXggMDAwMDAwMDAwMDAwMDAwMDAw MDAwMDAwMDAwMDAwMDAwMDAwMDAwMC4uOTZlZmM1NDNmNDExZmJlNjFmNTkyODY3MDRlNmQ3YTNk ODkyMDEzNwotLS0gL2Rldi9udWxsCisrKyBiL1NvdXJjZS9KYXZhU2NyaXB0Q29yZS90ZXN0cy9z dHJlc3MvZG91YmxlLXJlcC1yZWFsLW51bWJlci11c2Utb24tbmFuLmpzCkBAIC0wLDAgKzEsNDYg QEAKKy8vIE9yaWdpbmFsIHRlc3QgY2FzZS4KK2Z1bmN0aW9uIGlzTmFOT25Eb3VibGUodmFsdWUp Cit7CisgICAgcmV0dXJuICgrdmFsdWUpICE9PSB2YWx1ZTsKK30KK25vSW5saW5lKGlzTmFOT25E b3VibGUpOworCitmdW5jdGlvbiB0ZXN0SXNOYU5PbkRvdWJsZXMoKQoreworICAgIHZhciB2YWx1 ZSA9IGlzTmFOT25Eb3VibGUoLTApOworICAgIGlmICh2YWx1ZSkKKyAgICAgICAgdGhyb3cgImlz TmFOT25Eb3VibGUoLTApID0gIiArIHZhbHVlOworCisgICAgdmFyIHZhbHVlID0gaXNOYU5PbkRv dWJsZShOYU4pOworICAgIGlmICghdmFsdWUpCisgICAgICAgIHRocm93ICJpc05hTk9uRG91Ymxl KE5hTikgPSAiICsgdmFsdWU7CisKKyAgICB2YXIgdmFsdWUgPSBpc05hTk9uRG91YmxlKE51bWJl ci5QT1NJVElWRV9JTkZJTklUWSk7CisgICAgaWYgKHZhbHVlKQorICAgICAgICB0aHJvdyAiaXNO YU5PbkRvdWJsZShOdW1iZXIuUE9TSVRJVkVfSU5GSU5JVFkpID0gIiArIHZhbHVlOworfQorbm9J bmxpbmUodGVzdElzTmFOT25Eb3VibGVzKTsKKworZm9yIChsZXQgaSA9IDA7IGkgPCAxZTY7ICsr aSkgeworICAgIHRlc3RJc05hTk9uRG91YmxlcygpOworfQorCisvLyBTaW1wbGlmaWVkIHRlc3Qg Y2FzZS4KK2Z1bmN0aW9uIGlzTmFOT25Eb3VibGUyKHZhbHVlKQoreworICAgIGxldCB2YWx1ZVRv TnVtYmVyID0gKCt2YWx1ZSk7CisgICAgcmV0dXJuIHZhbHVlVG9OdW1iZXIgIT09IHZhbHVlVG9O dW1iZXI7Cit9Citub0lubGluZShpc05hTk9uRG91YmxlMik7CisKKy8vIFdhcm0gdXAgd2l0aG91 dCBOYU4uCitmb3IgKGxldCBpID0gMDsgaSA8IDFlNjsgKytpKSB7CisgICAgaWYgKGlzTmFOT25E b3VibGUyKDEuNSkpCisgICAgICAgIHRocm93ICJGYWlsZWQgaXNOYU5PbkRvdWJsZSgxLjUpIjsK K30KKworLy8gVGhlbiBwYXNzIHNvbWUgTmFOcy4KK2ZvciAobGV0IGkgPSAwOyBpIDwgMWU2OyAr K2kpIHsKKyAgICBpZiAoIWlzTmFOT25Eb3VibGUyKE5hTikpCisgICAgICAgIHRocm93ICJGYWls ZWQgaXNOYU5PbkRvdWJsZShOYU4pIjsKK30K