Summary: | Get rid of DFG::DoubleOperand and simplify ValueToInt32 | ||||||||
---|---|---|---|---|---|---|---|---|---|
Product: | WebKit | Reporter: | Filip Pizlo <fpizlo> | ||||||
Component: | JavaScriptCore | Assignee: | Filip Pizlo <fpizlo> | ||||||
Status: | RESOLVED FIXED | ||||||||
Severity: | Normal | CC: | barraclough, ggaren, mark.lam, mhahnenberg, msaboff, oliver, ossy, sam | ||||||
Priority: | P2 | ||||||||
Version: | 528+ (Nightly build) | ||||||||
Hardware: | All | ||||||||
OS: | All | ||||||||
Bug Depends on: | 110184 | ||||||||
Bug Blocks: | 109371, 110092 | ||||||||
Attachments: |
|
Description
Filip Pizlo
2013-02-17 19:52:57 PST
Actually ValueToInt32, the only use of DoubleOperand, was not just slightly wrong. It was totally borked. Repro case: function foo(a, b) { var result = a | b.f; return [result, a]; } var counter = 0; for (var i = 0; i < 100; ++i) { var result = foo({valueOf:function() { counter++; return 1; }}, {f:i == 99 ? 5.5 : 5}); if (result.length != 2) throw "error"; if (result[0] != 5) throw "error"; } if (counter != 100) throw "error"; Created attachment 188799 [details]
the patch
Still need to generate the results file. But other than that it's good to go.
Created attachment 188804 [details]
the patch
Comment on attachment 188804 [details]
the patch
r=me
Landed in http://trac.webkit.org/changeset/143241 (In reply to comment #5) > Landed in http://trac.webkit.org/changeset/143241 It caused a serious regression on 32 bit platforms. See https://bugs.webkit.org/show_bug.cgi?id=110184 for details. *** Bug 101434 has been marked as a duplicate of this bug. *** |