Bug 110072 – Get rid of DFG::DoubleOperand and simplify ValueToInt32

• Component: JavaScriptCore
• Status: RESOLVED FIXED

[Filip Pizlo]

The only remaining use of it is actually somewhat wrong.

[Filip Pizlo]

Actually ValueToInt32, the only use of DoubleOperand, was not just slightly wrong.  It was totally borked.  Repro case:

function foo(a, b) {
    var result = a | b.f;
    return [result, a];
}

var counter = 0;
for (var i = 0; i < 100; ++i) {
    var result = foo({valueOf:function() { counter++; return 1; }}, {f:i == 99 ? 5.5 : 5});
    if (result.length != 2)
        throw "error";
    if (result[0] != 5)
        throw "error";
}

if (counter != 100)
    throw "error";

[Filip Pizlo]

Created attachment 188799 [details]
the patch

Still need to generate the results file.  But other than that it's good to go.

[Filip Pizlo]

Created attachment 188804 [details]
the patch

[Geoffrey Garen]

Comment on attachment 188804 [details]
the patch

r=me

[Filip Pizlo]

Landed in http://trac.webkit.org/changeset/143241

[Csaba Osztrogonác]

(In reply to comment #5)
> Landed in http://trac.webkit.org/changeset/143241

It caused a serious regression on 32 bit platforms. See https://bugs.webkit.org/show_bug.cgi?id=110184 for details.

[Filip Pizlo]

*** Bug 101434 has been marked as a duplicate of this bug. ***