Bug 110072

Summary: Get rid of DFG::DoubleOperand and simplify ValueToInt32
Product: WebKit Reporter: Filip Pizlo <fpizlo>
Component: JavaScriptCoreAssignee: Filip Pizlo <fpizlo>
Status: RESOLVED FIXED    
Severity: Normal CC: barraclough, ggaren, mark.lam, mhahnenberg, msaboff, oliver, ossy, sam
Priority: P2    
Version: 528+ (Nightly build)   
Hardware: All   
OS: All   
Bug Depends on: 110184    
Bug Blocks: 109371, 110092    
Attachments:
Description Flags
the patch
none
the patch ggaren: review+

Description Filip Pizlo 2013-02-17 19:52:57 PST
The only remaining use of it is actually somewhat wrong.
Comment 1 Filip Pizlo 2013-02-17 21:27:12 PST
Actually ValueToInt32, the only use of DoubleOperand, was not just slightly wrong.  It was totally borked.  Repro case:

function foo(a, b) {
    var result = a | b.f;
    return [result, a];
}

var counter = 0;
for (var i = 0; i < 100; ++i) {
    var result = foo({valueOf:function() { counter++; return 1; }}, {f:i == 99 ? 5.5 : 5});
    if (result.length != 2)
        throw "error";
    if (result[0] != 5)
        throw "error";
}

if (counter != 100)
    throw "error";
Comment 2 Filip Pizlo 2013-02-17 22:38:34 PST
Created attachment 188799 [details]
the patch

Still need to generate the results file.  But other than that it's good to go.
Comment 3 Filip Pizlo 2013-02-18 00:03:36 PST
Created attachment 188804 [details]
the patch
Comment 4 Geoffrey Garen 2013-02-18 05:58:54 PST
Comment on attachment 188804 [details]
the patch

r=me
Comment 5 Filip Pizlo 2013-02-18 10:42:04 PST
Landed in http://trac.webkit.org/changeset/143241
Comment 6 Csaba Osztrogonác 2013-02-18 23:15:48 PST
(In reply to comment #5)
> Landed in http://trac.webkit.org/changeset/143241

It caused a serious regression on 32 bit platforms. See https://bugs.webkit.org/show_bug.cgi?id=110184 for details.
Comment 7 Filip Pizlo 2013-02-20 14:28:17 PST
*** Bug 101434 has been marked as a duplicate of this bug. ***