Summary: | In the 64-bit DFG and FTL, Array::Double case for HasIndexedProperty should set its result to true when all is well | ||||||||
---|---|---|---|---|---|---|---|---|---|
Product: | WebKit | Reporter: | Mark Lam <mark.lam> | ||||||
Component: | JavaScriptCore | Assignee: | Mark Lam <mark.lam> | ||||||
Status: | RESOLVED FIXED | ||||||||
Severity: | Normal | CC: | benjamin, fpizlo, ggaren, mmirman, msaboff, webkit-bug-importer | ||||||
Priority: | P2 | Keywords: | InRadar | ||||||
Version: | 528+ (Nightly build) | ||||||||
Hardware: | Unspecified | ||||||||
OS: | Unspecified | ||||||||
Attachments: |
|
Description
Mark Lam
2015-04-03 19:17:28 PDT
Turns out that the FTL implementation of HasIndexedProperty has a similar but different problem. In this case, the FTL is setting the boolean result. However, the value that it is setting it with needs to be inverted. Michael helped me out with figuring out how to invert said bit. My tests appear to be passing now. Patch for fix coming soon. Created attachment 250226 [details]
the patch.
Comment on attachment 250226 [details] the patch. View in context: https://bugs.webkit.org/attachment.cgi?id=250226&action=review > Source/JavaScriptCore/ftl/FTLLowerDFGToLLVM.cpp:4712 > - m_out.doubleNotEqualOrUnordered(doubleValue, doubleValue)); > - m_out.branch(checkHoleResult.value(), rarely(slowCase), usually(continuation)); > + m_out.bitNot(m_out.doubleNotEqualOrUnordered(doubleValue, doubleValue))); > + m_out.branch(checkHoleResult.value(), usually(continuation), rarely(slowCase)); You should just use doubleEqual() instead of bitNot(doubleNotEqualOrUnordered) Created attachment 250228 [details]
patch 2: with Fil's better doubles comparison.
Thanks. Landed in r182444: <http://trac.webkit.org/r182444>. |