Bug 196313

Summary: validateOSREntryValue with Int52 should box the value being checked into double format
Product: WebKit Reporter: Saam Barati <saam>
Component: JavaScriptCoreAssignee: Saam Barati <saam>
Status: RESOLVED FIXED    
Severity: Normal CC: benjamin, commit-queue, fpizlo, ggaren, gskachkov, guijemont, keith_miller, mark.lam, msaboff, rmorisset, ticaiolima, tzagallo, webkit-bug-importer, ysuzuki
Priority: P2 Keywords: InRadar
Version: WebKit Nightly Build   
Hardware: Unspecified   
OS: Unspecified   
Attachments:
Description Flags
patch
ysuzuki: review+
patch for landing none

Description Saam Barati 2019-03-27 13:29:03 PDT
...
Comment 1 Saam Barati 2019-03-27 13:32:33 PDT
<rdar://problem/49306703>
Comment 2 Saam Barati 2019-03-27 13:36:23 PDT
Created attachment 366099 [details]
patch
Comment 3 Yusuke Suzuki 2019-03-27 13:39:30 PDT
Comment on attachment 366099 [details]
patch

View in context: https://bugs.webkit.org/attachment.cgi?id=366099&action=review

r=me

> Source/JavaScriptCore/dfg/DFGOSREntry.cpp:217
>              // Constant AnyInt value is stored as usual boxed value in AbstractValue.

We can change this comment like,

Constant AnyInt value is represented as SpecAnyIntAsDouble value in DFG.

> Source/JavaScriptCore/dfg/DFGOSREntry.cpp:219
>              format = FlushedInt52;
> +            value = jsDoubleNumber(value.asAnyInt());

You can exchange these two lines to align them to the code for FlushedDouble case.
Comment 4 Saam Barati 2019-03-27 13:41:28 PDT
Comment on attachment 366099 [details]
patch

View in context: https://bugs.webkit.org/attachment.cgi?id=366099&action=review

>> Source/JavaScriptCore/dfg/DFGOSREntry.cpp:217
>>              // Constant AnyInt value is stored as usual boxed value in AbstractValue.
> 
> We can change this comment like,
> 
> Constant AnyInt value is represented as SpecAnyIntAsDouble value in DFG.

This isn't always the case because you have strict and not strict. I'm going to just remove the comment.

>> Source/JavaScriptCore/dfg/DFGOSREntry.cpp:219
>> +            value = jsDoubleNumber(value.asAnyInt());
> 
> You can exchange these two lines to align them to the code for FlushedDouble case.

Sounds good.
Comment 5 Saam Barati 2019-03-27 13:42:44 PDT
Created attachment 366100 [details]
patch for landing
Comment 6 WebKit Commit Bot 2019-03-27 18:06:07 PDT
Comment on attachment 366100 [details]
patch for landing

Clearing flags on attachment: 366100

Committed r243596: <https://trac.webkit.org/changeset/243596>
Comment 7 WebKit Commit Bot 2019-03-27 18:06:09 PDT
All reviewed patches have been landed.  Closing bug.