Bug 228068 – Compiler Incorrect Optimization

• Component: JavaScriptCore
• Status: RESOLVED FIXED

[zhiyi]

OS: ubuntu18.04
Architecture: <x64>

./jsc bug.js

expected output
-Infinity
-Infinity

actual output
-Infinity
Infinity


bug.js
##################################
function f() {
  v0 = (-0.0).toLocaleString();
  return parseInt(v0);
}
let a0 = f();
print(1 / a0);

for (let i = 0; i < 0x1000; i++) { f(); }
let a3 = f();
print(1 / a3);

[Radar WebKit Bug Importer]

<rdar://problem/80788603>

[Mark Lam]

Created attachment 433828 [details]
proposed patch.

[Yusuke Suzuki]

Comment on attachment 433828 [details]
proposed patch.

View in context: https://bugs.webkit.org/attachment.cgi?id=433828&action=review

> Source/JavaScriptCore/dfg/DFGOperations.cpp:206
> +    if (static_cast<double>(asInt) == input) {
> +        if (asInt || !std::signbit(input))

I think it is worth putting `LIKELY`.

if (LIKELY(static_cast<double>(asInt) == input && (asInt || !std::signbit(input))))
    return JSValue::encode(jsNumber(asInt));

[Mark Lam]

(In reply to Yusuke Suzuki from comment #3)
> Comment on attachment 433828 [details]
> proposed patch.
> 
> View in context:
> https://bugs.webkit.org/attachment.cgi?id=433828&action=review
> 
> > Source/JavaScriptCore/dfg/DFGOperations.cpp:206
> > +    if (static_cast<double>(asInt) == input) {
> > +        if (asInt || !std::signbit(input))
> 
> I think it is worth putting `LIKELY`.
> 
> if (LIKELY(static_cast<double>(asInt) == input && (asInt ||
> !std::signbit(input))))
>     return JSValue::encode(jsNumber(asInt));

OK, will do.

[Mark Lam]

Created attachment 433830 [details]
patch for landing.

[Mark Lam]

Thanks for the review.  Landed in r280060: <http://trac.webkit.org/r280060>.