Bug 150313 - DoubleRep fails to convert SpecBoolean values
Summary: DoubleRep fails to convert SpecBoolean values
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: JavaScriptCore (show other bugs)
Version: WebKit Local Build
Hardware: Unspecified Unspecified
: P2 Normal
Assignee: Mark Lam
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2015-10-18 23:10 PDT by Mark Lam
Modified: 2015-10-19 09:15 PDT (History)
6 users (show)

See Also:


Attachments
the patch. (11.49 KB, patch)
2015-10-18 23:42 PDT, Mark Lam
ggaren: review+
Details | Formatted Diff | Diff
32-bit benchmark result 1 (63.37 KB, text/plain)
2015-10-18 23:53 PDT, Mark Lam
no flags Details
32-bit benchmark result 2 (63.49 KB, text/plain)
2015-10-18 23:54 PDT, Mark Lam
no flags Details
64-bit benchmark result 1 (64.04 KB, text/plain)
2015-10-18 23:54 PDT, Mark Lam
no flags Details
64-bit benchmark result 2 (64.32 KB, text/plain)
2015-10-18 23:54 PDT, Mark Lam
no flags Details

Note You need to log in before you can comment on or make changes to this bug.
Description Mark Lam 2015-10-18 23:10:15 PDT
This was uncovered by the op_sub stress test on 32-bit builds.  On 32-bit builds, DoubleRep will erroneously convert 'true' to a 'NaN' instead of a double 1.  On 64-bit, the same issue exists but is masked by another bug in DoubleRep where boolean values will always erroneously trigger a BadType OSR exit.
Comment 1 Mark Lam 2015-10-18 23:42:22 PDT
Created attachment 263446 [details]
the patch.
Comment 2 Mark Lam 2015-10-18 23:53:43 PDT
Created attachment 263447 [details]
32-bit benchmark result 1
Comment 3 Mark Lam 2015-10-18 23:54:01 PDT
Created attachment 263448 [details]
32-bit benchmark result 2
Comment 4 Mark Lam 2015-10-18 23:54:24 PDT
Created attachment 263449 [details]
64-bit benchmark result 1
Comment 5 Mark Lam 2015-10-18 23:54:58 PDT
Created attachment 263450 [details]
64-bit benchmark result 2
Comment 6 Mark Lam 2015-10-18 23:58:11 PDT
Benchmark results show no significance difference in perf.  The components that show up as definitely faster / slower in one run does not manifest on the second run with the same builds.  Similarly, when run individually, the test components also do not show any significant difference in perf.
Comment 7 Geoffrey Garen 2015-10-19 09:09:16 PDT
Comment on attachment 263446 [details]
the patch.

View in context: https://bugs.webkit.org/attachment.cgi?id=263446&action=review

> Source/JavaScriptCore/ChangeLog:18
> +        implemented incorrectly.  It was checking if any bits other than bit 0 was set.

was=>were

> Source/JavaScriptCore/ChangeLog:19
> +        However, boolean JS values always has TagBitBool (the 3rd bit) set.  Hence, the

has=>have
Comment 8 Mark Lam 2015-10-19 09:15:28 PDT
Thanks.  Landed in r191290: <http://trac.webkit.org/r191290>.