Bug 150313 – DoubleRep fails to convert SpecBoolean values

• Status: RESOLVED
• Resolution: FIXED
• Component: JavaScriptCore

[Mark Lam]

This was uncovered by the op_sub stress test on 32-bit builds.  On 32-bit builds, DoubleRep will erroneously convert 'true' to a 'NaN' instead of a double 1.  On 64-bit, the same issue exists but is masked by another bug in DoubleRep where boolean values will always erroneously trigger a BadType OSR exit.

[Mark Lam]

Created attachment 263446 [details]
the patch.

[Mark Lam]

Created attachment 263447 [details]
32-bit benchmark result 1

[Mark Lam]

Created attachment 263448 [details]
32-bit benchmark result 2

[Mark Lam]

Created attachment 263449 [details]
64-bit benchmark result 1

[Mark Lam]

Created attachment 263450 [details]
64-bit benchmark result 2

[Mark Lam]

Benchmark results show no significance difference in perf.  The components that show up as definitely faster / slower in one run does not manifest on the second run with the same builds.  Similarly, when run individually, the test components also do not show any significant difference in perf.

[Geoffrey Garen]

Comment on attachment 263446 [details]
the patch.

View in context: https://bugs.webkit.org/attachment.cgi?id=263446&action=review

> Source/JavaScriptCore/ChangeLog:18
> +        implemented incorrectly.  It was checking if any bits other than bit 0 was set.

was=>were

> Source/JavaScriptCore/ChangeLog:19
> +        However, boolean JS values always has TagBitBool (the 3rd bit) set.  Hence, the

has=>have

[Mark Lam]

Thanks.  Landed in r191290: <http://trac.webkit.org/r191290>.