Bug 174034 – B3ReduceDoubleToFloat incorrectly reduces operations over two double constants

• Status: RESOLVED
• Resolution: FIXED
• Component: JavaScriptCore

[Saam Barati]

e.g, we'll change this program:

a = DoubleConst(c1)
b = DoubleConst(c2)
c = EqualOrUnordered(@a, @b)

into:

a = FloatConst(static_cast<float>(c1))
b = FloatConst(static_cast<float>(c2))
c = EqualOrUnordered(@a, @b)

Which is clearly wrong. The example program where this goes wrong is for a denormal negative zero. We have this comparison:
a = DoubleConst(0x8000000000000001)
b = DoubleConst(0x0000000000000000)
c = EqualOrUnordered(@a, @b)

into:
a = FloatConst(0x80000000)
b = FloatConst(0x00000000)
c = EqualOrUnordered(@a, @b)

And this will produce different program behavior.

[Saam Barati]

<rdar://problem/30793007>

[Saam Barati]

Created attachment 314289 [details]
patch

[WebKit Commit Bot]

Comment on attachment 314289 [details]
patch

Clearing flags on attachment: 314289

Committed r219026: <http://trac.webkit.org/changeset/219026>

[WebKit Commit Bot]

All reviewed patches have been landed.  Closing bug.

[Csaba Osztrogonác]

(In reply to WebKit Commit Bot from comment #3)
> Comment on attachment 314289 [details]
> patch
> 
> Clearing flags on attachment: 314289
> 
> Committed r219026: <http://trac.webkit.org/changeset/219026>

It broke the GCC build, see build.webkit.org for details, for example the GTK bots and AArch64 bot.

[Csaba Osztrogonác]

https://build.webkit.org/builders/GTK%20Linux%2064-bit%20Release%20Ubuntu%20LTS%20%28Build%29/builds/3368

[Yusuke Suzuki]

Committed r219047: <http://trac.webkit.org/changeset/219047>

[Saam Barati]

(In reply to Yusuke Suzuki from comment #7)
> Committed r219047: <http://trac.webkit.org/changeset/219047>

Thanks!