Bug 228068 - Compiler Incorrect Optimization
Summary: Compiler Incorrect Optimization
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: JavaScriptCore (show other bugs)
Version: WebKit Nightly Build
Hardware: Unspecified Unspecified
: P2 Normal
Assignee: Mark Lam
URL:
Keywords: InRadar
Depends on:
Blocks:
 
Reported: 2021-07-18 19:59 PDT by zhiyi
Modified: 2021-07-19 17:49 PDT (History)
10 users (show)

See Also:


Attachments
proposed patch. (2.68 KB, patch)
2021-07-19 15:31 PDT, Mark Lam
ysuzuki: review+
Details | Formatted Diff | Diff
patch for landing. (2.58 KB, patch)
2021-07-19 15:44 PDT, Mark Lam
no flags Details | Formatted Diff | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description zhiyi 2021-07-18 19:59:14 PDT
OS: ubuntu18.04
Architecture: <x64>

./jsc bug.js

expected output
-Infinity
-Infinity

actual output
-Infinity
Infinity


bug.js
##################################
function f() {
  v0 = (-0.0).toLocaleString();
  return parseInt(v0);
}
let a0 = f();
print(1 / a0);

for (let i = 0; i < 0x1000; i++) { f(); }
let a3 = f();
print(1 / a3);
Comment 1 Radar WebKit Bug Importer 2021-07-19 09:44:59 PDT
<rdar://problem/80788603>
Comment 2 Mark Lam 2021-07-19 15:31:39 PDT
Created attachment 433828 [details]
proposed patch.
Comment 3 Yusuke Suzuki 2021-07-19 15:35:10 PDT
Comment on attachment 433828 [details]
proposed patch.

View in context: https://bugs.webkit.org/attachment.cgi?id=433828&action=review

> Source/JavaScriptCore/dfg/DFGOperations.cpp:206
> +    if (static_cast<double>(asInt) == input) {
> +        if (asInt || !std::signbit(input))

I think it is worth putting `LIKELY`.

if (LIKELY(static_cast<double>(asInt) == input && (asInt || !std::signbit(input))))
    return JSValue::encode(jsNumber(asInt));
Comment 4 Mark Lam 2021-07-19 15:36:22 PDT
(In reply to Yusuke Suzuki from comment #3)
> Comment on attachment 433828 [details]
> proposed patch.
> 
> View in context:
> https://bugs.webkit.org/attachment.cgi?id=433828&action=review
> 
> > Source/JavaScriptCore/dfg/DFGOperations.cpp:206
> > +    if (static_cast<double>(asInt) == input) {
> > +        if (asInt || !std::signbit(input))
> 
> I think it is worth putting `LIKELY`.
> 
> if (LIKELY(static_cast<double>(asInt) == input && (asInt ||
> !std::signbit(input))))
>     return JSValue::encode(jsNumber(asInt));

OK, will do.
Comment 5 Mark Lam 2021-07-19 15:44:25 PDT
Created attachment 433830 [details]
patch for landing.
Comment 6 Mark Lam 2021-07-19 17:49:45 PDT
Thanks for the review.  Landed in r280060: <http://trac.webkit.org/r280060>.