ThunkGenerators does not convert positive double zero into integer zero, particularly when returning from floor, ceil, and round. This means that doing Math.floor(2/1) does not return an integer as some benchmarks expect. This omission is due to conservatism when dealing with double zero. A double zero could be negative, in which case converting to an integer would be wrong. But because the ThunkGenerators return the result in a GPR after boxing, it's possible to easily detect positive double zero. The first step of boxing is moving the double into a GPR. When the value is in a GPR, a positive double zero is represented by all bits being identically 0. Thus, a branchTestPtr(Zero, regT0) is all that is needed to detect positive double zero and convert it to an integer zero.
Created attachment 106246 [details] the patch
Comment on attachment 106246 [details] the patch All tests pass.
Hey Filip, I haven't looked closely yet, but we really should make this work for JSVALUE32_64 too, if it doesn't do so already.
(In reply to comment #3) > Hey Filip, I haven't looked closely yet, but we really should make this work for JSVALUE32_64 too, if it doesn't do so already. It's not clear to me that this will be performance-neutral in JSVALUE32_64. On 64-bit it's a single branch. On JSVALUE32_64 it would be two branches. I'll mess around with it though.
Created attachment 106258 [details] the patch - 32 bit as well
Comment on attachment 106258 [details] the patch - 32 bit as well Awesome, cheers for covering 32_64 too Phil.
Comment on attachment 106258 [details] the patch - 32 bit as well Clearing flags on attachment: 106258 Committed r94500: <http://trac.webkit.org/changeset/94500>
All reviewed patches have been landed. Closing bug.