Bug 69552 - DFG implementation of UInt32ToNumber is missing a break statement
Summary: DFG implementation of UInt32ToNumber is missing a break statement
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: JavaScriptCore (show other bugs)
Version: 528+ (Nightly build)
Hardware: All All
: P2 Normal
Assignee: Nobody
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2011-10-06 12:52 PDT by Filip Pizlo
Modified: 2011-10-06 14:45 PDT (History)
1 user (show)

See Also:

Attachments
the patch (1.76 KB, patch)
2011-10-06 12:54 PDT, Filip Pizlo 		oliver: review+
Details | Formatted Diff | Diff
View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Filip Pizlo 2011-10-06 12:52:22 PDT 
This may result in bizarre code generation behavior or crashes when compiling a UInt32ToNumber that must perform a double conversion.
Comment 1 Filip Pizlo 2011-10-06 12:54:32 PDT 
Created attachment 109999 [details]
the patch
Comment 2 Oliver Hunt 2011-10-06 12:55:13 PDT 
Comment on attachment 109999 [details]
the patch

ouch
Comment 3 Geoffrey Garen 2011-10-06 14:30:19 PDT 
Can this be regression tested?
Comment 4 Filip Pizlo 2011-10-06 14:42:27 PDT 
Landed in r96860.
Comment 5 Filip Pizlo 2011-10-06 14:45:57 PDT 
(In reply to comment #3)
> Can this be regression tested?

I think we should strive to do this right, in one go: https://bugs.webkit.org/show_bug.cgi?id=69565

The DFG's speculation on arithmetic operations is starting to stabilize to the point where it can be succinctly described and elegantly tested.  I think we should take a break at some point from adding new bugs to the DFG and figure out a testing harness that can do this the right way, and uniformly, to minimize the number of redundant tests that we add.