Math.round() produces wrong result for value prior to 0.5
authorross.kirsling@sony.com <ross.kirsling@sony.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Fri, 6 Sep 2019 22:49:56 +0000 (22:49 +0000)
committerross.kirsling@sony.com <ross.kirsling@sony.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Fri, 6 Sep 2019 22:49:56 +0000 (22:49 +0000)
commit6082d5a45575ba9d84b196f63b625bc68c3e05d2
tree47d454b4ca4510b0b09cb865d217875a2e86f6f6
parenta69db6930da2d2559623aeb677d51777c92cfd19
Math.round() produces wrong result for value prior to 0.5
https://bugs.webkit.org/show_bug.cgi?id=185115

Reviewed by Saam Barati.

JSTests:

* stress/math-round-basics.js:
Add positive/negative test cases.

* test262/expectations.yaml:
Mark test passing.

Source/JavaScriptCore:

Our Math.round implementation goes in the wrong direction for double values like 0.49999999999999994.
This requires just a subtle adjustment for three of our four versions; only baseline JIT needed a full rewrite.

Specifically:
  - While 0.49999999999999994 is representable, 1 - 0.49999999999999994 is not (it turns into 0.5),
    so taking the difference between ceil(value)` and `value` is problematic.
  - The baseline implementation was doing `floor(x + 0.5)` for positive doubles and slowpathing negative ones
    (by falling back to jsRound). This patch gives baseline a legitimate implementation too.

* dfg/DFGSpeculativeJIT.cpp:
(JSC::DFG::SpeculativeJIT::compileArithRounding):
* ftl/FTLLowerDFGToB3.cpp:
(JSC::FTL::DFG::LowerDFGToB3::compileArithRound):
* jit/ThunkGenerators.cpp:
(JSC::roundThunkGenerator):
* runtime/MathCommon.cpp:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@249597 268f45cc-cd09-0410-ab3c-d52691b4dbfc
JSTests/ChangeLog
JSTests/stress/math-round-basics.js
JSTests/test262/expectations.yaml
Source/JavaScriptCore/ChangeLog
Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp
Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp
Source/JavaScriptCore/jit/ThunkGenerators.cpp
Source/JavaScriptCore/runtime/MathCommon.cpp