[DFG] Compare operations do not respect negative zeros
authorutatane.tea@gmail.com <utatane.tea@gmail.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Thu, 7 Jun 2018 02:28:01 +0000 (02:28 +0000)
committerutatane.tea@gmail.com <utatane.tea@gmail.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Thu, 7 Jun 2018 02:28:01 +0000 (02:28 +0000)
commitcfa9e7e47f2992e2ea4b14aa7a94609e1d704211
tree4eb35b48697f0f23caf01281bd555a277d5224a4
parent2a33d71f59a48432842841dab1bbd1958d24fc47
[DFG] Compare operations do not respect negative zeros
https://bugs.webkit.org/show_bug.cgi?id=183729

Reviewed by Saam Barati.

JSTests:

* stress/comparison-ignore-negative-zero.js: Added.
(shouldBe):
(zero):
(negativeZero):
(object.valueOf):
(test):

Source/JavaScriptCore:

Compare operations do not respect negative zeros. So propagating this can
reduce the size of the produced code for negative zero case. This pattern
can be seen in Kraken stanford-crypto-aes.

This also causes an existing bug which converts CompareEq(Int32Only, NonIntAsdouble) to false.
However, NonIntAsdouble includes negative zero, which can be equal to Int32 positive zero.
This issue is covered by fold-based-on-int32-proof-mul-branch.js, and we fix this.

* bytecode/SpeculatedType.cpp:
(JSC::leastUpperBoundOfStrictlyEquivalentSpeculations):
SpecNonIntAsDouble includes negative zero (-0.0), which can be equal to 0 and 0.0.
To emphasize this, we use SpecAnyIntAsDouble | SpecNonIntAsDouble directly instead of
SpecDoubleReal.

* dfg/DFGBackwardsPropagationPhase.cpp:
(JSC::DFG::BackwardsPropagationPhase::propagate):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@232567 268f45cc-cd09-0410-ab3c-d52691b4dbfc
JSTests/ChangeLog
JSTests/stress/comparison-ignore-negative-zero.js [new file with mode: 0644]
Source/JavaScriptCore/ChangeLog
Source/JavaScriptCore/bytecode/SpeculatedType.cpp
Source/JavaScriptCore/dfg/DFGBackwardsPropagationPhase.cpp