[DFG] NewArrayWithSize(size)'s size does not care negative zero
authorutatane.tea@gmail.com <utatane.tea@gmail.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Sat, 9 Sep 2017 05:19:47 +0000 (05:19 +0000)
committerutatane.tea@gmail.com <utatane.tea@gmail.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Sat, 9 Sep 2017 05:19:47 +0000 (05:19 +0000)
https://bugs.webkit.org/show_bug.cgi?id=176300

Reviewed by Saam Barati.

JSTests:

* stress/new-array-with-size-div.js: Added.
(shouldBe):
(test):
(i.i):

Source/JavaScriptCore:

NewArrayWithSize(size)'s size does not care negative zero as
is the same to NewTypedArray. We propagate this information
in DFGBackwardsPropagationPhase. This removes negative zero
check in kraken fft's deinterleave function.

* dfg/DFGBackwardsPropagationPhase.cpp:
(JSC::DFG::BackwardsPropagationPhase::propagate):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@221807 268f45cc-cd09-0410-ab3c-d52691b4dbfc

JSTests/ChangeLog
JSTests/stress/new-array-with-size-div.js [new file with mode: 0644]
Source/JavaScriptCore/ChangeLog
Source/JavaScriptCore/dfg/DFGBackwardsPropagationPhase.cpp

index 2deff2a..4ae1d5b 100644 (file)
@@ -1,5 +1,17 @@
 2017-09-08  Yusuke Suzuki  <utatane.tea@gmail.com>
 
+        [DFG] NewArrayWithSize(size)'s size does not care negative zero
+        https://bugs.webkit.org/show_bug.cgi?id=176300
+
+        Reviewed by Saam Barati.
+
+        * stress/new-array-with-size-div.js: Added.
+        (shouldBe):
+        (test):
+        (i.i):
+
+2017-09-08  Yusuke Suzuki  <utatane.tea@gmail.com>
+
         [DFG] PutByVal with Array::Generic is too generic
         https://bugs.webkit.org/show_bug.cgi?id=176345
 
diff --git a/JSTests/stress/new-array-with-size-div.js b/JSTests/stress/new-array-with-size-div.js
new file mode 100644 (file)
index 0000000..f0d113f
--- /dev/null
@@ -0,0 +1,22 @@
+function shouldBe(actual, expected) {
+    if (actual !== expected)
+        throw new Error('bad value: ' + actual);
+}
+
+function test(length, number)
+{
+    return new Array(length / number);
+}
+noInline(test);
+
+var value = 0;
+var number = 0;
+for (var i = 0; i < 1e4; ++i) {
+    value = i * 2;
+    number = 2;
+    if (i === (1e4 - 1)) {
+        value = 0;
+        number = -1;
+    }
+    shouldBe(test(value, number).length, (value / number));
+}
index 176967f..c3f8019 100644 (file)
@@ -1,5 +1,20 @@
 2017-09-08  Yusuke Suzuki  <utatane.tea@gmail.com>
 
+        [DFG] NewArrayWithSize(size)'s size does not care negative zero
+        https://bugs.webkit.org/show_bug.cgi?id=176300
+
+        Reviewed by Saam Barati.
+
+        NewArrayWithSize(size)'s size does not care negative zero as
+        is the same to NewTypedArray. We propagate this information
+        in DFGBackwardsPropagationPhase. This removes negative zero
+        check in kraken fft's deinterleave function.
+
+        * dfg/DFGBackwardsPropagationPhase.cpp:
+        (JSC::DFG::BackwardsPropagationPhase::propagate):
+
+2017-09-08  Yusuke Suzuki  <utatane.tea@gmail.com>
+
         [DFG] PutByVal with Array::Generic is too generic
         https://bugs.webkit.org/show_bug.cgi?id=176345
 
index 5f98907..e7796fb 100644 (file)
@@ -335,12 +335,8 @@ private:
             break;
         }
             
+        case NewTypedArray:
         case NewArrayWithSize: {
-            node->child1()->mergeFlags(NodeBytecodeUsesAsValue | NodeBytecodeUsesAsInt | NodeBytecodeUsesAsArrayIndex);
-            break;
-        }
-            
-        case NewTypedArray: {
             // Negative zero is not observable. NaN versus undefined are only observable
             // in that you would get a different exception message. So, like, whatever: we
             // claim here that NaN v. undefined is observable.