Makes compileArithSub in the DFG ensure that the constant is an int32.

https://bugs.webkit.org/show_bug.cgi?id=146910
rdar://problem/21729083

Reviewed by Filip Pizlo.

Also fixes the debug build problem where all edges are assumed to
have UntypedUse before the fixup phase.

* dfg/DFGSpeculativeJIT.cpp:
(JSC::DFG::SpeculativeJIT::compileArithSub):
* dfg/DFGValidate.cpp:
(JSC::DFG::Validate::validateEdgeWithDoubleResultIfNecessary):
* tests/stress/arith-add-with-constants.js: Added some tests for this case.
(arithAdd42WrittenAsInteger):
(testArithAdd42WrittenAsInteger):
(arithSub42WrittenAsDouble):
(testArithSub42WrittenAsDouble):
(doubleConstant):
(testDoubleConstant): Added test for the case of +0.0 and Math.min(0.0)
(arithAdd42WrittenAsDouble): Deleted.
(testArithAdd42WrittenAsDouble): Deleted.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@186805 268f45cc-cd09-0410-ab3c-d52691b4dbfc

diff --git a/Source/JavaScriptCore/ChangeLog b/Source/JavaScriptCore/ChangeLog
index 0e7faf9..bc1e62e 100644 (file)
--- a/Source/JavaScriptCore/ChangeLog
+++ b/Source/JavaScriptCore/ChangeLog
@@ -1,3 +1,28 @@
+2015-07-13  Matthew Mirman  <mmirman@apple.com>
+
+        Makes compileArithSub in the DFG ensure that the constant is an int32.
+        https://bugs.webkit.org/show_bug.cgi?id=146910
+        rdar://problem/21729083
+
+        Reviewed by Filip Pizlo.
+        
+        Also fixes the debug build problem where all edges are assumed to 
+        have UntypedUse before the fixup phase.
+
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileArithSub):
+        * dfg/DFGValidate.cpp:
+        (JSC::DFG::Validate::validateEdgeWithDoubleResultIfNecessary):
+        * tests/stress/arith-add-with-constants.js: Added some tests for this case.
+        (arithAdd42WrittenAsInteger):
+        (testArithAdd42WrittenAsInteger):
+        (arithSub42WrittenAsDouble):
+        (testArithSub42WrittenAsDouble):
+        (doubleConstant):
+        (testDoubleConstant): Added test for the case of +0.0 and Math.min(0.0)
+        (arithAdd42WrittenAsDouble): Deleted.
+        (testArithAdd42WrittenAsDouble): Deleted.
+
 2015-07-13  Basile Clement  <basile_clement@apple.com>
 
         Object cycles should not prevent allocation elimination/sinking

diff --git a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp
index 8b5fa95..9644995 100644 (file)
--- a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp
+++ b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp
@@ -2989,7 +2989,7 @@ void SpeculativeJIT::compileArithSub(Node* node)
     case Int32Use: {
         ASSERT(!shouldCheckNegativeZero(node->arithMode()));
         
-        if (node->child2()->isNumberConstant()) {
+        if (node->child2()->isInt32Constant()) {
             SpeculateInt32Operand op1(this, node->child1());
             int32_t imm2 = node->child2()->asInt32();
             GPRTemporary result(this);
@@ -3006,7 +3006,7 @@ void SpeculativeJIT::compileArithSub(Node* node)
             return;
         }
             
-        if (node->child1()->isNumberConstant()) {
+        if (node->child1()->isInt32Constant()) {
             int32_t imm1 = node->child1()->asInt32();
             SpeculateInt32Operand op2(this, node->child2());
             GPRTemporary result(this);

diff --git a/Source/JavaScriptCore/dfg/DFGValidate.cpp b/Source/JavaScriptCore/dfg/DFGValidate.cpp
index 0d5b468..6a134d0 100644 (file)
--- a/Source/JavaScriptCore/dfg/DFGValidate.cpp
+++ b/Source/JavaScriptCore/dfg/DFGValidate.cpp
@@ -574,9 +574,9 @@ private:
             return;
 
         if (m_graph.m_planStage < PlanStage::AfterFixup)
-            VALIDATE((node, edge), edge.useKind() == UntypedUse);
-        else
-            VALIDATE((node, edge), edge.useKind() == DoubleRepUse || edge.useKind() == DoubleRepRealUse || edge.useKind() == DoubleRepMachineIntUse);
+            return;
+        
+        VALIDATE((node, edge), edge.useKind() == DoubleRepUse || edge.useKind() == DoubleRepRealUse || edge.useKind() == DoubleRepMachineIntUse);
     }
 
     void checkOperand(

diff --git a/Source/JavaScriptCore/tests/stress/arith-add-with-constants.js b/Source/JavaScriptCore/tests/stress/arith-add-with-constants.js
index 27be428..ffb90dc 100644 (file)
--- a/Source/JavaScriptCore/tests/stress/arith-add-with-constants.js
+++ b/Source/JavaScriptCore/tests/stress/arith-add-with-constants.js
@@ -167,56 +167,105 @@ function testArithAdd42WrittenAsInteger() {
 testArithAdd42WrittenAsInteger();
 
 
-function arithAdd42WrittenAsDouble(x) {
-    var a = x + 42.0;
-    var b = 42. + x;
+
+
+// Test "value + 42".
+function arithAdd42WrittenAsInteger(x) {
+    var a = x + 42;
+    var b = 42 + x;
     if (!(isNaN(x) && isNaN(a) && isNaN(b)) && a !== b)
-        throw "Internal error on arithAdd42WrittenAsDouble, a = " + a + " b = " + b;
+        throw "Internal error on arithAdd42WrittenAsInteger, a = " + a + " b = " + b;
     return a;
 }
-noInline(arithAdd42WrittenAsDouble);
+noInline(arithAdd42WrittenAsInteger);
 
-function testArithAdd42WrittenAsDouble() {
+function testArithAdd42WrittenAsInteger() {
     for (var i = 0; i < 1e4; ++i) {
-        var result = arithAdd42WrittenAsDouble(13);
+        var result = arithAdd42WrittenAsInteger(13);
         if (result !== 55) {
-            throw "arithAdd42WrittenAsDouble(i) = " + result + ", expected 55";
+            throw "arithAdd42WrittenAsInteger(13) = " + result + ", expected 55";
         }
     }
 
     for (var i = 0; i < 1e4; ++i) {
-        var result = arithAdd42WrittenAsDouble(-0);
+        var result = arithAdd42WrittenAsInteger(-0);
         if (result !== 42) {
-            throw "arithAdd42WrittenAsDouble(-0) = " + result + ", expected 42";
+            throw "arithAdd42WrittenAsInteger(-0) = " + result + ", expected 42";
         }
     }
 
     for (var i = 0; i < 1e4; ++i) {
-        var result = arithAdd42WrittenAsDouble(13.3);
+        var result = arithAdd42WrittenAsInteger(13.3);
         if (result !== 55.3) {
-            throw "arithAdd42WrittenAsDouble(13.3) = " + result + ", expected 55.3";
+            throw "arithAdd42WrittenAsInteger(13.3) = " + result + ", expected 55.3";
         }
     }
 
     for (var i = 0; i < 1e4; ++i) {;
-        var result = arithAdd42WrittenAsDouble(NaN);
+        var result = arithAdd42WrittenAsInteger(NaN);
         if (!isNaN(result)) {
-            throw "arithAdd42WrittenAsDouble(NaN) = " + result + ", expected NaN";
+            throw "arithAdd42WrittenAsInteger(NaN) = " + result + ", expected NaN";
         }
     }
 
     for (var i = 0; i < 1e4; ++i) {;
-        var result = arithAdd42WrittenAsDouble(Infinity);
+        var result = arithAdd42WrittenAsInteger(Infinity);
         if (isFinite(result)) {
-            throw "arithAdd42WrittenAsDouble(Infinity) = " + result + ", expected Infinity";
+            throw "arithAdd42WrittenAsInteger(Infinity) = " + result + ", expected Infinity";
         }
     }
 
     for (var i = 0; i < 1e4; ++i) {;
-        var result = arithAdd42WrittenAsDouble(-Infinity);
+        var result = arithAdd42WrittenAsInteger(-Infinity);
         if (isFinite(result) || result >= 0) {
-            throw "arithAdd42WrittenAsDouble(-Infinity) = " + result + ", expected -Infinity";
+            throw "arithAdd42WrittenAsInteger(-Infinity) = " + result + ", expected -Infinity";
         }
     }
 }
-testArithAdd42WrittenAsDouble();
\ No newline at end of file
+testArithAdd42WrittenAsInteger();
+
+function arithSub42WrittenAsDouble(x) {
+    var a = (x|0) - 42.0;
+    var b = -42. + (x|0);
+    if (!(isNaN(x) && isNaN(a) && isNaN(b)) && a !== b)
+        throw "Internal error on arithSub42WrittenAsDouble, a = " + a + " b = " + b;
+    return a;
+}
+noInline(arithSub42WrittenAsDouble);
+
+function testArithSub42WrittenAsDouble() {
+    for (var i = 0; i < 1e4; ++i) {
+        var result = arithSub42WrittenAsDouble(13);
+        if (result !== -29) {
+            throw "arithSub42WrittenAsDouble(13) = " + result + ", expected -29";
+        }
+    }
+
+    for (var i = 0; i < 1e4; ++i) {
+        var result = arithSub42WrittenAsDouble(-0);
+        if (result !== -42) {
+            throw "arithSub42WrittenAsDouble(-0) = " + result + ", expected -42";
+        }
+    }
+
+    for (var i = 0; i < 1e4; ++i) {
+        var result = arithSub42WrittenAsDouble(13.3);
+        if (result !== -29) {
+            throw "arithSub42WrittenAsDouble(13.3) = " + result + ", expected -29";
+        }
+    }
+}
+testArithSub42WrittenAsDouble();
+
+
+function doubleConstant(){
+    Math.min(0.0);
+    +0.0;
+} noInline(doubleConstant);
+
+function testDoubleConstant(){
+    for (var i = 0; i < 1e4; ++i) {
+        doubleConstant();
+    }
+}
+testDoubleConstant();