DFGGraph::m_doubleConstantMap will not map 0 values correctly.
authormark.lam@apple.com <mark.lam@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Wed, 18 Jun 2014 18:57:12 +0000 (18:57 +0000)
committermark.lam@apple.com <mark.lam@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Wed, 18 Jun 2014 18:57:12 +0000 (18:57 +0000)
commit00edfbfd01e8a7f1f9ab5499ac9f4545b85c3220
tree10474c8ca4bc0dd79ad3847614f7580f5716a6de
parentaef72ec0e1d6facf7bd421dbd78314f323bd7f91
DFGGraph::m_doubleConstantMap will not map 0 values correctly.
<https://webkit.org/b/133994>

Reviewed by Geoffrey Garen.

DFGGraph::m_doubleConstantsMap should not use a double as a key to its HashMap,
because it means two unfortunate things:
- It will probably break for zero.
- It will think that -0 is the same as +0 under some circumstances, size
  -0==+0 even though they are distinct values (for example 1/-0 != 1/+0).

The fix is to use std::unordered_map which does not require special empty
and deleted values, and to use the raw bits instead of the double value as
the key.

* dfg/DFGGraph.h:
* dfg/DFGJITCompiler.cpp:
(JSC::DFG::JITCompiler::addressOfDoubleConstant):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@170109 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Source/JavaScriptCore/ChangeLog
Source/JavaScriptCore/dfg/DFGGraph.h
Source/JavaScriptCore/dfg/DFGJITCompiler.cpp