Changeset 103636 in webkit for trunk/Source/JavaScriptCore/assembler

Timestamp:

Dec 23, 2011, 1:05:46 PM (14 years ago)

Author:

[email protected]

Message:

DFG does double-to-int conversion incorrectly when storing into int typed arrays
​https://bugs.webkit.org/show_bug.cgi?id=75164
<rdar://problem/10557547>

Reviewed by Geoffrey Garen.

Source/JavaScriptCore:

• assembler/MacroAssemblerARMv7.h:

(JSC::MacroAssemblerARMv7::branchTruncateDoubleToUint32):

• assembler/MacroAssemblerX86Common.h:

(JSC::MacroAssemblerX86Common::branchTruncateDoubleToUint32):
(JSC::MacroAssemblerX86Common::truncateDoubleToUint32):

• dfg/DFGSpeculativeJIT.cpp:

(JSC::DFG::SpeculativeJIT::compilePutByValForIntTypedArray):

LayoutTests:

• fast/js/dfg-int32array-overflow-values-expected.txt: Added.
• fast/js/dfg-int32array-overflow-values.html: Added.
• fast/js/dfg-uint32array-overflow-values-expected.txt: Added.
• fast/js/dfg-uint32array-overflow-values.html: Added.
• fast/js/script-tests/dfg-int32array-overflow-values.js: Added.

(getter1):
(setter1):
(getter2):
(setter2):
(getter3):
(setter3):
(getter4):
(setter4):
(getters.getter1.a):
(.a):
(setters.setter1.a):
(safeGetter):
(safeSetter):

• fast/js/script-tests/dfg-uint32array-overflow-values.js: Added.

(getter1):
(setter1):
(getter2):
(setter2):
(getter3):
(setter3):
(getter4):
(setter4):
(getters.getter1.a):
(.a):
(setters.setter1.a):
(safeGetter):
(safeSetter):

Location:

trunk/Source/JavaScriptCore/assembler

Files:

• MacroAssemblerARMv7.h (modified) (1 diff)
• MacroAssemblerX86Common.h (modified) (2 diffs)

trunk/Source/JavaScriptCore/assembler/MacroAssemblerARMv7.h

@@ -937 +937 @@
     }
 
+    Jump branchTruncateDoubleToUint32(FPRegisterID src, RegisterID dest, BranchTruncateType branchType = BranchIfTruncateFailed)
+    {
+        m_assembler.vcvt_floatingPointToSigned(fpTempRegisterAsSingle(), src);
+        m_assembler.vmov(dest, fpTempRegisterAsSingle());
+
+        return branch32(branchType ? GreaterThanOrEqual : LessThan, dest, TrustedImm32(0));
+    }
+
     // Result is undefined if the value is outside of the integer range.
     void truncateDoubleToInt32(FPRegisterID src, RegisterID dest)

trunk/Source/JavaScriptCore/assembler/MacroAssemblerX86Common.h

@@ -787 +787 @@
     }
 
+    Jump branchTruncateDoubleToUint32(FPRegisterID src, RegisterID dest, BranchTruncateType branchType = BranchIfTruncateFailed)
+    {
+        ASSERT(isSSE2Present());
+        m_assembler.cvttsd2si_rr(src, dest);
+        return branch32(branchType ? GreaterThanOrEqual : LessThan, dest, TrustedImm32(0));
+    }
+
     void truncateDoubleToInt32(FPRegisterID src, RegisterID dest)
     {
@@ -798 +805 @@
         ASSERT(isSSE2Present());
         m_assembler.cvttsd2siq_rr(src, dest);
-    }
-#else
-    void truncateDoubleToUint32(FPRegisterID src, RegisterID dest)
-    {
-        ASSERT(isSSE2Present());
-        // FIXME: Generate correct code for a double to unsigned conversion.
-        m_assembler.cvttsd2si_rr(src, dest);
     }
 #endif