haikuwebkit/JSTests/stress/atomic-store-result-type-in...

6 lines
167 B
JavaScript
Raw Permalink Normal View History

[JSC] Atomics.store in DFG / FTL should return ToNumber(input) value https://bugs.webkit.org/show_bug.cgi?id=221438 <rdar://problem/73973264> Reviewed by Filip Pizlo. JSTests: * stress/atomic-store-result-type-in-ai.js: Added. * stress/atomics-store-result-double-nan.js: Added. (shouldBe): (test): * stress/atomics-store-result-double-negative-zero.js: Added. (shouldBe): (test): * stress/atomics-store-result-double.js: Added. (shouldBe): (test): * stress/atomics-store-result-int52.js: Added. (shouldBe): * stress/atomics-store-result.js: Added. (shouldBe): Source/JavaScriptCore: Atomics.store is different from the other ReadModifyWrite atomics. It returns the input value without truncating it into TypedArray's requirement. For example, var u8 = new Uint8Array(8); Atomics.store(u8, 0, 0xffff) === 0xffff // Not 0xff. However DFG and FTL implementations do not handle it correctly. This patch fixes AI, fixup, and code generations to handle this. * dfg/DFGAbstractInterpreterInlines.h: (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects): * dfg/DFGFixupPhase.cpp: (JSC::DFG::FixupPhase::fixupNode): * dfg/DFGSpeculativeJIT.cpp: (JSC::DFG::SpeculativeJIT::compileGetByValOnIntTypedArray): (JSC::DFG::SpeculativeJIT::getIntTypedArrayStoreOperandForAtomics): * dfg/DFGSpeculativeJIT.h: * dfg/DFGSpeculativeJIT64.cpp: (JSC::DFG::SpeculativeJIT::compile): * ftl/FTLLowerDFGToB3.cpp: (JSC::FTL::DFG::LowerDFGToB3::compileAtomicsReadModifyWrite): (JSC::FTL::DFG::LowerDFGToB3::compileGetByVal): (JSC::FTL::DFG::LowerDFGToB3::setIntTypedArrayLoadResult): (JSC::FTL::DFG::LowerDFGToB3::toIntegerOrInfinity): Canonical link: https://commits.webkit.org/233729@main git-svn-id: https://svn.webkit.org/repository/webkit/trunk@272405 268f45cc-cd09-0410-ab3c-d52691b4dbfc
2021-02-05 08:45:09 +00:00
//@ runDefault("--forceDebuggerBytecodeGeneration=1", "--useConcurrentJIT=0")
let a = new Uint8Array(1);
for (let i = 0; i < 10000; ++i) {
Atomics.store(a, 0, i);
}