[webkit-reviews] review granted: [Bug 214834] [JSC][wasm] Truncating slightly less than INT32_MIN is incorrect : [Attachment 405338] Patch

[bugzilla-daemon at webkit.org]

Darin Adler <darin at apple.com> has granted Yusuke Suzuki <ysuzuki at apple.com>'s
request for review:
Bug 214834: [JSC][wasm] Truncating slightly less than INT32_MIN is incorrect
https://bugs.webkit.org/show_bug.cgi?id=214834

Attachment 405338: Patch

https://bugs.webkit.org/attachment.cgi?id=405338&action=review




--- Comment #3 from Darin Adler <darin at apple.com> ---
Comment on attachment 405338
  --> https://bugs.webkit.org/attachment.cgi?id=405338
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=405338&action=review

> Source/JavaScriptCore/llint/WebAssembly.asm:1105
> +    move 0xcf000000, t0 # INT32_MIN (Note that INT32_MIN - 1.0 in float is
the same to INT32_MIN in float).

"same to" -> "same as"

> Source/JavaScriptCore/wasm/WasmAirIRGenerator.cpp:2815
> +    auto min = addConstant(Type::F64,
bitwise_cast<uint64_t>(static_cast<double>(std::numeric_limits<int32_t>::min())
- 1.0));

No need for the static_cast<double> now since "- 1.0" causes conversion to
double, but I suppose we can keep it for clarity.

> Source/JavaScriptCore/wasm/WasmB3IRGenerator.cpp:2273
> +    Value* min = constant(Double,
bitwise_cast<uint64_t>(static_cast<double>(std::numeric_limits<int32_t>::min())
- 1.0));

Ditto.