[Webkit-unassigned] [Bug 67486] New: MacroAssemberARM branchTruncateDoubleToInt32() doesn't work?

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=67486

           Summary: MacroAssemberARM branchTruncateDoubleToInt32() doesn't
                    work?
           Product: WebKit
           Version: 528+ (Nightly build)
          Platform: Unspecified
        OS/Version: Unspecified
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: JavaScriptCore
        AssignedTo: webkit-unassigned at lists.webkit.org
        ReportedBy: yong.li.webkit at gmail.com
                CC: barraclough at apple.com


Right shift operators (>> and >>>) fail when the left operand is a large negative number and the right operand is an immediate number.

var largeNeg=-2715228072;
alert(largeNeg >>> 5); // wrong when using ARM assembler.

It seems branchTruncateDoubleToInt32() doesn't work as expected by the caller (JIT::emitRightShiftSlowCase).

Turning off supportsFloatingPointTruncate() for MacroAssemberARM can simply solve the problem.

I noticed this comment in MacroAssemberARMv7.h:

    // On x86(_64) the MacroAssembler provides an interface to truncate a double to an integer.
    // If a value is not representable as an integer, and possibly for some values that are,
    // (on x86 INT_MIN, since this is indistinguishable from results for out-of-range/NaN input)
    // a branch will  be taken.  It is not clear whether this interface will be well suited to
    // other platforms.  On ARMv7 the hardware truncation operation produces multiple possible
    // failure values (saturates to INT_MIN & INT_MAX, NaN reulsts in a value of 0).  This is a
    // temporary solution while we work out what this interface should be.  Either we need to
    // decide to make this interface work on all platforms, rework the interface to make it more
    // generic, or decide that the MacroAssembler cannot practically be used to abstracted these
    // operations, and make clients go directly to the m_assembler to plant truncation instructions.
    // In short, FIXME:.
    bool supportsFloatingPointTruncate() const { return false; }

Should we also turn off supportsFloatingPointTruncate() for ARM?

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.