[Webkit-unassigned] [Bug 158368] New: Eager FTL failure for strict comparison of NaN with number check

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=158368

            Bug ID: 158368
           Summary: Eager FTL failure for strict comparison of NaN with
                    number check
    Classification: Unclassified
           Product: WebKit
           Version: WebKit Nightly Build
          Hardware: Unspecified
                OS: Unspecified
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: JavaScriptCore
          Assignee: webkit-unassigned at lists.webkit.org
          Reporter: joepeck at webkit.org
                CC: benjamin at webkit.org, fpizlo at apple.com,
                    ggaren at apple.com, keith_miller at apple.com,
                    sbarati at apple.com

Created attachment 280480
  --> https://bugs.webkit.org/attachment.cgi?id=280480&action=review
[TEST] JS Reduction

* SUMMARY
Eager FTL failure for strict comparison of NaN with number check

* TEST
function isNaNOnDouble(value)
{
    return (+value) !== value;
}
noInline(isNaNOnDouble);

function testIsNaNOnDoubles()
{
    var value = isNaNOnDouble(-0);
    if (value)
        throw "isNaNOnDouble(-0) = " + value;

    var value = isNaNOnDouble(NaN);
    if (!value)
        throw "isNaNOnDouble(NaN) = " + value;

    var value = isNaNOnDouble(Number.POSITIVE_INFINITY);
    if (value)
        throw "isNaNOnDouble(Number.POSITIVE_INFINITY) = " + value;
}
noInline(testIsNaNOnDoubles);

for (var i = 0; i < 1e6; ++i) {
    testIsNaNOnDoubles();
}


* STEPS TO REPRODUCE
1. $ DYLD_FRAMEWORK_PATH=$build/Release $build/Release/jsc --useFTLJIT=true --useConcurrentJIT=false --thresholdForJITAfterWarmUp=100 --thresholdForJITAfterWarmUp=10 --thresholdForJITSoon=10 --thresholdForOptimizeAfterWarmUp=20 --thresholdForOptimizeAfterLongWarmUp=20 --thresholdForOptimizeSoon=20 --thresholdForFTLOptimizeAfterWarmUp=20 --thresholdForFTLOptimizeSoon=20 number-compare-strict.js

Exception: isNaNOnDouble(NaN) = false

* NOTES
- The issue only reproduces if --useConcurrentJIT=false

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.webkit.org/pipermail/webkit-unassigned/attachments/20160603/9134ac91/attachment.html>