diff --git a/JSTests/stress/double-inlined-call-argument.js b/JSTests/stress/double-inlined-call-argument.js new file mode 100644 index 0000000000000..d27dce971a0d9 --- /dev/null +++ b/JSTests/stress/double-inlined-call-argument.js @@ -0,0 +1,22 @@ +function foo(a, b, c, p) { + a = b + c; + if (p) { + a++; + return a; + } +} + +function bar(a, b) { + return foo("hello", a, b, a <= b); +} + +noInline(bar); + +for (var i = 0; i < 100000; ++i) { + var result = bar(2000000000, 2000000000.5); + if (result != 4000000001.5) + throw new Error(`Bad result: ${result}!`); +} + +if (reoptimizationRetryCount(bar) != 0) + throw new Error(`Should not have reoptimized bar, but reoptimized ${reoptimizationRetryCount(bar)} times.`); diff --git a/JSTests/stress/regress-116397731.js b/JSTests/stress/regress-116397731.js new file mode 100644 index 0000000000000..fe9db950f4c53 --- /dev/null +++ b/JSTests/stress/regress-116397731.js @@ -0,0 +1,16 @@ +var out; + +function func0(value) { + if (value) {} + out = value; + value = value + 1 + 2; +} + +function main() { + for (let i = 0; i < 0x100000; i++) + func0(undefined); + if (out !== undefined) + throw new Error(`Bad value: ${out}!`); +} + +main(); diff --git a/Source/JavaScriptCore/dfg/DFGVariableAccessData.cpp b/Source/JavaScriptCore/dfg/DFGVariableAccessData.cpp index 2ac2ee39b4cca..1cb933ba841bf 100644 --- a/Source/JavaScriptCore/dfg/DFGVariableAccessData.cpp +++ b/Source/JavaScriptCore/dfg/DFGVariableAccessData.cpp @@ -131,7 +131,7 @@ bool VariableAccessData::tallyVotesForShouldUseDoubleFormat() if (!newValueOfShouldUseDoubleFormat) { // We monotonically convert to double. Hence, if the fixpoint leads us to conclude that we should // switch back to int, we instead ignore this and stick with double. - return false; + return DFG::mergeDoubleFormatState(m_doubleFormatState, NotUsingDoubleFormat); } if (m_doubleFormatState == UsingDoubleFormat)