885175 - Fix hashing of doubles

Status: RESOLVED FIXED

(Core :: JavaScript Engine, enhancement)

Description

[Dan Gohman [:sunfish]]

DefaultHasher<double>'s hash method uses a union which causes it to return values which depend on the endianness, and its match method uses floating-point equality, so it doesn't handle negative zeros or NaNs properly.

Comment 1

[Dan Gohman [:sunfish]]

Attachment: a proposed fix

This is partly based on part of the patch in bug 876064.

Comment 2

[Luke Wagner [:luke]]

Could you use BitwiseCast<uint64_t> instead (see use in ion/MIR.cpp)?

Comment 3

[Jeff Walden [:Waldo]]

Does the existing DefaultHasher stuff use mfbt/HashFunctions.h at all?  Would probably be good to add some double overloads and functions there, and use that.  (The existing code there looks like it'd hash the double as if it were a uint32_t, which is wrong in all sorts of ways.)

Comment 4

[Dan Gohman [:sunfish]]

Attachment: an updated patch, following review feedback

Luke: Updated patch using BitwiseCast<uint64_t>. It's nicer :-).

Jeff: As far as I can tell, nothing in js/public/HashTable.h uses mfbt/HashFunctions.h currently. Switching it over looks like a bigger project than I'm interested in tackling at this time.

Comment 5

[Luke Wagner [:luke]]

Comment on attachment 765482 [details] [diff] [review]
an updated patch, following review feedback

Great!  Feel free to take over bug 876064, btw.

Comment 6

[Dan Gohman [:sunfish]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/806a358aa8b2

Also, yes, I do plan to take over bug 876064 soon :).

Comment 7

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/806a358aa8b2