Title: [276524] trunk/Source/_javascript_Core
Revision
276524
Author
[email protected]
Date
2021-04-23 15:14:11 -0700 (Fri, 23 Apr 2021)

Log Message

Fix B3 strength reduction for shl.
https://bugs.webkit.org/show_bug.cgi?id=224913
rdar://76978874

Reviewed by Michael Saboff.

If the operation can potentially either underflow or overflow, then the result
can be any value.

* b3/B3ReduceStrength.cpp:

Modified Paths

Diff

Modified: trunk/Source/_javascript_Core/ChangeLog (276523 => 276524)


--- trunk/Source/_javascript_Core/ChangeLog	2021-04-23 22:06:26 UTC (rev 276523)
+++ trunk/Source/_javascript_Core/ChangeLog	2021-04-23 22:14:11 UTC (rev 276524)
@@ -1,3 +1,16 @@
+2021-04-23  Mark Lam  <[email protected]>
+
+        Fix B3 strength reduction for shl.
+        https://bugs.webkit.org/show_bug.cgi?id=224913
+        rdar://76978874
+
+        Reviewed by Michael Saboff.
+
+        If the operation can potentially either underflow or overflow, then the result
+        can be any value.
+
+        * b3/B3ReduceStrength.cpp:
+
 2021-04-23  Fujii Hironori  <[email protected]>
 
         [JSC][Win] callOperationNoExceptionCheck() also needs to support operations that return SlowPathReturnType

Modified: trunk/Source/_javascript_Core/b3/B3ReduceStrength.cpp (276523 => 276524)


--- trunk/Source/_javascript_Core/b3/B3ReduceStrength.cpp	2021-04-23 22:06:26 UTC (rev 276523)
+++ trunk/Source/_javascript_Core/b3/B3ReduceStrength.cpp	2021-04-23 22:14:11 UTC (rev 276524)
@@ -240,10 +240,11 @@
         T newMin = static_cast<T>(m_min) << static_cast<T>(shiftAmount);
         T newMax = static_cast<T>(m_max) << static_cast<T>(shiftAmount);
 
-        if ((newMin >> shiftAmount) != static_cast<T>(m_min))
+        if (((newMin >> shiftAmount) != static_cast<T>(m_min))
+            || ((newMax >> shiftAmount) != static_cast<T>(m_max))) {
             newMin = std::numeric_limits<T>::min();
-        if ((newMax >> shiftAmount) != static_cast<T>(m_max))
             newMax = std::numeric_limits<T>::max();
+        }
 
         return IntRange(newMin, newMax);
     }
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes

Reply via email to