Title: [283300] trunk
- Revision
- 283300
- Author
- [email protected]
- Date
- 2021-09-29 22:27:45 -0700 (Wed, 29 Sep 2021)
Log Message
DFG strength reduction on % operator should handle an INT_MIN divisor.
https://bugs.webkit.org/show_bug.cgi?id=230391
<rdar://problem/83229740>
Reviewed by Robin Morisset.
JSTests:
* stress/dfg-strength-reduction-on-mod-should-handle-INT_MIN.js: Added.
Source/_javascript_Core:
* dfg/DFGStrengthReductionPhase.cpp:
(JSC::DFG::StrengthReductionPhase::handleNode):
Modified Paths
Added Paths
Diff
Modified: trunk/JSTests/ChangeLog (283299 => 283300)
--- trunk/JSTests/ChangeLog 2021-09-30 05:17:38 UTC (rev 283299)
+++ trunk/JSTests/ChangeLog 2021-09-30 05:27:45 UTC (rev 283300)
@@ -1,3 +1,13 @@
+2021-09-29 Mark Lam <[email protected]>
+
+ DFG strength reduction on % operator should handle an INT_MIN divisor.
+ https://bugs.webkit.org/show_bug.cgi?id=230391
+ <rdar://problem/83229740>
+
+ Reviewed by Robin Morisset.
+
+ * stress/dfg-strength-reduction-on-mod-should-handle-INT_MIN.js: Added.
+
2021-09-29 Saam Barati <[email protected]>
Print values in a nicer way in the jsc shell
Added: trunk/JSTests/stress/dfg-strength-reduction-on-mod-should-handle-INT_MIN.js (0 => 283300)
--- trunk/JSTests/stress/dfg-strength-reduction-on-mod-should-handle-INT_MIN.js (rev 0)
+++ trunk/JSTests/stress/dfg-strength-reduction-on-mod-should-handle-INT_MIN.js 2021-09-30 05:27:45 UTC (rev 283300)
@@ -0,0 +1,11 @@
+function foo(num) {
+ num |= 0;
+ let x1 = num % -2147483648;
+ let x2 = x1 % 5;
+
+ if (x2 > 5)
+ throw "Error";
+}
+
+for (let i = 0; i < 10000; i++)
+ foo(i);
Modified: trunk/Source/_javascript_Core/ChangeLog (283299 => 283300)
--- trunk/Source/_javascript_Core/ChangeLog 2021-09-30 05:17:38 UTC (rev 283299)
+++ trunk/Source/_javascript_Core/ChangeLog 2021-09-30 05:27:45 UTC (rev 283300)
@@ -1,3 +1,14 @@
+2021-09-29 Mark Lam <[email protected]>
+
+ DFG strength reduction on % operator should handle an INT_MIN divisor.
+ https://bugs.webkit.org/show_bug.cgi?id=230391
+ <rdar://problem/83229740>
+
+ Reviewed by Robin Morisset.
+
+ * dfg/DFGStrengthReductionPhase.cpp:
+ (JSC::DFG::StrengthReductionPhase::handleNode):
+
2021-09-29 Saam Barati <[email protected]>
Print values in a nicer way in the jsc shell
Modified: trunk/Source/_javascript_Core/dfg/DFGStrengthReductionPhase.cpp (283299 => 283300)
--- trunk/Source/_javascript_Core/dfg/DFGStrengthReductionPhase.cpp 2021-09-30 05:17:38 UTC (rev 283299)
+++ trunk/Source/_javascript_Core/dfg/DFGStrengthReductionPhase.cpp 2021-09-30 05:27:45 UTC (rev 283300)
@@ -1,5 +1,5 @@
/*
- * Copyright (C) 2013-2019 Apple Inc. All rights reserved.
+ * Copyright (C) 2013-2021 Apple Inc. All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
@@ -197,8 +197,15 @@
&& m_node->child2()->isInt32Constant()
&& m_node->child1()->op() == ArithMod
&& m_node->child1()->binaryUseKind() == Int32Use
- && m_node->child1()->child2()->isInt32Constant()
- && std::abs(m_node->child1()->child2()->asInt32()) <= std::abs(m_node->child2()->asInt32())) {
+ && m_node->child1()->child2()->isInt32Constant()) {
+
+ int32_t const1 = m_node->child1()->child2()->asInt32();
+ int32_t const2 = m_node->child2()->asInt32();
+
+ if (const1 == INT_MIN || const2 == INT_MIN)
+ break; // std::abs(INT_MIN) is undefined.
+
+ if (std::abs(const1) <= std::abs(const2))
convertToIdentityOverChild1();
}
break;
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
