Title: [284809] branches/safari-612-branch/Source/_javascript_Core
- Revision
- 284809
- Author
- [email protected]
- Date
- 2021-10-25 12:10:03 -0700 (Mon, 25 Oct 2021)
Log Message
Cherry-pick r284585. rdar://problem/84338648
[JSC] ArithAbs should care about INT32_MIN
https://bugs.webkit.org/show_bug.cgi?id=232051
rdar://84338648
Reviewed by Michael Saboff.
ArithAbs (without overflow check) can return negative value if the input is INT32_MIN with Int32Use.
* dfg/DFGIntegerRangeOptimizationPhase.cpp:
git-svn-id: https://svn.webkit.org/repository/webkit/trunk@284585 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Modified Paths
Diff
Modified: branches/safari-612-branch/Source/_javascript_Core/ChangeLog (284808 => 284809)
--- branches/safari-612-branch/Source/_javascript_Core/ChangeLog 2021-10-25 19:10:00 UTC (rev 284808)
+++ branches/safari-612-branch/Source/_javascript_Core/ChangeLog 2021-10-25 19:10:03 UTC (rev 284809)
@@ -1,5 +1,33 @@
2021-10-25 Null <[email protected]>
+ Cherry-pick r284585. rdar://problem/84338648
+
+ [JSC] ArithAbs should care about INT32_MIN
+ https://bugs.webkit.org/show_bug.cgi?id=232051
+ rdar://84338648
+
+ Reviewed by Michael Saboff.
+
+ ArithAbs (without overflow check) can return negative value if the input is INT32_MIN with Int32Use.
+
+ * dfg/DFGIntegerRangeOptimizationPhase.cpp:
+
+ git-svn-id: https://svn.webkit.org/repository/webkit/trunk@284585 268f45cc-cd09-0410-ab3c-d52691b4dbfc
+
+ 2021-10-20 Yusuke Suzuki <[email protected]>
+
+ [JSC] ArithAbs should care about INT32_MIN
+ https://bugs.webkit.org/show_bug.cgi?id=232051
+ rdar://84338648
+
+ Reviewed by Michael Saboff.
+
+ ArithAbs (without overflow check) can return negative value if the input is INT32_MIN with Int32Use.
+
+ * dfg/DFGIntegerRangeOptimizationPhase.cpp:
+
+2021-10-25 Null <[email protected]>
+
Cherry-pick r284576. rdar://problem/84338462
We should watch isHavingABadTime if we read from the structureCache
Modified: branches/safari-612-branch/Source/_javascript_Core/dfg/DFGIntegerRangeOptimizationPhase.cpp (284808 => 284809)
--- branches/safari-612-branch/Source/_javascript_Core/dfg/DFGIntegerRangeOptimizationPhase.cpp 2021-10-25 19:10:00 UTC (rev 284808)
+++ branches/safari-612-branch/Source/_javascript_Core/dfg/DFGIntegerRangeOptimizationPhase.cpp 2021-10-25 19:10:03 UTC (rev 284809)
@@ -1400,7 +1400,25 @@
case ArithAbs: {
if (node->child1().useKind() != Int32Use)
break;
- setRelationship(Relationship(node, m_zero, Relationship::GreaterThan, -1));
+
+ // If ArithAbs cares about overflow, then INT32_MIN input will cause OSR exit.
+ // Thus we can safely say `x >= 0`.
+ if (shouldCheckOverflow(node->arithMode())) {
+ setRelationship(Relationship(node, m_zero, Relationship::GreaterThan, -1));
+ break;
+ }
+
+ // If ArithAbs does not care about overflow, it can return INT32_MIN if the input is INT32_MIN.
+ // If minValue is not INT32_MIN, we can still say it is `x >= 0`.
+ int minValue = std::numeric_limits<int>::min();
+ auto iter = m_relationships.find(node->child1().node());
+ if (iter != m_relationships.end()) {
+ for (Relationship relationship : iter->value)
+ minValue = std::max(minValue, relationship.minValueOfLeft());
+ }
+
+ if (minValue > std::numeric_limits<int>::min())
+ setRelationship(Relationship(node, m_zero, Relationship::GreaterThan, -1));
break;
}
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
