Title: [285678] branches/safari-612.3.6.1-branch
- Revision
- 285678
- Author
- [email protected]
- Date
- 2021-11-11 15:41:20 -0800 (Thu, 11 Nov 2021)
Log Message
Cherry-pick r283300. rdar://problem/85259264
DFG strength reduction on % operator should handle an INT_MIN divisor.
https://bugs.webkit.org/show_bug.cgi?id=230391
<rdar://problem/83229740>
Reviewed by Robin Morisset.
JSTests:
* stress/dfg-strength-reduction-on-mod-should-handle-INT_MIN.js: Added.
Source/_javascript_Core:
* dfg/DFGStrengthReductionPhase.cpp:
(JSC::DFG::StrengthReductionPhase::handleNode):
git-svn-id: https://svn.webkit.org/repository/webkit/trunk@283300 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Modified Paths
Added Paths
Diff
Modified: branches/safari-612.3.6.1-branch/JSTests/ChangeLog (285677 => 285678)
--- branches/safari-612.3.6.1-branch/JSTests/ChangeLog 2021-11-11 23:38:33 UTC (rev 285677)
+++ branches/safari-612.3.6.1-branch/JSTests/ChangeLog 2021-11-11 23:41:20 UTC (rev 285678)
@@ -1,3 +1,35 @@
+2021-11-11 Alan Coon <[email protected]>
+
+ Cherry-pick r283300. rdar://problem/85259264
+
+ DFG strength reduction on % operator should handle an INT_MIN divisor.
+ https://bugs.webkit.org/show_bug.cgi?id=230391
+ <rdar://problem/83229740>
+
+ Reviewed by Robin Morisset.
+
+ JSTests:
+
+ * stress/dfg-strength-reduction-on-mod-should-handle-INT_MIN.js: Added.
+
+ Source/_javascript_Core:
+
+ * dfg/DFGStrengthReductionPhase.cpp:
+ (JSC::DFG::StrengthReductionPhase::handleNode):
+
+
+ git-svn-id: https://svn.webkit.org/repository/webkit/trunk@283300 268f45cc-cd09-0410-ab3c-d52691b4dbfc
+
+ 2021-09-29 Mark Lam <[email protected]>
+
+ DFG strength reduction on % operator should handle an INT_MIN divisor.
+ https://bugs.webkit.org/show_bug.cgi?id=230391
+ <rdar://problem/83229740>
+
+ Reviewed by Robin Morisset.
+
+ * stress/dfg-strength-reduction-on-mod-should-handle-INT_MIN.js: Added.
+
2021-10-25 Yusuke Suzuki <[email protected]>
[JSC] Don't branch around register allocation in DFG enumerator get by val
Added: branches/safari-612.3.6.1-branch/JSTests/stress/dfg-strength-reduction-on-mod-should-handle-INT_MIN.js (0 => 285678)
--- branches/safari-612.3.6.1-branch/JSTests/stress/dfg-strength-reduction-on-mod-should-handle-INT_MIN.js (rev 0)
+++ branches/safari-612.3.6.1-branch/JSTests/stress/dfg-strength-reduction-on-mod-should-handle-INT_MIN.js 2021-11-11 23:41:20 UTC (rev 285678)
@@ -0,0 +1,11 @@
+function foo(num) {
+ num |= 0;
+ let x1 = num % -2147483648;
+ let x2 = x1 % 5;
+
+ if (x2 > 5)
+ throw "Error";
+}
+
+for (let i = 0; i < 10000; i++)
+ foo(i);
Modified: branches/safari-612.3.6.1-branch/Source/_javascript_Core/ChangeLog (285677 => 285678)
--- branches/safari-612.3.6.1-branch/Source/_javascript_Core/ChangeLog 2021-11-11 23:38:33 UTC (rev 285677)
+++ branches/safari-612.3.6.1-branch/Source/_javascript_Core/ChangeLog 2021-11-11 23:41:20 UTC (rev 285678)
@@ -1,3 +1,36 @@
+2021-11-11 Alan Coon <[email protected]>
+
+ Cherry-pick r283300. rdar://problem/85259264
+
+ DFG strength reduction on % operator should handle an INT_MIN divisor.
+ https://bugs.webkit.org/show_bug.cgi?id=230391
+ <rdar://problem/83229740>
+
+ Reviewed by Robin Morisset.
+
+ JSTests:
+
+ * stress/dfg-strength-reduction-on-mod-should-handle-INT_MIN.js: Added.
+
+ Source/_javascript_Core:
+
+ * dfg/DFGStrengthReductionPhase.cpp:
+ (JSC::DFG::StrengthReductionPhase::handleNode):
+
+
+ git-svn-id: https://svn.webkit.org/repository/webkit/trunk@283300 268f45cc-cd09-0410-ab3c-d52691b4dbfc
+
+ 2021-09-29 Mark Lam <[email protected]>
+
+ DFG strength reduction on % operator should handle an INT_MIN divisor.
+ https://bugs.webkit.org/show_bug.cgi?id=230391
+ <rdar://problem/83229740>
+
+ Reviewed by Robin Morisset.
+
+ * dfg/DFGStrengthReductionPhase.cpp:
+ (JSC::DFG::StrengthReductionPhase::handleNode):
+
2021-10-25 Yusuke Suzuki <[email protected]>
[JSC] Don't branch around register allocation in DFG enumerator get by val
Modified: branches/safari-612.3.6.1-branch/Source/_javascript_Core/dfg/DFGStrengthReductionPhase.cpp (285677 => 285678)
--- branches/safari-612.3.6.1-branch/Source/_javascript_Core/dfg/DFGStrengthReductionPhase.cpp 2021-11-11 23:38:33 UTC (rev 285677)
+++ branches/safari-612.3.6.1-branch/Source/_javascript_Core/dfg/DFGStrengthReductionPhase.cpp 2021-11-11 23:41:20 UTC (rev 285678)
@@ -1,5 +1,5 @@
/*
- * Copyright (C) 2013-2019 Apple Inc. All rights reserved.
+ * Copyright (C) 2013-2021 Apple Inc. All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
@@ -197,8 +197,15 @@
&& m_node->child2()->isInt32Constant()
&& m_node->child1()->op() == ArithMod
&& m_node->child1()->binaryUseKind() == Int32Use
- && m_node->child1()->child2()->isInt32Constant()
- && std::abs(m_node->child1()->child2()->asInt32()) <= std::abs(m_node->child2()->asInt32())) {
+ && m_node->child1()->child2()->isInt32Constant()) {
+
+ int32_t const1 = m_node->child1()->child2()->asInt32();
+ int32_t const2 = m_node->child2()->asInt32();
+
+ if (const1 == INT_MIN || const2 == INT_MIN)
+ break; // std::abs(INT_MIN) is undefined.
+
+ if (std::abs(const1) <= std::abs(const2))
convertToIdentityOverChild1();
}
break;
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
