Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 47b456d4d7f328a0d75f974f351ed4cef9dd53b5
https://github.com/WebKit/WebKit/commit/47b456d4d7f328a0d75f974f351ed4cef9dd53b5
Author: David Degazio <[email protected]>
Date: 2023-01-19 (Thu, 19 Jan 2023)
Changed paths:
A JSTests/stress/parse-int-negative-zero-key.js
A JSTests/stress/parse-int-negative-zero.js
M Source/JavaScriptCore/dfg/DFGConstantFoldingPhase.cpp
Log Message:
-----------
Require Int32 when constant-folding ParseInt in DFG
https://bugs.webkit.org/show_bug.cgi?id=250806
rdar://104071090
Reviewed by Saam Barati and Yusuke Suzuki.
Currently, we fold any ParseInt node with a Number radix equal to zero in DFG.
This
patch adds the requirement that the radix be an Int32 specifically, since
that's the
speculation check we add to all ParseInt nodes in the DFG fixup phase.
* JSTests/stress/parse-int-negative-zero-key.js: Added.
* JSTests/stress/parse-int-negative-zero.js: Added.
* Source/JavaScriptCore/dfg/DFGConstantFoldingPhase.cpp:
(JSC::DFG::ConstantFoldingPhase::foldConstants):
Canonical link: https://commits.webkit.org/259102@main
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
