Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 79a659d55c63c76abcb5c54b02dffe7631b68e6b
https://github.com/WebKit/WebKit/commit/79a659d55c63c76abcb5c54b02dffe7631b68e6b
Author: Yijia Huang <[email protected]>
Date: 2023-11-09 (Thu, 09 Nov 2023)
Changed paths:
A JSTests/stress/dfg-add-int32-var-with-const-double.js
M Source/JavaScriptCore/dfg/DFGGraph.h
Log Message:
-----------
[JSC] Fix addImmediateShouldSpeculateInt32 for case int32 + constant double
https://bugs.webkit.org/show_bug.cgi?id=264278
rdar://117563215
Reviewed by Yusuke Suzuki.
Current fixup phase would convert the DFG node
ValueAdd(Int32, DoubleConstant)
to
ArithAdd(Int32, JSConstant(DoubleConstant))
if the node is OK to be truncated to Int32. This is
wrong. For example, let Int32 be -1 and DoubleConstant
be 0.1 where
ToInt32(-1 + 0.1) == 0
but
-1 + ToInt32(0.1) == -1
. So, we should not speculate that node with Int32 in this case.
* JSTests/stress/dfg-int32-add-non-int-double.js: Added.
(foo):
* Source/JavaScriptCore/dfg/DFGGraph.h:
Canonical link: https://commits.webkit.org/270481@main
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
