Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: ea3cfb65e1ab1b5093178c62b5293ef185f3acd2
https://github.com/WebKit/WebKit/commit/ea3cfb65e1ab1b5093178c62b5293ef185f3acd2
Author: Daniel Liu <[email protected]>
Date: 2025-04-23 (Wed, 23 Apr 2025)
Changed paths:
A JSTests/stress/fiat-negative-zero-from-variable.js
A JSTests/stress/fiat-negative-zero.js
M Source/JavaScriptCore/dfg/DFGAbstractValue.cpp
M Source/JavaScriptCore/dfg/DFGFixupPhase.cpp
M Source/JavaScriptCore/dfg/DFGMayExit.cpp
M Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp
M Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp
Log Message:
-----------
Fix DFG Int52 handling around negative zero
https://bugs.webkit.org/show_bug.cgi?id=290851
rdar://147481105
Reviewed by Yusuke Suzuki.
292253@main introduced some changes to Int52's handling of negative zero.
However,
we have some cases where the AbstractInterpreter isn't tracking the possibility
of
a negative zero correctly, and thus may wrongly mark states as inconsistent
during
DFG/FTL compilation. This patch adds extra handling to cover cases when a
negative
zero may appear.
* JSTests/stress/fiat-negative-zero-from-variable.js: Added.
(func_1_):
(func_2_):
* JSTests/stress/fiat-negative-zero.js: Added.
* Source/JavaScriptCore/dfg/DFGAbstractValue.cpp:
(JSC::DFG::AbstractValue::fixTypeForRepresentation):
* Source/JavaScriptCore/dfg/DFGFixupPhase.cpp:
(JSC::DFG::FixupPhase::fixupChecksInBlock):
* Source/JavaScriptCore/dfg/DFGMayExit.cpp:
* Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp:
(JSC::DFG::SpeculativeJIT::compile):
(JSC::DFG::SpeculativeJIT::convertAnyInt):
* Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp:
(JSC::FTL::DFG::LowerDFGToB3::compileInt52Rep):
(JSC::FTL::DFG::LowerDFGToB3::compileCompareStrictEq):
Canonical link: https://commits.webkit.org/294024@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
