Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 1c537b0aea640597681150878d85e1bc0bc9ab09
https://github.com/WebKit/WebKit/commit/1c537b0aea640597681150878d85e1bc0bc9ab09
Author: Yusuke Suzuki <[email protected]>
Date: 2026-02-28 (Sat, 28 Feb 2026)
Changed paths:
A JSTests/wasm/stress/b3-reduceStrength-trunc-sshr-add-unaligned.js
M Source/JavaScriptCore/b3/B3ReduceStrength.cpp
M Source/JavaScriptCore/b3/testb3.h
M Source/JavaScriptCore/b3/testb3_1.cpp
M Source/JavaScriptCore/b3/testb3_7.cpp
Log Message:
-----------
[JSC] Unsound optimization in ReduceStrength regarding Int52-to-Int32
conversion pattern
https://bugs.webkit.org/show_bug.cgi?id=308722
rdar://171147977
Reviewed by Yijia Huang and Keith Miller.
The optimization is assuming that constant value's lower 12 bits are
zero, otherwise, addition can carry one bit. This patch ensures that
constant is not having lower 12 bits.
Tests: JSTests/wasm/stress/b3-reduceStrength-trunc-sshr-add-unaligned.js
Source/JavaScriptCore/b3/testb3_1.cpp
Source/JavaScriptCore/b3/testb3_7.cpp
* JSTests/wasm/stress/b3-reduceStrength-trunc-sshr-add-unaligned.js: Added.
(expected):
* Source/JavaScriptCore/b3/B3ReduceStrength.cpp:
* Source/JavaScriptCore/b3/testb3.h:
* Source/JavaScriptCore/b3/testb3_1.cpp:
(run):
* Source/JavaScriptCore/b3/testb3_7.cpp:
(testTruncSShrAddUnalignedConstant):
Canonical link: https://commits.webkit.org/308417@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
