Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 7711916200dda7e418b321e34493f66a7af2a0b0
https://github.com/WebKit/WebKit/commit/7711916200dda7e418b321e34493f66a7af2a0b0
Author: Kai Tamkun <[email protected]>
Date: 2026-08-22 (Sat, 22 Aug 2026)
Changed paths:
A JSTests/stress/inc-dec-int32-overflow-dce.js
M Source/JavaScriptCore/dfg/DFGFixupPhase.cpp
Log Message:
-----------
[JSC] NodeMustGenerate incorrectly cleared on CheckOverflow ArithAdd/ArithSub
in DFGFixupPhase Inc/Dec handler
https://bugs.webkit.org/show_bug.cgi?id=315213
rdar://176984293
Reviewed by Yijia Huang.
This patch prevents overflow checks for increment/decrement in DFG from being
mistakenly DCE'd.
Test: JSTests/stress/inc-dec-int32-overflow-dce.js
* JSTests/stress/inc-dec-int32-overflow-dce.js: Added.
(shouldBe):
(inc):
(dec):
* Source/JavaScriptCore/dfg/DFGFixupPhase.cpp:
(JSC::DFG::FixupPhase::fixupNode):
Originally-landed-as: [email protected] (7951c397a1ba).
rdar://185368748
Canonical link: https://commits.webkit.org/319649@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
