Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 03a07e420089127130f5e8560d8b1888ccc4d6f4
https://github.com/WebKit/WebKit/commit/03a07e420089127130f5e8560d8b1888ccc4d6f4
Author: Yijia Huang <[email protected]>
Date: 2026-08-24 (Mon, 24 Aug 2026)
Changed paths:
A JSTests/stress/arith-abs-checked-input-range.js
M Source/JavaScriptCore/dfg/DFGIntegerRangeOptimizationPhase.cpp
Log Message:
-----------
[JSC] Pin upstream checks that DFG IRO range proofs rely on
rdar://179027979
https://bugs.webkit.org/show_bug.cgi?id=317611
Reviewed by Keith Miller.
DFGIntegerRangeOptimizationPhase (IRO) flips checked arithmetic to
Arith::Unchecked using range proofs derived from other checked ops in
the graph, but doesn't record that dependency. DFG DCE can then remove
those upstream checks (when their values are otherwise unread), making
IRO's earlier mutations unsound at runtime.
* rangeFor() now returns a RangeBound { value, proof } per axis,
where proof points to the relationship that produced the tight
bound (one per axis; ties resolved by first encountered).
* pinRangeBounds(...) is a variadic helper that sets NodeMustGenerate
on the producers behind each given bound's proof. Every site that
flips a checked op to Arith::Unchecked calls it with only the
bounds the proof actually consulted.
Test: JSTests/stress/arith-abs-checked-input-range.js
Originally-landed-as: [email protected] (f778c76c61d1).
rdar://185367869
Canonical link: https://commits.webkit.org/319726@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
