Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 9f3eea6f466175106d4e9073964cd4bb000895dc
https://github.com/WebKit/WebKit/commit/9f3eea6f466175106d4e9073964cd4bb000895dc
Author: Sosuke Suzuki <[email protected]>
Date: 2026-08-26 (Wed, 26 Aug 2026)
Changed paths:
A JSTests/stress/arith-checked-int-must-generate-dce.js
M Source/JavaScriptCore/dfg/DFGFixupPhase.cpp
Log Message:
-----------
[JSC] `DFGFixupPhase` should not clear `NodeMustGenerate` on checked arith
nodes
https://bugs.webkit.org/show_bug.cgi?id=322371
Reviewed by Yusuke Suzuki.
DFGFixupPhase cleared NodeMustGenerate on these nodes even when it had just
selected Arith::CheckOverflow or Arith::CheckOverflowAndNegativeZero. The
abstract interpreter then proves the result is Int32 (and not -0) on the
strength of that check, folds users such as `(y | 0) === y` to constants, and
MovHintRemoval + DCE delete the node together with the check that justified the
proof. This is the same shape as bug 315213 for Inc / Dec.
Clear NodeMustGenerate only on the Arith::Unchecked branches, which DFGMayExit
already treats as non-exiting, so the DCE introduced for unused unchecked
div / mod is preserved. Int52 ArithMul / ArithNegate have no unchecked mode and
keep NodeMustGenerate unconditionally.
Test: JSTests/stress/arith-checked-int-must-generate-dce.js
* JSTests/stress/arith-checked-int-must-generate-dce.js: Added.
(shouldBe):
(mulOverflow):
(mulNegativeZero):
(divNonInteger):
(modNegativeZero):
(negateOverflow):
(negateNegativeZero):
(absOverflow):
* Source/JavaScriptCore/dfg/DFGFixupPhase.cpp:
(JSC::DFG::FixupPhase::fixupArithDivInt32):
(JSC::DFG::FixupPhase::fixupArithDiv):
(JSC::DFG::FixupPhase::fixupArithMul):
(JSC::DFG::FixupPhase::fixupNode):
Canonical link: https://commits.webkit.org/319935@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
