Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 13714a5887a573158451081539e20d5521bc3357
https://github.com/WebKit/WebKit/commit/13714a5887a573158451081539e20d5521bc3357
Author: Sosuke Suzuki <[email protected]>
Date: 2026-10-11 (Sun, 11 Oct 2026)
Changed paths:
A JSTests/stress/backwards-propagation-add-with-non-integer-constant.js
M Source/JavaScriptCore/dfg/DFGBackwardsPropagationPhase.cpp
Log Message:
-----------
[JSC] DFG backwards propagation should not treat non-integer constants as
within power of two
https://bugs.webkit.org/show_bug.cgi?id=326632
Reviewed by Yusuke Suzuki.
When one operand of an addition is a constant whose absolute value is less
than 2^32, BackwardsPropagationPhase does not propagate NodeBytecodeUsesAsNumber
to the other operand, so the other operand can become an unchecked int32
addition. This relies on ToInt32(v + k * 2^32) == ToInt32(v), which only holds
when v is an integer. isWithinPowerOfTwoForConstant accepted non-integer
constants too, so DFG and FTL returned a result that is off by one when the
inner addition overflows:
function round(x, y) { return (x + y + 0.5) | 0; }
round(2000000000, 2000000000); // -294967295, should be -294967296
This patch makes isWithinPowerOfTwoForConstant accept integers only.
Test: JSTests/stress/backwards-propagation-add-with-non-integer-constant.js
* JSTests/stress/backwards-propagation-add-with-non-integer-constant.js: Added.
(shouldBe):
(addThenAddHalf):
(addThenAddNegativeHalf):
(subThenAddHalf):
(halfOnLeft):
(unsignedRightShift):
(bitAnd):
(threeOperands):
(negate):
(mulThenAddHalf):
(largeNegativeConstant):
(largePositiveConstant):
* Source/JavaScriptCore/dfg/DFGBackwardsPropagationPhase.cpp:
(JSC::DFG::BackwardsPropagationPhase::isWithinPowerOfTwoForConstant):
Canonical link: https://commits.webkit.org/323383@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
