Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 3785004bc41b057d1fd39228f8b91ad81a6926d8
https://github.com/WebKit/WebKit/commit/3785004bc41b057d1fd39228f8b91ad81a6926d8
Author: Yusuke Suzuki <[email protected]>
Date: 2026-10-13 (Tue, 13 Oct 2026)
Changed paths:
A JSTests/stress/backwards-propagation-shift-bound-uses-masked-count.js
M Source/JavaScriptCore/dfg/DFGBackwardsPropagationPhase.cpp
Log Message:
-----------
[JSC] DFG backwards propagation should bound right shifts by their masked
shift count
https://bugs.webkit.org/show_bug.cgi?id=327373
rdar://189886500
Reviewed by Dan Hecht.
Fix DFGBackwardsPropagationPhase's shift related bugs.
1. Incorrectly checking constant status for `node` instead of
`shiftAmount` (so this code was dead code). Fixing it.
2. Fix shift amount check. JS clears shiftAmount with 31, so we should
apply it. Also the checked number should be `31 - power`.
Test: JSTests/stress/backwards-propagation-shift-bound-uses-masked-count.js
* JSTests/stress/backwards-propagation-shift-bound-uses-masked-count.js: Added.
(shouldBe):
(shiftBy33ThenMultiply):
(unsignedShiftBy32ThenMultiply):
(shiftBy10ThenMultiply):
(unsignedShiftBy10ThenMultiply):
* Source/JavaScriptCore/dfg/DFGBackwardsPropagationPhase.cpp:
(JSC::DFG::BackwardsPropagationPhase::isWithinPowerOfTwo):
Canonical link: https://commits.webkit.org/323595@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
