[webkit-changes] [WebKit/WebKit] 0e08d4: [JSC] Fix FTL ToIntegerOrInfinity

[Yusuke Suzuki]

  Branch: refs/heads/main
  Home:   https://github.com/WebKit/WebKit
  Commit: 0e08d48004c0da63b53f54ef8752ccdd97b0ca92
      
https://github.com/WebKit/WebKit/commit/0e08d48004c0da63b53f54ef8752ccdd97b0ca92
  Author: Yusuke Suzuki <ysuz...@apple.com>
  Date:   2026-10-13 (Tue, 13 Oct 2026)

  Changed paths:
    A 
JSTests/stress/atomics-store-returns-positive-zero-for-negative-fraction.js
    M Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp

  Log Message:
  -----------
  [JSC] Fix FTL ToIntegerOrInfinity
https://bugs.webkit.org/show_bug.cgi?id=327357
rdar://189876905

Reviewed by Dan Hecht.

For double input (-1, 0), FTL ToIntegerOrInfinity returns -0 since

1. They are not 0
2. m_out.doubleTrunc(doubleValue) generates -0

Fix it by comparing the truncated result with double-zero.

Test: 
JSTests/stress/atomics-store-returns-positive-zero-for-negative-fraction.js

* JSTests/stress/atomics-store-returns-positive-zero-for-negative-fraction.js: 
Added.
(shouldBe):
(storeU8):
(storeI32):
* Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp:
(JSC::FTL::DFG::LowerDFGToB3::compileCompareStrictEq):

Canonical link: https://commits.webkit.org/323624@main



To unsubscribe from these emails, change your notification settings at 
https://github.com/WebKit/WebKit/settings/notifications