[webkit-changes] [WebKit/WebKit] bf2f05: [JSC] DFG might force a local to be double even if...

[Commit Queue]

  Branch: refs/heads/main
  Home:   https://github.com/WebKit/WebKit
  Commit: bf2f05e02c8a12f6b716ea8bc21e62852d8493ac
      https://github.com/WebKit/WebKit/commit/bf2f05e02c8a12f6b716ea8bc21e62852d8493ac
  Author: Alexey Shvayka <ashvayka at apple.com>
  Date:   2023-12-15 (Fri, 15 Dec 2023)

  Changed paths:
    A JSTests/stress/double-inlined-call-argument.js
    A JSTests/stress/regress-116397731.js
    M Source/JavaScriptCore/dfg/DFGVariableAccessData.cpp

  Log Message:
  -----------
  [JSC] DFG might force a local to be double even if we store non-numeric values into it
https://bugs.webkit.org/show_bug.cgi?id=263090
<rdar://116397731>

Reviewed by Keith Miller.

This changes fixes tallyVotesForShouldUseDoubleFormat() to set NotUsingDoubleFormat if the variable
is no longer predicted to hold only doubles.

* JSTests/stress/double-inlined-call-argument.js: Added.
* JSTests/stress/regress-116397731.js: Added.
* Source/JavaScriptCore/dfg/DFGVariableAccessData.cpp:
(JSC::DFG::VariableAccessData::tallyVotesForShouldUseDoubleFormat):

Originally-landed-as: 267815.352 at safari-7617-branch (11987a2c00bf). rdar://119597752
Canonical link: https://commits.webkit.org/272168@main