[webkit-changes] [WebKit/WebKit] 47b456: Require Int32 when constant-folding ParseInt in DFG

[EWS]

  Branch: refs/heads/main
  Home:   https://github.com/WebKit/WebKit
  Commit: 47b456d4d7f328a0d75f974f351ed4cef9dd53b5
      https://github.com/WebKit/WebKit/commit/47b456d4d7f328a0d75f974f351ed4cef9dd53b5
  Author: David Degazio <d_degazio at apple.com>
  Date:   2023-01-19 (Thu, 19 Jan 2023)

  Changed paths:
    A JSTests/stress/parse-int-negative-zero-key.js
    A JSTests/stress/parse-int-negative-zero.js
    M Source/JavaScriptCore/dfg/DFGConstantFoldingPhase.cpp

  Log Message:
  -----------
  Require Int32 when constant-folding ParseInt in DFG
https://bugs.webkit.org/show_bug.cgi?id=250806
rdar://104071090

Reviewed by Saam Barati and Yusuke Suzuki.

Currently, we fold any ParseInt node with a Number radix equal to zero in DFG. This
patch adds the requirement that the radix be an Int32 specifically, since that's the
speculation check we add to all ParseInt nodes in the DFG fixup phase.

* JSTests/stress/parse-int-negative-zero-key.js: Added.
* JSTests/stress/parse-int-negative-zero.js: Added.
* Source/JavaScriptCore/dfg/DFGConstantFoldingPhase.cpp:
(JSC::DFG::ConstantFoldingPhase::foldConstants):

Canonical link: https://commits.webkit.org/259102@main