[webkit-changes] [WebKit/WebKit] 73b582: [JSC] Relax Int32 arith condition while having NaN

[Yusuke Suzuki]

  Branch: refs/heads/main
  Home:   https://github.com/WebKit/WebKit
  Commit: 73b58272b44dbb9c6edfec221839210a04d7f92c
      https://github.com/WebKit/WebKit/commit/73b58272b44dbb9c6edfec221839210a04d7f92c
  Author: Yusuke Suzuki <ysuzuki at apple.com>
  Date:   2023-06-29 (Thu, 29 Jun 2023)

  Changed paths:
    M Source/JavaScriptCore/dfg/DFGGraph.h
    M Source/JavaScriptCore/dfg/DFGNode.h

  Log Message:
  -----------
  [JSC] Relax Int32 arith condition while having NaN
https://bugs.webkit.org/show_bug.cgi?id=258691
rdar://111529018

Reviewed by Mark Lam.

Sometimes NaN is used as a default value (e.g. parseInt's failure case), and it can pollute the graph
with Doubles. But when considering about Int32 speculation, if ArithProfile said "we didn't see double result",
then it is very unlikely that this NaN is coming to this site since arithmetic ops with NaN is always NaN.

* Source/JavaScriptCore/dfg/DFGGraph.h:
* Source/JavaScriptCore/dfg/DFGNode.h:
(JSC::DFG::Node::shouldSpeculateInt32OrBooleanExpectingDefined):

Canonical link: https://commits.webkit.org/265637@main