[webkit-changes] [WebKit/WebKit] 79a659: [JSC] Fix addImmediateShouldSpeculateInt32 for cas...

[Commit Queue]

  Branch: refs/heads/main
  Home:   https://github.com/WebKit/WebKit
  Commit: 79a659d55c63c76abcb5c54b02dffe7631b68e6b
      https://github.com/WebKit/WebKit/commit/79a659d55c63c76abcb5c54b02dffe7631b68e6b
  Author: Yijia Huang <yijia_huang at apple.com>
  Date:   2023-11-09 (Thu, 09 Nov 2023)

  Changed paths:
    A JSTests/stress/dfg-add-int32-var-with-const-double.js
    M Source/JavaScriptCore/dfg/DFGGraph.h

  Log Message:
  -----------
  [JSC] Fix addImmediateShouldSpeculateInt32 for case int32 + constant double
https://bugs.webkit.org/show_bug.cgi?id=264278
rdar://117563215

Reviewed by Yusuke Suzuki.

Current fixup phase would convert the DFG node

    ValueAdd(Int32, DoubleConstant)

to

    ArithAdd(Int32, JSConstant(DoubleConstant))

if the node is OK to be truncated to Int32. This is
wrong. For example, let Int32 be -1 and DoubleConstant
be 0.1 where

    ToInt32(-1 + 0.1) == 0

but

    -1 + ToInt32(0.1) == -1

. So, we should not speculate that node with Int32 in this case.

* JSTests/stress/dfg-int32-add-non-int-double.js: Added.
(foo):
* Source/JavaScriptCore/dfg/DFGGraph.h:

Canonical link: https://commits.webkit.org/270481@main