[webkit-changes] [WebKit/WebKit] 024291: Negative exponent exception for BigInt not thrown ...

[Yijia Huang]

  Branch: refs/heads/main
  Home:   https://github.com/WebKit/WebKit
  Commit: 02429197cd90525288d0a2681640e4236c62d783
      https://github.com/WebKit/WebKit/commit/02429197cd90525288d0a2681640e4236c62d783
  Author: Yijia Huang <yijia_huang at apple.com>
  Date:   2024-07-10 (Wed, 10 Jul 2024)

  Changed paths:
    A JSTests/stress/dead-code-eliminiation-with-side-effect-node.js
    M Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h
    M Source/JavaScriptCore/dfg/DFGFixupPhase.cpp
    M Source/JavaScriptCore/runtime/JSBigInt.h
    M Source/JavaScriptCore/runtime/JSCJSValue.h
    M Source/JavaScriptCore/runtime/JSCJSValueInlines.h

  Log Message:
  -----------
  Negative exponent exception for BigInt not thrown in JIT compiler
https://bugs.webkit.org/show_bug.cgi?id=275939
rdar://131051084

Reviewed by Yusuke Suzuki.

Some DFG nodes can have side effects even if their results
are not used by others. In that case, we shouldn't clear the
NodeMustGenerate flags unless they are proven not having side effects.

* JSTests/stress/dead-code-eliminiation-with-side-effect-node.js: Added.
(assert):
(let.iteration.1e3.opt):
(i.assert.opt.opt):
(i.assert.opt):
* Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h:
(JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
* Source/JavaScriptCore/dfg/DFGFixupPhase.cpp:
(JSC::DFG::FixupPhase::fixupNode):
* Source/JavaScriptCore/runtime/JSBigInt.h:
* Source/JavaScriptCore/runtime/JSCJSValue.h:
* Source/JavaScriptCore/runtime/JSCJSValueInlines.h:
(JSC::JSValue::isZeroBigInt const):
(JSC::JSValue::isNegativeBigInt const):

Canonical link: https://commits.webkit.org/280841@main



To unsubscribe from these emails, change your notification settings at https://github.com/WebKit/WebKit/settings/notifications