[webkit-reviews] review granted: [Bug 86330] DFG performs incorrect constant folding on double-to-uint32 conversion in Uint32Array PutByVal : [Attachment 141638] the patch

[bugzilla-daemon at webkit.org]

Darin Adler <darin at apple.com> has granted Filip Pizlo <fpizlo at apple.com>'s
request for review:
Bug 86330: DFG performs incorrect constant folding on double-to-uint32
conversion in Uint32Array PutByVal
https://bugs.webkit.org/show_bug.cgi?id=86330

Attachment 141638: the patch
https://bugs.webkit.org/attachment.cgi?id=141638&action=review

------- Additional Comments from Darin Adler <darin at apple.com>
View in context: https://bugs.webkit.org/attachment.cgi?id=141638&action=review


Can you add a regression test for this? Normally we don’t land fixes without
tests.

> Source/JavaScriptCore/ChangeLog:9
> +	   static_cast<int>(d) is wrong, since JS semantics require us to use
toInt32(d).

Sure would be nice to be more specific here about how close static_cast<int>
was or wasn’t, such as what values it would give a wrong value for.