[Webkit-unassigned] [Bug 244182] New: JSC DFGFixup computes a wrong addSpeculation mode in DFGGraph::addImmediateShouldSpeculteInt32 when immediateValue is Double

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=244182

            Bug ID: 244182
           Summary: JSC DFGFixup computes a wrong addSpeculation mode in
                    DFGGraph::addImmediateShouldSpeculteInt32 when
                    immediateValue is Double
           Product: WebKit
           Version: WebKit Local Build
          Hardware: PC
                OS: Linux
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: JavaScriptCore
          Assignee: webkit-unassigned at lists.webkit.org
          Reporter: entryhii at gmail.com

var values = [0, 1, 2, 3, 4, -5];
function foo( arg) {
  let actual = 0.2 + ( arg | arg ) | 0
  print(actual)
} 
for (var i = 0; i < values.length; ++i) {
  foo( values[i]);
} 


With the above script as input to JSC, run JSC with the following parameters:
./jsc test.js --useConcurrentJIT=0 --jitPolicyScale=0

When the parameter passed to foo is -5, the correct result returned by foo should be -4, but JSC incorrectly returns -5.

We found that the problem lies in DFGFixupPhase. When handling ValueAdd node, it will first perform attemptToMakeIntegerAdd. In this step, 0.2 is first converted to 0, and 0 and -5 are added to get the result -5.
The correct case should be that 0.2 is added with -5 to get -4.8, and -4.8 is converted to an integer -4.

In the fixup phase, whether 0.2 is converted to 0 depends on the result of DFGGraph::addImmediateShouldSpeculateInt32, which incorrectly returns SpeculateInt32AndTruncateConstants mode. When immediateValue is Double, it should return DontSpeculateInt32.

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-unassigned/attachments/20220822/e85200e2/attachment.htm>