[Webkit-unassigned] [Bug 257949] New: JSC computes incorrectly in DFG

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=257949

            Bug ID: 257949
           Summary: JSC computes incorrectly in DFG
           Product: WebKit
           Version: WebKit Nightly Build
          Hardware: PC
                OS: Linux
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: JavaScriptCore
          Assignee: webkit-unassigned at lists.webkit.org
          Reporter: ChristineWillice at gmail.com

``````````````test.js`````````````````
function opt(v)
{
  return ((-1 >>> v) + -0.2) | 0
}
for (let i = 0; i < 100; i++) {
  opt(0)
}
print(opt(32))
``````````````````````````````````````

This bug is in latest version JSC.

Run args: ./jsc test.js --useConcurrentJIT=0 --jitPolicyScale=0

The corrent result is -2, but JSC prints -1.

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-unassigned/attachments/20230612/1194d1a0/attachment.htm>