Title: [244178] trunk/Source/_javascript_Core
- Revision
- 244178
- Author
- sbar...@apple.com
- Date
- 2019-04-10 18:31:51 -0700 (Wed, 10 Apr 2019)
Log Message
ArithSub over Int52 has shouldCheckOverflow as always true
https://bugs.webkit.org/show_bug.cgi?id=196796
Reviewed by Yusuke Suzuki.
AI was checking for ArithSub over Int52 if !shouldCheckOverflow. However,
shouldCheckOverflow is always true, so !shouldCheckOverflow is always
false. We shouldn't check something we assert against.
* dfg/DFGAbstractInterpreterInlines.h:
(JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
Modified Paths
Diff
Modified: trunk/Source/_javascript_Core/ChangeLog (244177 => 244178)
--- trunk/Source/_javascript_Core/ChangeLog 2019-04-11 01:22:19 UTC (rev 244177)
+++ trunk/Source/_javascript_Core/ChangeLog 2019-04-11 01:31:51 UTC (rev 244178)
@@ -1,3 +1,17 @@
+2019-04-10 Saam Barati <sbar...@apple.com>
+
+ ArithSub over Int52 has shouldCheckOverflow as always true
+ https://bugs.webkit.org/show_bug.cgi?id=196796
+
+ Reviewed by Yusuke Suzuki.
+
+ AI was checking for ArithSub over Int52 if !shouldCheckOverflow. However,
+ shouldCheckOverflow is always true, so !shouldCheckOverflow is always
+ false. We shouldn't check something we assert against.
+
+ * dfg/DFGAbstractInterpreterInlines.h:
+ (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+
2019-04-10 Basuke Suzuki <basuke.suz...@sony.com>
[PlayStation] Specify byte order clearly on Remote Inspector Protocol
Modified: trunk/Source/_javascript_Core/dfg/DFGAbstractInterpreterInlines.h (244177 => 244178)
--- trunk/Source/_javascript_Core/dfg/DFGAbstractInterpreterInlines.h 2019-04-11 01:22:19 UTC (rev 244177)
+++ trunk/Source/_javascript_Core/dfg/DFGAbstractInterpreterInlines.h 2019-04-11 01:31:51 UTC (rev 244178)
@@ -763,7 +763,7 @@
case Int52RepUse:
if (left && right && left.isAnyInt() && right.isAnyInt()) {
JSValue result = jsNumber(left.asAnyInt() - right.asAnyInt());
- if (result.isAnyInt() || !shouldCheckOverflow(node->arithMode())) {
+ if (result.isAnyInt()) {
setConstant(node, result);
break;
}
_______________________________________________
webkit-changes mailing list
webkit-changes@lists.webkit.org
https://lists.webkit.org/mailman/listinfo/webkit-changes
