Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 0f41131e73da067be424a306693bc68c309c5a84
https://github.com/WebKit/WebKit/commit/0f41131e73da067be424a306693bc68c309c5a84
Author: Shu-yu Guo <[email protected]>
Date: 2026-02-16 (Mon, 16 Feb 2026)
Changed paths:
M JSTests/stress/int52-arith-mod.js
M Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h
Log Message:
-----------
[JSC] Sanitize -0 in DFG arith mod constant folding
https://bugs.webkit.org/show_bug.cgi?id=308016
rdar://170174915
Reviewed by Yusuke Suzuki.
Fix a case where we miss sanitizing -0 to +0 when the Arith::Mode of the node
is !shouldCheckNegativeZero().
Test: JSTests/stress/int52-arith-mod.js
* JSTests/stress/int52-arith-mod.js:
(negZeroWithInt32Overflow):
* Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h:
(JSC::DFG::AbstractInterpreter<AbstractStateType>::handleConstantDivOp):
Canonical link: https://commits.webkit.org/307681@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
