Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 787be9470e19a8f703bc17d0e73ba7e7bb24d237
https://github.com/WebKit/WebKit/commit/787be9470e19a8f703bc17d0e73ba7e7bb24d237
Author: Anand Srinivasan <[email protected]>
Date: 2026-04-23 (Thu, 23 Apr 2026)
Changed paths:
A JSTests/wasm/stress/int-div-rem-constant-folding.js
M Source/JavaScriptCore/wasm/WasmBBQJIT.cpp
M Source/JavaScriptCore/wasm/WasmBBQJIT.h
Log Message:
-----------
Fix BBQ constant folding for integer div/rem with INT_MIN and -1
https://bugs.webkit.org/show_bug.cgi?id=312682
rdar://175122462
Reviewed by Dan Hecht.
BBQ currently emits an integer overflow trap for integer div/rem
operations where the operands are INT_MIN and -1. This is only valid for
signed division since unsigned division and modulo cannot overflow. This
patch changes checkConstantDivision to no longer emit a trap in the
cases of unsigned div and all rem instructions.
Test: JSTests/wasm/stress/int-div-rem-constant-folding.js
* JSTests/wasm/stress/int-div-rem-constant-folding.js: Added.
(async test):
* Source/JavaScriptCore/wasm/WasmBBQJIT.cpp:
(JSC::Wasm::BBQJITImpl::BBQJIT::checkConstantDivision):
(JSC::Wasm::BBQJITImpl::BBQJIT::addI32DivS):
(JSC::Wasm::BBQJITImpl::BBQJIT::addI64DivS):
(JSC::Wasm::BBQJITImpl::BBQJIT::addI32DivU):
(JSC::Wasm::BBQJITImpl::BBQJIT::addI64DivU):
(JSC::Wasm::BBQJITImpl::BBQJIT::addI32RemU):
(JSC::Wasm::BBQJITImpl::BBQJIT::addI64RemU):
* Source/JavaScriptCore/wasm/WasmBBQJIT.h:
Canonical link: https://commits.webkit.org/311898@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
