Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: f325c4f3adb7d4c41b097c660fdbe1eeecfcaf59
https://github.com/WebKit/WebKit/commit/f325c4f3adb7d4c41b097c660fdbe1eeecfcaf59
Author: Sergey Rubanov <[email protected]>
Date: 2026-09-30 (Wed, 30 Sep 2026)
Changed paths:
A JSTests/stress/arith-rounding-int32-overflow-dce.js
M Source/JavaScriptCore/dfg/DFGFixupPhase.cpp
Log Message:
-----------
[JSC] Keep NodeMustGenerate on checked DFG rounding
https://bugs.webkit.org/show_bug.cgi?id=325499
Reviewed by Yusuke Suzuki.
DFGFixupPhase cleared NodeMustGenerate for ArithFloor, ArithCeil,
ArithRound, and ArithTrunc even when the rounding mode is Int32 or
Int32WithNegativeZeroCheck. Those modes exit on overflow or negative
zero. After the result was folded away, DCE removed the operation and
the function returned the in-range answer.
Clear the flag only for the Double rounding mode, which does not exit.
* JSTests/stress/arith-rounding-int32-overflow-dce.js: Added.
* Source/JavaScriptCore/dfg/DFGFixupPhase.cpp:
(JSC::DFG::FixupPhase::fixupNode):
Canonical link: https://commits.webkit.org/322285@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
