Changeset 276524 in webkit

Timestamp:

Apr 23, 2021, 3:14:11 PM (5 years ago)

Author:

mark.lam@apple.com

Message:

Fix B3 strength reduction for shl.
​https://bugs.webkit.org/show_bug.cgi?id=224913
rdar://76978874

Reviewed by Michael Saboff.

If the operation can potentially either underflow or overflow, then the result
can be any value.

• b3/B3ReduceStrength.cpp:

Location:

trunk/Source/JavaScriptCore

Files:

• ChangeLog (modified) (1 diff)
• b3/B3ReduceStrength.cpp (modified) (1 diff)

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2021-04-23  Mark Lam  <mark.lam@apple.com>
+
+        Fix B3 strength reduction for shl.
+        https://bugs.webkit.org/show_bug.cgi?id=224913
+        rdar://76978874
+
+        Reviewed by Michael Saboff.
+
+        If the operation can potentially either underflow or overflow, then the result
+        can be any value.
+
+        * b3/B3ReduceStrength.cpp:
+
 2021-04-23  Fujii Hironori  <Hironori.Fujii@sony.com>
 

trunk/Source/JavaScriptCore/b3/B3ReduceStrength.cpp

@@ -241 +241 @@
         T newMax = static_cast<T>(m_max) << static_cast<T>(shiftAmount);
 
-        if ((newMin >> shiftAmount) != static_cast<T>(m_min))
+        if (((newMin >> shiftAmount) != static_cast<T>(m_min))
+            || ((newMax >> shiftAmount) != static_cast<T>(m_max))) {
             newMin = std::numeric_limits<T>::min();
-        if ((newMax >> shiftAmount) != static_cast<T>(m_max))
             newMax = std::numeric_limits<T>::max();
+        }
 
         return IntRange(newMin, newMax);