Changeset 284585 in webkit

Timestamp:

Oct 20, 2021, 5:00:20 PM (5 years ago)

Author:

ysuzuki@apple.com

Message:

[JSC] ArithAbs should care about INT32_MIN
​https://bugs.webkit.org/show_bug.cgi?id=232051
rdar://84338648

Reviewed by Michael Saboff.

ArithAbs (without overflow check) can return negative value if the input is INT32_MIN with Int32Use.

• dfg/DFGIntegerRangeOptimizationPhase.cpp:

Location:

trunk/Source/JavaScriptCore

Files:

• ChangeLog (modified) (1 diff)
• dfg/DFGIntegerRangeOptimizationPhase.cpp (modified) (1 diff)

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2021-10-20  Yusuke Suzuki  <ysuzuki@apple.com>
+
+        [JSC] ArithAbs should care about INT32_MIN
+        https://bugs.webkit.org/show_bug.cgi?id=232051
+        rdar://84338648
+
+        Reviewed by Michael Saboff.
+
+        ArithAbs (without overflow check) can return negative value if the input is INT32_MIN with Int32Use.
+
+        * dfg/DFGIntegerRangeOptimizationPhase.cpp:
+
 2021-10-20  Justin Michaud  <justin_michaud@apple.com>
 

trunk/Source/JavaScriptCore/dfg/DFGIntegerRangeOptimizationPhase.cpp

@@ -1401 +1401 @@
             if (node->child1().useKind() != Int32Use)
                 break;
-            setRelationship(Relationship(node, m_zero, Relationship::GreaterThan, -1));
+
+            // If ArithAbs cares about overflow, then INT32_MIN input will cause OSR exit.
+            // Thus we can safely say `x >= 0`.
+            if (shouldCheckOverflow(node->arithMode())) {
+                setRelationship(Relationship(node, m_zero, Relationship::GreaterThan, -1));
+                break;
+            }
+
+            // If ArithAbs does not care about overflow, it can return INT32_MIN if the input is INT32_MIN.
+            // If minValue is not INT32_MIN, we can still say it is `x >= 0`.
+            int minValue = std::numeric_limits<int>::min();
+            auto iter = m_relationships.find(node->child1().node());
+            if (iter != m_relationships.end()) {
+                for (Relationship relationship : iter->value)
+                    minValue = std::max(minValue, relationship.minValueOfLeft());
+            }
+
+            if (minValue > std::numeric_limits<int>::min())
+                setRelationship(Relationship(node, m_zero, Relationship::GreaterThan, -1));
             break;
         }