Changeset 284809 in webkit

Timestamp:

Oct 25, 2021, 12:10:03 PM (5 years ago)

Author:

Alan Coon

Message:

Cherry-pick r284585. rdar://problem/84338648

[JSC] ArithAbs should care about INT32_MIN
​https://bugs.webkit.org/show_bug.cgi?id=232051
rdar://84338648

Reviewed by Michael Saboff.

ArithAbs (without overflow check) can return negative value if the input is INT32_MIN with Int32Use.

• dfg/DFGIntegerRangeOptimizationPhase.cpp:

git-svn-id: ​https://svn.webkit.org/repository/webkit/trunk@284585 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Location:

branches/safari-612-branch/Source/JavaScriptCore

Files:

• ChangeLog (modified) (1 diff)
• dfg/DFGIntegerRangeOptimizationPhase.cpp (modified) (1 diff)

branches/safari-612-branch/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2021-10-25  Null  <null@apple.com>
+
+        Cherry-pick r284585. rdar://problem/84338648
+
+    [JSC] ArithAbs should care about INT32_MIN
+    https://bugs.webkit.org/show_bug.cgi?id=232051
+    rdar://84338648
+    
+    Reviewed by Michael Saboff.
+    
+    ArithAbs (without overflow check) can return negative value if the input is INT32_MIN with Int32Use.
+    
+    * dfg/DFGIntegerRangeOptimizationPhase.cpp:
+    
+    git-svn-id: https://svn.webkit.org/repository/webkit/trunk@284585 268f45cc-cd09-0410-ab3c-d52691b4dbfc
+
+    2021-10-20  Yusuke Suzuki  <ysuzuki@apple.com>
+
+            [JSC] ArithAbs should care about INT32_MIN
+            https://bugs.webkit.org/show_bug.cgi?id=232051
+            rdar://84338648
+
+            Reviewed by Michael Saboff.
+
+            ArithAbs (without overflow check) can return negative value if the input is INT32_MIN with Int32Use.
+
+            * dfg/DFGIntegerRangeOptimizationPhase.cpp:
+
 2021-10-25  Null  <null@apple.com>
 

branches/safari-612-branch/Source/JavaScriptCore/dfg/DFGIntegerRangeOptimizationPhase.cpp

@@ -1401 +1401 @@
             if (node->child1().useKind() != Int32Use)
                 break;
-            setRelationship(Relationship(node, m_zero, Relationship::GreaterThan, -1));
+
+            // If ArithAbs cares about overflow, then INT32_MIN input will cause OSR exit.
+            // Thus we can safely say `x >= 0`.
+            if (shouldCheckOverflow(node->arithMode())) {
+                setRelationship(Relationship(node, m_zero, Relationship::GreaterThan, -1));
+                break;
+            }
+
+            // If ArithAbs does not care about overflow, it can return INT32_MIN if the input is INT32_MIN.
+            // If minValue is not INT32_MIN, we can still say it is `x >= 0`.
+            int minValue = std::numeric_limits<int>::min();
+            auto iter = m_relationships.find(node->child1().node());
+            if (iter != m_relationships.end()) {
+                for (Relationship relationship : iter->value)
+                    minValue = std::max(minValue, relationship.minValueOfLeft());
+            }
+
+            if (minValue > std::numeric_limits<int>::min())
+                setRelationship(Relationship(node, m_zero, Relationship::GreaterThan, -1));
             break;
         }