Changeset 260517 in webkit

Timestamp:

Apr 22, 2020, 9:34:47 AM (5 years ago)

Author:

sbarati@apple.com

Message:

ValueBitNot is wrong in FTL with AnyBigIntUse
​https://bugs.webkit.org/show_bug.cgi?id=210846

Reviewed by Yusuke Suzuki.

JSTests:

• stress/big-int-value-bit-not-spec-any-big-int.js: Added.

(assert):
(foo):

Source/JavaScriptCore:

We forgot to speculate.

• ftl/FTLLowerDFGToB3.cpp:

(JSC::FTL::DFG::LowerDFGToB3::compileValueBitNot):

Location:

trunk

Files:

• JSTests/ChangeLog (modified) (1 diff)
• JSTests/stress/big-int-value-bit-not-spec-any-big-int.js (added)
• Source/JavaScriptCore/ChangeLog (modified) (1 diff)
• Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp (modified) (1 diff)

trunk/JSTests/ChangeLog

@@ +1 @@
+2020-04-22  Saam Barati  <sbarati@apple.com>
+
+        ValueBitNot is wrong in FTL with AnyBigIntUse
+        https://bugs.webkit.org/show_bug.cgi?id=210846
+
+        Reviewed by Yusuke Suzuki.
+
+        * stress/big-int-value-bit-not-spec-any-big-int.js: Added.
+        (assert):
+        (foo):
+
 2020-04-22  Yusuke Suzuki  <ysuzuki@apple.com>
 

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2020-04-22  Saam Barati  <sbarati@apple.com>
+
+        ValueBitNot is wrong in FTL with AnyBigIntUse
+        https://bugs.webkit.org/show_bug.cgi?id=210846
+
+        Reviewed by Yusuke Suzuki.
+
+        We forgot to speculate.
+
+        * ftl/FTLLowerDFGToB3.cpp:
+        (JSC::FTL::DFG::LowerDFGToB3::compileValueBitNot):
+
 2020-04-22  Yusuke Suzuki  <ysuzuki@apple.com>
 

trunk/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp

@@ -3302 +3302 @@
         }
 
-        LValue operand = lowJSValue(m_node->child1());
+        DFG_ASSERT(m_graph, m_node, m_node->child1().useKind() == UntypedUse || m_node->child1().useKind() == AnyBigIntUse);
+        LValue operand = lowJSValue(m_node->child1(), ManualOperandSpeculation);
+        speculate(m_node, m_node->child1());
         LValue result = vmCall(Int64, operationValueBitNot, weakPointer(globalObject), operand);
         setJSValue(result);