Bug 250806
| Summary: | Require Int32 when constant-folding ParseInt in DFG | ||
|---|---|---|---|
| Product: | WebKit | Reporter: | David Degazio <d_degazio> |
| Component: | JavaScriptCore | Assignee: | David Degazio <d_degazio> |
| Status: | RESOLVED FIXED | ||
| Severity: | Normal | CC: | webkit-bug-importer |
| Priority: | P2 | Keywords: | InRadar |
| Version: | WebKit Nightly Build | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
David Degazio
rdar://104071090
In DFG's constant folding phase, we fold ParseInt nodes when the radix is a Number equal to zero. In the DFG fixup phase, however, we more optimistically assume the radix is an Int32 and add a speculation check. We should make sure that the constant folding phase's behavior reflects the type constraints we introduce in the fixup phase.
| Attachments | ||
|---|---|---|
| Add attachment proposed patch, testcase, etc. |
David Degazio
Pull request: https://github.com/WebKit/WebKit/pull/8804
EWS
Committed 259102@main (47b456d4d7f3): <https://commits.webkit.org/259102@main>
Reviewed commits have been landed. Closing PR #8804 and removing active labels.