Bug 250806 - Require Int32 when constant-folding ParseInt in DFG
Summary: Require Int32 when constant-folding ParseInt in DFG
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: JavaScriptCore (show other bugs)
Version: WebKit Nightly Build
Hardware: Unspecified Unspecified
: P2 Normal
Assignee: David Degazio
URL:
Keywords: InRadar
Depends on:
Blocks:
 
Reported: 2023-01-18 16:25 PST by David Degazio
Modified: 2023-01-19 11:47 PST (History)
1 user (show)

See Also:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description David Degazio 2023-01-18 16:25:43 PST 
rdar://104071090

In DFG's constant folding phase, we fold ParseInt nodes when the radix is a Number equal to zero. In the DFG fixup phase, however, we more optimistically assume the radix is an Int32 and add a speculation check. We should make sure that the constant folding phase's behavior reflects the type constraints we introduce in the fixup phase.
Comment 1 David Degazio 2023-01-18 16:31:21 PST 
Pull request: https://github.com/WebKit/WebKit/pull/8804
Comment 2 EWS 2023-01-19 11:47:54 PST 
Committed 259102@main (47b456d4d7f3): <https://commits.webkit.org/259102@main>

Reviewed commits have been landed. Closing PR #8804 and removing active labels.