Bug 251117 - DFG should not speculate Int32 for NaN constants
Summary: DFG should not speculate Int32 for NaN constants
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: JavaScriptCore (show other bugs)
Version: WebKit Nightly Build
Hardware: Unspecified Unspecified
: P2 Normal
Assignee: David Degazio
URL:
Keywords: InRadar
Depends on:
Blocks:
 
Reported: 2023-01-24 15:03 PST by David Degazio
Modified: 2023-01-24 21:04 PST (History)
1 user (show)

See Also:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description David Degazio 2023-01-24 15:03:00 PST
rdar://104608391

Currently, DFG will attempt to speculate Int32 for certain double constants during the fixup phase. If a number constant is an Int32, or falls within a valid range (between ±2^48), it's allowed to be truncated into an integer. However, NaN values cannot be compared and ordered, so unlike other non-finite values like positive or negative Infinity, they can pass this range check and be converted into an Int32 despite clearly being non-integral values. We should add a check for NaN constants and reject Int32 speculation if we come across one during the fixup phase.
Comment 1 David Degazio 2023-01-24 15:14:44 PST
Pull request: https://github.com/WebKit/WebKit/pull/9077
Comment 2 EWS 2023-01-24 21:04:54 PST
Committed 259340@main (800a9bf27aa7): <https://commits.webkit.org/259340@main>

Reviewed commits have been landed. Closing PR #9077 and removing active labels.