244182 2022-08-22 00:09:29 -0700 JSC DFGFixup computes a wrong addSpeculation mode in DFGGraph::addImmediateShouldSpeculteInt32 when immediateValue is Double 2022-09-09 01:47:15 -0700 1 1 1 Unclassified WebKit JavaScriptCore WebKit Local Build PC Linux NEW InRadar P2 Normal --- 1 entryhii webkit-unassigned bugbot01 saam webkit-bug-importer ysuzuki oldest_to_newest 1892897 0 entryhii 2022-08-22 00:09:29 -0700 var values = [0, 1, 2, 3, 4, -5]; function foo( arg) { let actual = 0.2 + ( arg | arg ) | 0 print(actual) } for (var i = 0; i < values.length; ++i) { foo( values[i]); } With the above script as input to JSC, run JSC with the following parameters: ./jsc test.js --useConcurrentJIT=0 --jitPolicyScale=0 When the parameter passed to foo is -5, the correct result returned by foo should be -4, but JSC incorrectly returns -5. We found that the problem lies in DFGFixupPhase. When handling ValueAdd node, it will first perform attemptToMakeIntegerAdd. In this step, 0.2 is first converted to 0, and 0 and -5 are added to get the result -5. The correct case should be that 0.2 is added with -5 to get -4.8, and -4.8 is converted to an integer -4. In the fixup phase, whether 0.2 is converted to 0 depends on the result of DFGGraph::addImmediateShouldSpeculateInt32, which incorrectly returns SpeculateInt32AndTruncateConstants mode. When immediateValue is Double, it should return DontSpeculateInt32. 1894417 1 webkit-bug-importer 2022-08-29 00:10:16 -0700 <rdar://problem/99264817>