263881 2023-10-30 05:10:16 -0700 [JSC] BitURShift is eliminated when toString has an effect 2025-05-23 19:05:17 -0700 1 1 1 Unclassified WebKit JavaScriptCore WebKit Nightly Build PC Linux RESOLVED FIXED InRadar P2 Normal --- 1 entryhii ysuzuki mark.lam webkit-bug-importer ysuzuki oldest_to_newest 1988460 0 entryhii 2023-10-30 05:10:16 -0700 ==================test.js===================== function f1(o, value) { function f2() { o.x=value return 2 } let y={} y.toString = f2 y >>> 1; } noInline(f1) let obj={} for (let v25 = 0; v25 < 100; v25++) { f1(obj, v25); } print(obj.x) ============================================== Run args: ./jsc -f test.js --useConcurrentJIT=0 --jitPolicyScale=0 obj.x should be 99, but JSC prints 1. This bug may be related to DCE and DFGMovHintRemovalPhase. I noticed JSC added a new phase named DFGMovHintRemoval, is this phase too radical for the JavaScript semantics? 1990139 1 webkit-bug-importer 2023-11-06 04:11:14 -0800 <rdar://problem/117993267> 2119408 2 ysuzuki 2025-05-23 15:33:41 -0700 Pull request: https://github.com/WebKit/WebKit/pull/45861 2119494 3 ews-feeder 2025-05-23 19:05:15 -0700 Committed 295380@main (9126da39238b): <https://commits.webkit.org/295380@main> Reviewed commits have been landed. Closing PR #45861 and removing active labels.