Bug 105226 – DFG is too aggressive with eliding overflow checks in loops

• Component: JavaScriptCore
• Status: RESOLVED FIXED

[Filip Pizlo]

Example:

function foo(a) {
    var x = a;
    // Make sure that this is the loop where we do OSR entry.
    for (var i = 0; i < 100000; ++i)
        x += 1;
    // Now trigger overflow that is so severe that the floating point result would be different than the bigint result.
    for (var i = 0; i < 160097152; ++i)
        x += 2147483647;
    return x | 0;
}

Calling foo(0) will return different results in the baseline JIT versus the DFG JIT.  The baseline JIT will be right.

[Filip Pizlo]

Created attachment 179822 [details]
the patch

[Filip Pizlo]

Landed in http://trac.webkit.org/changeset/137963