Bug 263881 – [JSC] BitURShift is eliminated when toString has an effect

• Component: JavaScriptCore
• Status: RESOLVED FIXED

[EntryHi]

==================test.js=====================
function f1(o, value) {
    function f2()
    {
        o.x=value
        return 2
    }
    let y={}
    y.toString = f2
    y >>> 1;
  }
  
  noInline(f1)
  let obj={}
  for (let v25 = 0; v25 < 100; v25++) {
    f1(obj, v25);
    
  }
 print(obj.x)
==============================================

Run args: ./jsc -f test.js --useConcurrentJIT=0  --jitPolicyScale=0

obj.x should be 99, but JSC prints 1.

This bug may be related to DCE and DFGMovHintRemovalPhase. I noticed JSC added a new phase named DFGMovHintRemoval, is this phase too radical for the JavaScript semantics?

[Radar WebKit Bug Importer]

<rdar://problem/117993267>

[Yusuke Suzuki]

Pull request: https://github.com/WebKit/WebKit/pull/45861

[EWS]

Committed 295380@main (9126da39238b): <https://commits.webkit.org/295380@main>

Reviewed commits have been landed. Closing PR #45861 and removing active labels.