Bug 196911 - DFG IntegerRangeOptimizationPhase fails to optimize the situation when ArithAdd node's second child is a negative constant.
Summary: DFG IntegerRangeOptimizationPhase fails to optimize the situation when ArithA...
Status: NEW
Alias: None
Product: WebKit
Classification: Unclassified
Component: JavaScriptCore (show other bugs)
Version: Safari 12
Hardware: All All
: P1 Normal
Assignee: Nobody
URL:
Keywords: InRadar
Depends on:
Blocks:
 
Reported: 2019-04-15 00:28 PDT by jundong.xjd
Modified: 2019-04-15 15:15 PDT (History)
5 users (show)

See Also:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description jundong.xjd 2019-04-15 00:28:04 PDT
In DFGIntegerRangeOptimizationPhase, the `executeNode` function fails to correctly deal with ArithAdd node when node's second child is a negative constant.
```
case ArithAdd: {
            ...
            
            int offset = node->child2()->asInt32();
            
            ...
            
            
            if (offset < 0 && offset != std::numeric_limits<int>::min()) {
                // If we have "add: @value - 1" then we know that @value >= min + 1, i.e. that
                // @value > min.
                if (!sumOverflows<int>(std::numeric_limits<int>::min(), offset, -1)) { <-- this line definitely returns false because intMin plus two negative value definitely overflows!
                    setRelationship(
                        Relationship::safeCreate(
                            node->child1().node(), m_zero, Relationship::GreaterThan,
                            std::numeric_limits<int>::min() + offset - 1),
                        0);
                }
                
                // If we have "add: @value + 1" then we know that @add <= max - 1, i.e. that
                // @add < max.
                if (!sumOverflows<int>(std::numeric_limits<int>::max(), -offset, 1)) { <-- intMax plus two positive value definitely overflows!
                    setRelationship(
                        Relationship(
                            node, m_zero, Relationship::LessThan,
                            std::numeric_limits<int>::max() - offset + 1),
                        0);
                }
            }
            break;
        }
```
If the offset is negative, we have add: @value - C, then we know @value >= min + C, @value > min + C - 1. C equals -offset, so final expression should be @value > min - offset - 1.
If the offset is negative, we have add: @value - C, then we know @add <= max - C, @add < max - C + 1. C equals -offset, so final expression should be @add < max + offset + 1.
Comment 1 Radar WebKit Bug Importer 2019-04-15 15:15:43 PDT
<rdar://problem/49919886>