Bug 244182 – JSC DFGFixup computes a wrong addSpeculation mode in DFGGraph::addImmediateShouldSpeculteInt32 when immediateValue is Double

• Status: NEW
• Component: JavaScriptCore

[EntryHi]

var values = [0, 1, 2, 3, 4, -5];
function foo( arg) {
  let actual = 0.2 + ( arg | arg ) | 0
  print(actual)
} 
for (var i = 0; i < values.length; ++i) {
  foo( values[i]);
} 


With the above script as input to JSC, run JSC with the following parameters:
./jsc test.js --useConcurrentJIT=0 --jitPolicyScale=0

When the parameter passed to foo is -5, the correct result returned by foo should be -4, but JSC incorrectly returns -5.

We found that the problem lies in DFGFixupPhase. When handling ValueAdd node, it will first perform attemptToMakeIntegerAdd. In this step, 0.2 is first converted to 0, and 0 and -5 are added to get the result -5.
The correct case should be that 0.2 is added with -5 to get -4.8, and -4.8 is converted to an integer -4.

In the fixup phase, whether 0.2 is converted to 0 depends on the result of DFGGraph::addImmediateShouldSpeculateInt32, which incorrectly returns SpeculateInt32AndTruncateConstants mode. When immediateValue is Double, it should return DontSpeculateInt32.

[Radar WebKit Bug Importer]

<rdar://problem/99264817>