Bug 257949 – JSC computes incorrectly in DFG

• Status: RESOLVED
• Resolution: FIXED
• Component: JavaScriptCore

[ChristineWillice]

``````````````test.js`````````````````
function opt(v)
{
  return ((-1 >>> v) + -0.2) | 0
}
for (let i = 0; i < 100; i++) {
  opt(0)
}
print(opt(32))
``````````````````````````````````````

This bug is in latest version JSC.

Run args: ./jsc test.js --useConcurrentJIT=0 --jitPolicyScale=0

The corrent result is -2, but JSC prints -1.

[Alexey Proskuryakov]

Reproduces on Apple Silicon macOS, too.

[Radar WebKit Bug Importer]

<rdar://problem/110661900>

[Justin Michaud]

Pull request: https://github.com/WebKit/WebKit/pull/15311

[EWS]

Committed 265833@main (2f7262436c99): <https://commits.webkit.org/265833@main>

Reviewed commits have been landed. Closing PR #15311 and removing active labels.

[WebKit Commit Bot]

Re-opened since this is blocked by bug 259065

[Carlos Alberto Lopez Perez]

BTW, this also caused crashes on the kraken benchmark (on GTK/WPE 64-bits builds). For example when running it with the run-benchmark tool like: Tools/Scripts/run-benchmark --plan kraken [...]
Crash log: http://sprunge.us/ZhSWj6

[Yijia Huang]

Pull request: https://github.com/WebKit/WebKit/pull/26024

[EWS]

Committed 276654@main (f5b95a221c2e): <https://commits.webkit.org/276654@main>

Reviewed commits have been landed. Closing PR #26024 and removing active labels.

[WebKit Commit Bot]

Re-opened since this is blocked by bug 271788

[Yijia Huang]

Pull request: https://github.com/WebKit/WebKit/pull/26913

[EWS]

Committed 277456@main (6c214dfbb5a1): <https://commits.webkit.org/277456@main>

Reviewed commits have been landed. Closing PR #26913 and removing active labels.

[Yusuke Suzuki]

*** Bug 265272 has been marked as a duplicate of this bug. ***