Bug 263660 - REGRESSION(269608@main): 32-bit shifts are used to zero out upper 32-bits after all.
Summary: REGRESSION(269608@main): 32-bit shifts are used to zero out upper 32-bits aft...
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: JavaScriptCore (show other bugs)
Version: WebKit Nightly Build
Hardware: Unspecified Unspecified
: P2 Normal
Assignee: Mark Lam
URL:
Keywords: InRadar
Depends on:
Blocks:
 
Reported: 2023-10-25 08:22 PDT by Mark Lam
Modified: 2023-10-25 14:39 PDT (History)
1 user (show)

See Also:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Mark Lam 2023-10-25 08:22:37 PDT 
In https://commits.webkit.org/269608@main, we added a peephole optimization to reduce shifts to moves if the shift amount is 0.  However, this is only correct if shift instructions are never used indirectly to zero out the upper 32-bits of the register.  It turns out that the JIT backends do rely on shifts to zero out the upper 32-bits.
Comment 1 Radar WebKit Bug Importer 2023-10-25 08:22:56 PDT 
<rdar://problem/117475957>
Comment 2 Mark Lam 2023-10-25 09:25:51 PDT 
Pull request: https://github.com/WebKit/WebKit/pull/19543
Comment 3 EWS 2023-10-25 14:39:02 PDT 
Committed 269785@main (748f4d4620ab): <https://commits.webkit.org/269785@main>

Reviewed commits have been landed. Closing PR #19543 and removing active labels.