DFG is too aggressive eliding overflow checks for additions involving large constants

https://bugs.webkit.org/show_bug.cgi?id=105239

Reviewed by Gavin Barraclough.

Source/JavaScriptCore:

If we elide overflow checks on an addition (or subtraction) involving a larger-than-2^32 immediate,
then make sure that the non-constant child of the addition knows that he's got to do an overflow
check, by flowing the UsedAsNumber property at him.

* dfg/DFGGraph.h:
(JSC::DFG::Graph::addSpeculationMode):
(Graph):
(JSC::DFG::Graph::addShouldSpeculateInteger):
(JSC::DFG::Graph::addImmediateShouldSpeculateInteger):
* dfg/DFGPredictionPropagationPhase.cpp:
(JSC::DFG::PredictionPropagationPhase::propagate):

LayoutTests:

* fast/js/dfg-int-overflow-large-constants-in-a-line-expected.txt: Added.
* fast/js/dfg-int-overflow-large-constants-in-a-line.html: Added.
* fast/js/jsc-test-list:
* fast/js/script-tests/dfg-int-overflow-large-constants-in-a-line.js: Added.
(foo):

Change-Id: If9f7c71050b6f07fc024e6e9f42083d7d3ca71f6
git-svn-id: http://svn.webkit.org/repository/webkit/trunk@137980 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Reviewed-by: Jocelyn Turcotte <jocelyn.turcotte@digia.com>

0 files changed, 0 insertions, 0 deletions