DFG DOMJIT: fix attemptToMakeCallDOM predicates and restore typed-array/Int52 lowering - #318
Open
robobun wants to merge 2 commits into
Open
DFG DOMJIT: fix attemptToMakeCallDOM predicates and restore typed-array/Int52 lowering#318robobun wants to merge 2 commits into
robobun wants to merge 2 commits into
Claude / Claude Code Review
completed
Jul 23, 2026 in 20m 40s
Code review found 1 potential issue
Found 1 candidates, confirmed 1. See review comments for details.
Details
| Severity | Count |
|---|---|
| 🔴 Important | 0 |
| 🟡 Nit | 1 |
| 🟣 Pre-existing | 0 |
| Severity | File:Line | Issue |
|---|---|---|
| 🟡 Nit | Source/JavaScriptCore/dfg/DFGFixupPhase.cpp:5340-5346 |
Int52 profitability mask omits SpecAnyIntAsDouble |
Annotations
Check warning on line 5346 in Source/JavaScriptCore/dfg/DFGFixupPhase.cpp
claude / Claude Code Review
Int52 profitability mask omits SpecAnyIntAsDouble
The Int52 profitability mask at line 5343 tests `SpecInt32Only | SpecInt52Any`, but at Fixup time a large integer argument (e.g. `2**40`) is profiled as `SpecAnyIntAsDouble` (bit 41) — never `SpecInt52Any` (bits 39|40), which only appears on `NodeResultInt52` nodes *after* Fixup inserts `Int52Rep`. So a pure-large-int argument sets `shouldConvertToCallDOM = false` and skips the DOMJIT fast path even though `fixEdge<Int52RepUse>` handles `SpecAnyIntAsDouble` fine. Consider using `SpecIntAnyFormat
Loading