Title: [204825] releases/WebKitGTK/webkit-2.12/Source/_javascript_Core
- Revision
- 204825
- Author
- [email protected]
- Date
- 2016-08-23 05:54:48 -0700 (Tue, 23 Aug 2016)
Log Message
Merge r202899 - [ARMv7] REGRESSION(r197655): ASSERTION FAILED: (cond == Zero) || (cond == NonZero)
https://bugs.webkit.org/show_bug.cgi?id=159419
Reviewed by Benjamin Poulain.
Allow Signed and PositiveOrZero conditions too because tst instruction updates N and Z flags.
* assembler/MacroAssemblerARM.h:
(JSC::MacroAssemblerARM::branchTest32):
* assembler/MacroAssemblerARMv7.h:
(JSC::MacroAssemblerARMv7::branchTest32): Add assertions to avoid possible bugs in the future.
Modified Paths
Diff
Modified: releases/WebKitGTK/webkit-2.12/Source/_javascript_Core/ChangeLog (204824 => 204825)
--- releases/WebKitGTK/webkit-2.12/Source/_javascript_Core/ChangeLog 2016-08-23 12:53:59 UTC (rev 204824)
+++ releases/WebKitGTK/webkit-2.12/Source/_javascript_Core/ChangeLog 2016-08-23 12:54:48 UTC (rev 204825)
@@ -1,3 +1,17 @@
+2016-07-07 Csaba Osztrogonác <[email protected]>
+
+ [ARMv7] REGRESSION(r197655): ASSERTION FAILED: (cond == Zero) || (cond == NonZero)
+ https://bugs.webkit.org/show_bug.cgi?id=159419
+
+ Reviewed by Benjamin Poulain.
+
+ Allow Signed and PositiveOrZero conditions too because tst instruction updates N and Z flags.
+
+ * assembler/MacroAssemblerARM.h:
+ (JSC::MacroAssemblerARM::branchTest32):
+ * assembler/MacroAssemblerARMv7.h:
+ (JSC::MacroAssemblerARMv7::branchTest32): Add assertions to avoid possible bugs in the future.
+
2016-04-04 Chris Dumez <[email protected]>
Regression(r196145): Crash in getOwnPropertyDescriptor on http://www.history.com/shows/vikings
Modified: releases/WebKitGTK/webkit-2.12/Source/_javascript_Core/assembler/MacroAssemblerARM.h (204824 => 204825)
--- releases/WebKitGTK/webkit-2.12/Source/_javascript_Core/assembler/MacroAssemblerARM.h 2016-08-23 12:53:59 UTC (rev 204824)
+++ releases/WebKitGTK/webkit-2.12/Source/_javascript_Core/assembler/MacroAssemblerARM.h 2016-08-23 12:54:48 UTC (rev 204825)
@@ -704,7 +704,7 @@
Jump branchTest32(ResultCondition cond, RegisterID reg, RegisterID mask)
{
- ASSERT((cond == Zero) || (cond == NonZero));
+ ASSERT(cond == Zero || cond == NonZero || cond == Signed || cond == PositiveOrZero);
m_assembler.tst(reg, mask);
return Jump(m_assembler.jmp(ARMCondition(cond)));
}
@@ -711,7 +711,7 @@
Jump branchTest32(ResultCondition cond, RegisterID reg, TrustedImm32 mask = TrustedImm32(-1))
{
- ASSERT((cond == Zero) || (cond == NonZero));
+ ASSERT(cond == Zero || cond == NonZero || cond == Signed || cond == PositiveOrZero);
ARMWord w = m_assembler.getImm(mask.m_value, ARMRegisters::S0, true);
if (w & ARMAssembler::Op2InvertedImmediate)
m_assembler.bics(ARMRegisters::S0, reg, w & ~ARMAssembler::Op2InvertedImmediate);
Modified: releases/WebKitGTK/webkit-2.12/Source/_javascript_Core/assembler/MacroAssemblerARMv7.h (204824 => 204825)
--- releases/WebKitGTK/webkit-2.12/Source/_javascript_Core/assembler/MacroAssemblerARMv7.h 2016-08-23 12:53:59 UTC (rev 204824)
+++ releases/WebKitGTK/webkit-2.12/Source/_javascript_Core/assembler/MacroAssemblerARMv7.h 2016-08-23 12:54:48 UTC (rev 204825)
@@ -1495,6 +1495,7 @@
Jump branchTest32(ResultCondition cond, RegisterID reg, RegisterID mask)
{
+ ASSERT(cond == Zero || cond == NonZero || cond == Signed || cond == PositiveOrZero);
m_assembler.tst(reg, mask);
return Jump(makeBranch(cond));
}
@@ -1501,6 +1502,7 @@
Jump branchTest32(ResultCondition cond, RegisterID reg, TrustedImm32 mask = TrustedImm32(-1))
{
+ ASSERT(cond == Zero || cond == NonZero || cond == Signed || cond == PositiveOrZero);
test32(reg, mask);
return Jump(makeBranch(cond));
}
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
