Title: [133089] trunk/Source/_javascript_Core
- Revision
- 133089
- Author
- [email protected]
- Date
- 2012-10-31 15:40:43 -0700 (Wed, 31 Oct 2012)
Log Message
64-bit llint PC offset can be negative: using an unsigned shift is a bug.
https://bugs.webkit.org/show_bug.cgi?id=100896.
Reviewed by Filip Pizlo.
Fixed the PC offset divisions in the 64-bit llint asm to use rshift instead of urshift.
* llint/LowLevelInterpreter64.asm:
Modified Paths
Diff
Modified: trunk/Source/_javascript_Core/ChangeLog (133088 => 133089)
--- trunk/Source/_javascript_Core/ChangeLog 2012-10-31 22:34:47 UTC (rev 133088)
+++ trunk/Source/_javascript_Core/ChangeLog 2012-10-31 22:40:43 UTC (rev 133089)
@@ -1,3 +1,14 @@
+2012-10-31 Mark Lam <[email protected]>
+
+ 64-bit llint PC offset can be negative: using an unsigned shift is a bug.
+ https://bugs.webkit.org/show_bug.cgi?id=100896.
+
+ Reviewed by Filip Pizlo.
+
+ Fixed the PC offset divisions in the 64-bit llint asm to use rshift instead of urshift.
+
+ * llint/LowLevelInterpreter64.asm:
+
2012-10-30 Yuqiang Xian <[email protected]>
glsl-function-atan.html WebGL conformance test fails after https://bugs.webkit.org/show_bug.cgi?id=99154
Modified: trunk/Source/_javascript_Core/llint/LowLevelInterpreter64.asm (133088 => 133089)
--- trunk/Source/_javascript_Core/llint/LowLevelInterpreter64.asm 2012-10-31 22:34:47 UTC (rev 133088)
+++ trunk/Source/_javascript_Core/llint/LowLevelInterpreter64.asm 2012-10-31 22:40:43 UTC (rev 133089)
@@ -87,7 +87,7 @@
move t1, cfr
move t3, PB
subp PB, PC
- urshiftp 3, PC
+ rshiftp 3, PC
end
macro callSlowPath(slowPath)
@@ -1525,7 +1525,7 @@
loadp JITStackFrame::globalData[sp], t3
loadp JSGlobalData::targetInterpreterPCForThrow[t3], PC
subp PB, PC
- urshiftp 3, PC
+ rshiftp 3, PC
loadp JSGlobalData::exception[t3], t0
storep 0, JSGlobalData::exception[t3]
loadis 8[PB, PC, 8], t2
_______________________________________________
webkit-changes mailing list
[email protected]
http://lists.webkit.org/mailman/listinfo/webkit-changes
