Diff
Modified: trunk/LayoutTests/ChangeLog (150693 => 150694)
--- trunk/LayoutTests/ChangeLog 2013-05-25 23:13:15 UTC (rev 150693)
+++ trunk/LayoutTests/ChangeLog 2013-05-25 23:31:20 UTC (rev 150694)
@@ -1,3 +1,24 @@
+2013-05-25 Filip Pizlo <[email protected]>
+
+ We broke (-2^31/-1)|0 in the DFG
+ https://bugs.webkit.org/show_bug.cgi?id=116767
+
+ Reviewed by Andreas Kling.
+
+ * fast/js/dfg-div-by-neg1-and-then-or-zero-interesting-reg-alloc-expected.txt: Added.
+ * fast/js/dfg-div-by-neg1-and-then-or-zero-interesting-reg-alloc.html: Added.
+ * fast/js/dfg-div-by-zero-and-then-or-zero-interesting-reg-alloc-expected.txt: Added.
+ * fast/js/dfg-div-by-zero-and-then-or-zero-interesting-reg-alloc.html: Added.
+ * fast/js/dfg-div-neg2tothe31-by-one-and-then-or-zero-with-interesting-reg-alloc-expected.txt: Added.
+ * fast/js/dfg-div-neg2tothe31-by-one-and-then-or-zero-with-interesting-reg-alloc.html: Added.
+ * fast/js/jsc-test-list:
+ * fast/js/script-tests/dfg-div-by-neg1-and-then-or-zero-interesting-reg-alloc.js: Added.
+ (foo):
+ * fast/js/script-tests/dfg-div-by-zero-and-then-or-zero-interesting-reg-alloc.js: Added.
+ (foo):
+ * fast/js/script-tests/dfg-div-neg2tothe31-by-one-and-then-or-zero-with-interesting-reg-alloc.js: Added.
+ (foo):
+
2013-05-25 Dan Bernstein <[email protected]>
Updated expected results after r150688.
Added: trunk/LayoutTests/fast/js/dfg-div-by-neg1-and-then-or-zero-interesting-reg-alloc-expected.txt (0 => 150694)
--- trunk/LayoutTests/fast/js/dfg-div-by-neg1-and-then-or-zero-interesting-reg-alloc-expected.txt (rev 0)
+++ trunk/LayoutTests/fast/js/dfg-div-by-neg1-and-then-or-zero-interesting-reg-alloc-expected.txt 2013-05-25 23:31:20 UTC (rev 150694)
@@ -0,0 +1,109 @@
+Tests that the (x/-1)|0 case in the DFG is handled correctly even when there is some interesting register allocation going on.
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+
+FAIL foo(0, 0, 0, -1) should be 0. Was 0.
+PASS foo(0, 0, 1, -1) is -1
+PASS foo(0, 0, 2, -1) is -2
+PASS foo(0, 0, 3, -1) is -3
+PASS foo(0, 0, 4, -1) is -4
+PASS foo(0, 0, 5, -1) is -5
+PASS foo(0, 0, 6, -1) is -6
+PASS foo(0, 0, 7, -1) is -7
+PASS foo(0, 0, 8, -1) is -8
+PASS foo(0, 0, 9, -1) is -9
+PASS foo(0, 0, 10, -1) is -10
+PASS foo(0, 0, 11, -1) is -11
+PASS foo(0, 0, 12, -1) is -12
+PASS foo(0, 0, 13, -1) is -13
+PASS foo(0, 0, 14, -1) is -14
+PASS foo(0, 0, 15, -1) is -15
+PASS foo(0, 0, 16, -1) is -16
+PASS foo(0, 0, 17, -1) is -17
+PASS foo(0, 0, 18, -1) is -18
+PASS foo(0, 0, 19, -1) is -19
+PASS foo(0, 0, 20, -1) is -20
+PASS foo(0, 0, 21, -1) is -21
+PASS foo(0, 0, 22, -1) is -22
+PASS foo(0, 0, 23, -1) is -23
+PASS foo(0, 0, 24, -1) is -24
+PASS foo(0, 0, 25, -1) is -25
+PASS foo(0, 0, 26, -1) is -26
+PASS foo(0, 0, 27, -1) is -27
+PASS foo(0, 0, 28, -1) is -28
+PASS foo(0, 0, 29, -1) is -29
+PASS foo(0, 0, 30, -1) is -30
+PASS foo(0, 0, 31, -1) is -31
+PASS foo(0, 0, 32, -1) is -32
+PASS foo(0, 0, 33, -1) is -33
+PASS foo(0, 0, 34, -1) is -34
+PASS foo(0, 0, 35, -1) is -35
+PASS foo(0, 0, 36, -1) is -36
+PASS foo(0, 0, 37, -1) is -37
+PASS foo(0, 0, 38, -1) is -38
+PASS foo(0, 0, 39, -1) is -39
+PASS foo(0, 0, 40, -1) is -40
+PASS foo(0, 0, 41, -1) is -41
+PASS foo(0, 0, 42, -1) is -42
+PASS foo(0, 0, 43, -1) is -43
+PASS foo(0, 0, 44, -1) is -44
+PASS foo(0, 0, 45, -1) is -45
+PASS foo(0, 0, 46, -1) is -46
+PASS foo(0, 0, 47, -1) is -47
+PASS foo(0, 0, 48, -1) is -48
+PASS foo(0, 0, 49, -1) is -49
+PASS foo(0, 0, 50, -1) is -50
+PASS foo(0, 0, 51, -1) is -51
+PASS foo(0, 0, 52, -1) is -52
+PASS foo(0, 0, 53, -1) is -53
+PASS foo(0, 0, 54, -1) is -54
+PASS foo(0, 0, 55, -1) is -55
+PASS foo(0, 0, 56, -1) is -56
+PASS foo(0, 0, 57, -1) is -57
+PASS foo(0, 0, 58, -1) is -58
+PASS foo(0, 0, 59, -1) is -59
+PASS foo(0, 0, 60, -1) is -60
+PASS foo(0, 0, 61, -1) is -61
+PASS foo(0, 0, 62, -1) is -62
+PASS foo(0, 0, 63, -1) is -63
+PASS foo(0, 0, 64, -1) is -64
+PASS foo(0, 0, 65, -1) is -65
+PASS foo(0, 0, 66, -1) is -66
+PASS foo(0, 0, 67, -1) is -67
+PASS foo(0, 0, 68, -1) is -68
+PASS foo(0, 0, 69, -1) is -69
+PASS foo(0, 0, 70, -1) is -70
+PASS foo(0, 0, 71, -1) is -71
+PASS foo(0, 0, 72, -1) is -72
+PASS foo(0, 0, 73, -1) is -73
+PASS foo(0, 0, 74, -1) is -74
+PASS foo(0, 0, 75, -1) is -75
+PASS foo(0, 0, 76, -1) is -76
+PASS foo(0, 0, 77, -1) is -77
+PASS foo(0, 0, 78, -1) is -78
+PASS foo(0, 0, 79, -1) is -79
+PASS foo(0, 0, 80, -1) is -80
+PASS foo(0, 0, 81, -1) is -81
+PASS foo(0, 0, 82, -1) is -82
+PASS foo(0, 0, 83, -1) is -83
+PASS foo(0, 0, 84, -1) is -84
+PASS foo(0, 0, 85, -1) is -85
+PASS foo(0, 0, 86, -1) is -86
+PASS foo(0, 0, 87, -1) is -87
+PASS foo(0, 0, 88, -1) is -88
+PASS foo(0, 0, 89, -1) is -89
+PASS foo(0, 0, 90, -1) is -90
+PASS foo(0, 0, 91, -1) is -91
+PASS foo(0, 0, 92, -1) is -92
+PASS foo(0, 0, 93, -1) is -93
+PASS foo(0, 0, 94, -1) is -94
+PASS foo(0, 0, 95, -1) is -95
+PASS foo(0, 0, 96, -1) is -96
+PASS foo(0, 0, 97, -1) is -97
+PASS foo(0, 0, 98, -1) is -98
+PASS foo(0, 0, 99, -1) is -99
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
Added: trunk/LayoutTests/fast/js/dfg-div-by-neg1-and-then-or-zero-interesting-reg-alloc.html (0 => 150694)
--- trunk/LayoutTests/fast/js/dfg-div-by-neg1-and-then-or-zero-interesting-reg-alloc.html (rev 0)
+++ trunk/LayoutTests/fast/js/dfg-div-by-neg1-and-then-or-zero-interesting-reg-alloc.html 2013-05-25 23:31:20 UTC (rev 150694)
@@ -0,0 +1,10 @@
+<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
+<html>
+<head>
+<script src=""
+</head>
+<body>
+<script src=""
+<script src=""
+</body>
+</html>
Added: trunk/LayoutTests/fast/js/dfg-div-by-zero-and-then-or-zero-interesting-reg-alloc-expected.txt (0 => 150694)
--- trunk/LayoutTests/fast/js/dfg-div-by-zero-and-then-or-zero-interesting-reg-alloc-expected.txt (rev 0)
+++ trunk/LayoutTests/fast/js/dfg-div-by-zero-and-then-or-zero-interesting-reg-alloc-expected.txt 2013-05-25 23:31:20 UTC (rev 150694)
@@ -0,0 +1,109 @@
+Tests that the (x/0)|0 case in the DFG is handled correctly even when there is some interesting register allocation going on.
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+
+PASS foo(0, 0, 0, 0) is 0
+PASS foo(0, 0, 1, 0) is 0
+PASS foo(0, 0, 2, 0) is 0
+PASS foo(0, 0, 3, 0) is 0
+PASS foo(0, 0, 4, 0) is 0
+PASS foo(0, 0, 5, 0) is 0
+PASS foo(0, 0, 6, 0) is 0
+PASS foo(0, 0, 7, 0) is 0
+PASS foo(0, 0, 8, 0) is 0
+PASS foo(0, 0, 9, 0) is 0
+PASS foo(0, 0, 10, 0) is 0
+PASS foo(0, 0, 11, 0) is 0
+PASS foo(0, 0, 12, 0) is 0
+PASS foo(0, 0, 13, 0) is 0
+PASS foo(0, 0, 14, 0) is 0
+PASS foo(0, 0, 15, 0) is 0
+PASS foo(0, 0, 16, 0) is 0
+PASS foo(0, 0, 17, 0) is 0
+PASS foo(0, 0, 18, 0) is 0
+PASS foo(0, 0, 19, 0) is 0
+PASS foo(0, 0, 20, 0) is 0
+PASS foo(0, 0, 21, 0) is 0
+PASS foo(0, 0, 22, 0) is 0
+PASS foo(0, 0, 23, 0) is 0
+PASS foo(0, 0, 24, 0) is 0
+PASS foo(0, 0, 25, 0) is 0
+PASS foo(0, 0, 26, 0) is 0
+PASS foo(0, 0, 27, 0) is 0
+PASS foo(0, 0, 28, 0) is 0
+PASS foo(0, 0, 29, 0) is 0
+PASS foo(0, 0, 30, 0) is 0
+PASS foo(0, 0, 31, 0) is 0
+PASS foo(0, 0, 32, 0) is 0
+PASS foo(0, 0, 33, 0) is 0
+PASS foo(0, 0, 34, 0) is 0
+PASS foo(0, 0, 35, 0) is 0
+PASS foo(0, 0, 36, 0) is 0
+PASS foo(0, 0, 37, 0) is 0
+PASS foo(0, 0, 38, 0) is 0
+PASS foo(0, 0, 39, 0) is 0
+PASS foo(0, 0, 40, 0) is 0
+PASS foo(0, 0, 41, 0) is 0
+PASS foo(0, 0, 42, 0) is 0
+PASS foo(0, 0, 43, 0) is 0
+PASS foo(0, 0, 44, 0) is 0
+PASS foo(0, 0, 45, 0) is 0
+PASS foo(0, 0, 46, 0) is 0
+PASS foo(0, 0, 47, 0) is 0
+PASS foo(0, 0, 48, 0) is 0
+PASS foo(0, 0, 49, 0) is 0
+PASS foo(0, 0, 50, 0) is 0
+PASS foo(0, 0, 51, 0) is 0
+PASS foo(0, 0, 52, 0) is 0
+PASS foo(0, 0, 53, 0) is 0
+PASS foo(0, 0, 54, 0) is 0
+PASS foo(0, 0, 55, 0) is 0
+PASS foo(0, 0, 56, 0) is 0
+PASS foo(0, 0, 57, 0) is 0
+PASS foo(0, 0, 58, 0) is 0
+PASS foo(0, 0, 59, 0) is 0
+PASS foo(0, 0, 60, 0) is 0
+PASS foo(0, 0, 61, 0) is 0
+PASS foo(0, 0, 62, 0) is 0
+PASS foo(0, 0, 63, 0) is 0
+PASS foo(0, 0, 64, 0) is 0
+PASS foo(0, 0, 65, 0) is 0
+PASS foo(0, 0, 66, 0) is 0
+PASS foo(0, 0, 67, 0) is 0
+PASS foo(0, 0, 68, 0) is 0
+PASS foo(0, 0, 69, 0) is 0
+PASS foo(0, 0, 70, 0) is 0
+PASS foo(0, 0, 71, 0) is 0
+PASS foo(0, 0, 72, 0) is 0
+PASS foo(0, 0, 73, 0) is 0
+PASS foo(0, 0, 74, 0) is 0
+PASS foo(0, 0, 75, 0) is 0
+PASS foo(0, 0, 76, 0) is 0
+PASS foo(0, 0, 77, 0) is 0
+PASS foo(0, 0, 78, 0) is 0
+PASS foo(0, 0, 79, 0) is 0
+PASS foo(0, 0, 80, 0) is 0
+PASS foo(0, 0, 81, 0) is 0
+PASS foo(0, 0, 82, 0) is 0
+PASS foo(0, 0, 83, 0) is 0
+PASS foo(0, 0, 84, 0) is 0
+PASS foo(0, 0, 85, 0) is 0
+PASS foo(0, 0, 86, 0) is 0
+PASS foo(0, 0, 87, 0) is 0
+PASS foo(0, 0, 88, 0) is 0
+PASS foo(0, 0, 89, 0) is 0
+PASS foo(0, 0, 90, 0) is 0
+PASS foo(0, 0, 91, 0) is 0
+PASS foo(0, 0, 92, 0) is 0
+PASS foo(0, 0, 93, 0) is 0
+PASS foo(0, 0, 94, 0) is 0
+PASS foo(0, 0, 95, 0) is 0
+PASS foo(0, 0, 96, 0) is 0
+PASS foo(0, 0, 97, 0) is 0
+PASS foo(0, 0, 98, 0) is 0
+PASS foo(0, 0, 99, 0) is 0
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
Added: trunk/LayoutTests/fast/js/dfg-div-by-zero-and-then-or-zero-interesting-reg-alloc.html (0 => 150694)
--- trunk/LayoutTests/fast/js/dfg-div-by-zero-and-then-or-zero-interesting-reg-alloc.html (rev 0)
+++ trunk/LayoutTests/fast/js/dfg-div-by-zero-and-then-or-zero-interesting-reg-alloc.html 2013-05-25 23:31:20 UTC (rev 150694)
@@ -0,0 +1,10 @@
+<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
+<html>
+<head>
+<script src=""
+</head>
+<body>
+<script src=""
+<script src=""
+</body>
+</html>
Added: trunk/LayoutTests/fast/js/dfg-div-neg2tothe31-by-one-and-then-or-zero-with-interesting-reg-alloc-expected.txt (0 => 150694)
--- trunk/LayoutTests/fast/js/dfg-div-neg2tothe31-by-one-and-then-or-zero-with-interesting-reg-alloc-expected.txt (rev 0)
+++ trunk/LayoutTests/fast/js/dfg-div-neg2tothe31-by-one-and-then-or-zero-with-interesting-reg-alloc-expected.txt 2013-05-25 23:31:20 UTC (rev 150694)
@@ -0,0 +1,109 @@
+Tests that the (-2147483648/-1)|0 case in the DFG is handled correctly even when there is some interesting register allocation going on.
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+
+PASS foo(0, 0, -2147483647-1, -1) is -2147483647-1
+PASS foo(0, 0, -2147483647-1, -1) is -2147483647-1
+PASS foo(0, 0, -2147483647-1, -1) is -2147483647-1
+PASS foo(0, 0, -2147483647-1, -1) is -2147483647-1
+PASS foo(0, 0, -2147483647-1, -1) is -2147483647-1
+PASS foo(0, 0, -2147483647-1, -1) is -2147483647-1
+PASS foo(0, 0, -2147483647-1, -1) is -2147483647-1
+PASS foo(0, 0, -2147483647-1, -1) is -2147483647-1
+PASS foo(0, 0, -2147483647-1, -1) is -2147483647-1
+PASS foo(0, 0, -2147483647-1, -1) is -2147483647-1
+PASS foo(0, 0, -2147483647-1, -1) is -2147483647-1
+PASS foo(0, 0, -2147483647-1, -1) is -2147483647-1
+PASS foo(0, 0, -2147483647-1, -1) is -2147483647-1
+PASS foo(0, 0, -2147483647-1, -1) is -2147483647-1
+PASS foo(0, 0, -2147483647-1, -1) is -2147483647-1
+PASS foo(0, 0, -2147483647-1, -1) is -2147483647-1
+PASS foo(0, 0, -2147483647-1, -1) is -2147483647-1
+PASS foo(0, 0, -2147483647-1, -1) is -2147483647-1
+PASS foo(0, 0, -2147483647-1, -1) is -2147483647-1
+PASS foo(0, 0, -2147483647-1, -1) is -2147483647-1
+PASS foo(0, 0, -2147483647-1, -1) is -2147483647-1
+PASS foo(0, 0, -2147483647-1, -1) is -2147483647-1
+PASS foo(0, 0, -2147483647-1, -1) is -2147483647-1
+PASS foo(0, 0, -2147483647-1, -1) is -2147483647-1
+PASS foo(0, 0, -2147483647-1, -1) is -2147483647-1
+PASS foo(0, 0, -2147483647-1, -1) is -2147483647-1
+PASS foo(0, 0, -2147483647-1, -1) is -2147483647-1
+PASS foo(0, 0, -2147483647-1, -1) is -2147483647-1
+PASS foo(0, 0, -2147483647-1, -1) is -2147483647-1
+PASS foo(0, 0, -2147483647-1, -1) is -2147483647-1
+PASS foo(0, 0, -2147483647-1, -1) is -2147483647-1
+PASS foo(0, 0, -2147483647-1, -1) is -2147483647-1
+PASS foo(0, 0, -2147483647-1, -1) is -2147483647-1
+PASS foo(0, 0, -2147483647-1, -1) is -2147483647-1
+PASS foo(0, 0, -2147483647-1, -1) is -2147483647-1
+PASS foo(0, 0, -2147483647-1, -1) is -2147483647-1
+PASS foo(0, 0, -2147483647-1, -1) is -2147483647-1
+PASS foo(0, 0, -2147483647-1, -1) is -2147483647-1
+PASS foo(0, 0, -2147483647-1, -1) is -2147483647-1
+PASS foo(0, 0, -2147483647-1, -1) is -2147483647-1
+PASS foo(0, 0, -2147483647-1, -1) is -2147483647-1
+PASS foo(0, 0, -2147483647-1, -1) is -2147483647-1
+PASS foo(0, 0, -2147483647-1, -1) is -2147483647-1
+PASS foo(0, 0, -2147483647-1, -1) is -2147483647-1
+PASS foo(0, 0, -2147483647-1, -1) is -2147483647-1
+PASS foo(0, 0, -2147483647-1, -1) is -2147483647-1
+PASS foo(0, 0, -2147483647-1, -1) is -2147483647-1
+PASS foo(0, 0, -2147483647-1, -1) is -2147483647-1
+PASS foo(0, 0, -2147483647-1, -1) is -2147483647-1
+PASS foo(0, 0, -2147483647-1, -1) is -2147483647-1
+PASS foo(0, 0, -2147483647-1, -1) is -2147483647-1
+PASS foo(0, 0, -2147483647-1, -1) is -2147483647-1
+PASS foo(0, 0, -2147483647-1, -1) is -2147483647-1
+PASS foo(0, 0, -2147483647-1, -1) is -2147483647-1
+PASS foo(0, 0, -2147483647-1, -1) is -2147483647-1
+PASS foo(0, 0, -2147483647-1, -1) is -2147483647-1
+PASS foo(0, 0, -2147483647-1, -1) is -2147483647-1
+PASS foo(0, 0, -2147483647-1, -1) is -2147483647-1
+PASS foo(0, 0, -2147483647-1, -1) is -2147483647-1
+PASS foo(0, 0, -2147483647-1, -1) is -2147483647-1
+PASS foo(0, 0, -2147483647-1, -1) is -2147483647-1
+PASS foo(0, 0, -2147483647-1, -1) is -2147483647-1
+PASS foo(0, 0, -2147483647-1, -1) is -2147483647-1
+PASS foo(0, 0, -2147483647-1, -1) is -2147483647-1
+PASS foo(0, 0, -2147483647-1, -1) is -2147483647-1
+PASS foo(0, 0, -2147483647-1, -1) is -2147483647-1
+PASS foo(0, 0, -2147483647-1, -1) is -2147483647-1
+PASS foo(0, 0, -2147483647-1, -1) is -2147483647-1
+PASS foo(0, 0, -2147483647-1, -1) is -2147483647-1
+PASS foo(0, 0, -2147483647-1, -1) is -2147483647-1
+PASS foo(0, 0, -2147483647-1, -1) is -2147483647-1
+PASS foo(0, 0, -2147483647-1, -1) is -2147483647-1
+PASS foo(0, 0, -2147483647-1, -1) is -2147483647-1
+PASS foo(0, 0, -2147483647-1, -1) is -2147483647-1
+PASS foo(0, 0, -2147483647-1, -1) is -2147483647-1
+PASS foo(0, 0, -2147483647-1, -1) is -2147483647-1
+PASS foo(0, 0, -2147483647-1, -1) is -2147483647-1
+PASS foo(0, 0, -2147483647-1, -1) is -2147483647-1
+PASS foo(0, 0, -2147483647-1, -1) is -2147483647-1
+PASS foo(0, 0, -2147483647-1, -1) is -2147483647-1
+PASS foo(0, 0, -2147483647-1, -1) is -2147483647-1
+PASS foo(0, 0, -2147483647-1, -1) is -2147483647-1
+PASS foo(0, 0, -2147483647-1, -1) is -2147483647-1
+PASS foo(0, 0, -2147483647-1, -1) is -2147483647-1
+PASS foo(0, 0, -2147483647-1, -1) is -2147483647-1
+PASS foo(0, 0, -2147483647-1, -1) is -2147483647-1
+PASS foo(0, 0, -2147483647-1, -1) is -2147483647-1
+PASS foo(0, 0, -2147483647-1, -1) is -2147483647-1
+PASS foo(0, 0, -2147483647-1, -1) is -2147483647-1
+PASS foo(0, 0, -2147483647-1, -1) is -2147483647-1
+PASS foo(0, 0, -2147483647-1, -1) is -2147483647-1
+PASS foo(0, 0, -2147483647-1, -1) is -2147483647-1
+PASS foo(0, 0, -2147483647-1, -1) is -2147483647-1
+PASS foo(0, 0, -2147483647-1, -1) is -2147483647-1
+PASS foo(0, 0, -2147483647-1, -1) is -2147483647-1
+PASS foo(0, 0, -2147483647-1, -1) is -2147483647-1
+PASS foo(0, 0, -2147483647-1, -1) is -2147483647-1
+PASS foo(0, 0, -2147483647-1, -1) is -2147483647-1
+PASS foo(0, 0, -2147483647-1, -1) is -2147483647-1
+PASS foo(0, 0, -2147483647-1, -1) is -2147483647-1
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
Added: trunk/LayoutTests/fast/js/dfg-div-neg2tothe31-by-one-and-then-or-zero-with-interesting-reg-alloc.html (0 => 150694)
--- trunk/LayoutTests/fast/js/dfg-div-neg2tothe31-by-one-and-then-or-zero-with-interesting-reg-alloc.html (rev 0)
+++ trunk/LayoutTests/fast/js/dfg-div-neg2tothe31-by-one-and-then-or-zero-with-interesting-reg-alloc.html 2013-05-25 23:31:20 UTC (rev 150694)
@@ -0,0 +1,10 @@
+<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
+<html>
+<head>
+<script src=""
+</head>
+<body>
+<script src=""
+<script src=""
+</body>
+</html>
Modified: trunk/LayoutTests/fast/js/jsc-test-list (150693 => 150694)
--- trunk/LayoutTests/fast/js/jsc-test-list 2013-05-25 23:13:15 UTC (rev 150693)
+++ trunk/LayoutTests/fast/js/jsc-test-list 2013-05-25 23:31:20 UTC (rev 150694)
@@ -128,6 +128,9 @@
fast/js/dfg-dead-speculation
fast/js/dfg-dead-unreachable-code-with-chain-of-dead-unchecked-nodes
fast/js/dfg-dead-variable-on-exit
+fast/js/dfg-div-by-zero-and-then-or-zero-interesting-reg-alloc
+fast/js/dfg-div-by-neg1-and-then-or-zero-interesting-reg-alloc
+fast/js/dfg-div-neg2tothe31-by-one-and-then-or-zero-with-interesting-reg-alloc
fast/js/dfg-double-addition-simplify-to-int
fast/js/dfg-double-use-of-post-simplification-double-prediction
fast/js/dfg-double-vote-fuzz
Added: trunk/LayoutTests/fast/js/script-tests/dfg-div-by-neg1-and-then-or-zero-interesting-reg-alloc.js (0 => 150694)
--- trunk/LayoutTests/fast/js/script-tests/dfg-div-by-neg1-and-then-or-zero-interesting-reg-alloc.js (rev 0)
+++ trunk/LayoutTests/fast/js/script-tests/dfg-div-by-neg1-and-then-or-zero-interesting-reg-alloc.js 2013-05-25 23:31:20 UTC (rev 150694)
@@ -0,0 +1,11 @@
+description(
+"Tests that the (x/-1)|0 case in the DFG is handled correctly even when there is some interesting register allocation going on."
+);
+
+function foo(c, d, a, b) {
+ return (c + d) + ((a / b) | 0);
+}
+
+for (var i = 0; i < 100; ++i)
+ shouldBe("foo(0, 0, " + i + ", -1)", "-" + i);
+
Added: trunk/LayoutTests/fast/js/script-tests/dfg-div-by-zero-and-then-or-zero-interesting-reg-alloc.js (0 => 150694)
--- trunk/LayoutTests/fast/js/script-tests/dfg-div-by-zero-and-then-or-zero-interesting-reg-alloc.js (rev 0)
+++ trunk/LayoutTests/fast/js/script-tests/dfg-div-by-zero-and-then-or-zero-interesting-reg-alloc.js 2013-05-25 23:31:20 UTC (rev 150694)
@@ -0,0 +1,11 @@
+description(
+"Tests that the (x/0)|0 case in the DFG is handled correctly even when there is some interesting register allocation going on."
+);
+
+function foo(c, d, a, b) {
+ return (c + d) + ((a / b) | 0);
+}
+
+for (var i = 0; i < 100; ++i)
+ shouldBe("foo(0, 0, " + i + ", 0)", "0");
+
Added: trunk/LayoutTests/fast/js/script-tests/dfg-div-neg2tothe31-by-one-and-then-or-zero-with-interesting-reg-alloc.js (0 => 150694)
--- trunk/LayoutTests/fast/js/script-tests/dfg-div-neg2tothe31-by-one-and-then-or-zero-with-interesting-reg-alloc.js (rev 0)
+++ trunk/LayoutTests/fast/js/script-tests/dfg-div-neg2tothe31-by-one-and-then-or-zero-with-interesting-reg-alloc.js 2013-05-25 23:31:20 UTC (rev 150694)
@@ -0,0 +1,11 @@
+description(
+"Tests that the (-2147483648/-1)|0 case in the DFG is handled correctly even when there is some interesting register allocation going on."
+);
+
+function foo(c, d, a, b) {
+ return (c + d) + ((a / b) | 0);
+}
+
+for (var i = 0; i < 100; ++i)
+ shouldBe("foo(0, 0, -2147483647-1, -1)", "-2147483647-1");
+
Modified: trunk/Source/_javascript_Core/ChangeLog (150693 => 150694)
--- trunk/Source/_javascript_Core/ChangeLog 2013-05-25 23:13:15 UTC (rev 150693)
+++ trunk/Source/_javascript_Core/ChangeLog 2013-05-25 23:31:20 UTC (rev 150694)
@@ -1,3 +1,16 @@
+2013-05-25 Filip Pizlo <[email protected]>
+
+ We broke (-2^31/-1)|0 in the DFG
+ https://bugs.webkit.org/show_bug.cgi?id=116767
+
+ Reviewed by Andreas Kling.
+
+ The bug is that we were assuming that in the -2^31 case, we already had -2^31
+ in the result register. This was a wrong assumption.
+
+ * dfg/DFGSpeculativeJIT.cpp:
+ (JSC::DFG::SpeculativeJIT::compileIntegerArithDivForX86):
+
2013-05-24 Filip Pizlo <[email protected]>
We broke !(0/0)
Modified: trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT.cpp (150693 => 150694)
--- trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT.cpp 2013-05-25 23:13:15 UTC (rev 150693)
+++ trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT.cpp 2013-05-25 23:31:20 UTC (rev 150694)
@@ -3432,21 +3432,33 @@
JITCompiler::Jump safeDenominator = m_jit.branch32(JITCompiler::Above, temp, JITCompiler::TrustedImm32(1));
- JITCompiler::Jump done;
+ JITCompiler::JumpList done;
if (nodeUsedAsNumber(node->arithNodeFlags())) {
speculationCheck(Overflow, JSValueRegs(), 0, m_jit.branchTest32(JITCompiler::Zero, op2GPR));
speculationCheck(Overflow, JSValueRegs(), 0, m_jit.branch32(JITCompiler::Equal, op1GPR, TrustedImm32(-2147483647-1)));
} else {
- JITCompiler::Jump zero = m_jit.branchTest32(JITCompiler::Zero, op2GPR);
- JITCompiler::Jump isNeg2ToThe31 = m_jit.branch32(JITCompiler::Equal, op1GPR, TrustedImm32(-2147483647-1));
- zero.link(&m_jit);
+ // This is the case where we convert the result to an int after we're done, and we
+ // already know that the denominator is either -1 or 0. So, if the denominator is
+ // zero, then the result should be zero. If the denominator is not zero (i.e. it's
+ // -1) and the numerator is -2^31 then the result should be -2^31. Otherwise we
+ // are happy to fall through to a normal division, since we're just dividing
+ // something by negative 1.
+
+ JITCompiler::Jump notZero = m_jit.branchTest32(JITCompiler::NonZero, op2GPR);
m_jit.move(TrustedImm32(0), eax.gpr());
- isNeg2ToThe31.link(&m_jit);
- done = m_jit.jump();
+ done.append(m_jit.jump());
+
+ notZero.link(&m_jit);
+ JITCompiler::Jump notNeg2ToThe31 =
+ m_jit.branch32(JITCompiler::NotEqual, op1GPR, TrustedImm32(-2147483647-1));
+ m_jit.move(op1GPR, eax.gpr());
+ done.append(m_jit.jump());
+
+ notNeg2ToThe31.link(&m_jit);
}
safeDenominator.link(&m_jit);
-
+
// If the user cares about negative zero, then speculate that we're not about
// to produce negative zero.
if (!nodeCanIgnoreNegativeZero(node->arithNodeFlags())) {
