Title: [155220] trunk
- Revision
- 155220
- Author
- [email protected]
- Date
- 2013-09-06 15:34:29 -0700 (Fri, 06 Sep 2013)
Log Message
FTL ArithNeg Int32Use doesn't check negative zero
https://bugs.webkit.org/show_bug.cgi?id=120900
Reviewed by Mark Hahnenberg.
Source/_javascript_Core:
* ftl/FTLLowerDFGToLLVM.cpp:
(JSC::FTL::LowerDFGToLLVM::compileArithNegate):
LayoutTests:
* fast/js/regress/script-tests/negative-zero-modulo.js:
Modified Paths
Diff
Modified: trunk/LayoutTests/ChangeLog (155219 => 155220)
--- trunk/LayoutTests/ChangeLog 2013-09-06 22:32:08 UTC (rev 155219)
+++ trunk/LayoutTests/ChangeLog 2013-09-06 22:34:29 UTC (rev 155220)
@@ -1,3 +1,12 @@
+2013-09-06 Filip Pizlo <[email protected]>
+
+ FTL ArithNeg Int32Use doesn't check negative zero
+ https://bugs.webkit.org/show_bug.cgi?id=120900
+
+ Reviewed by Mark Hahnenberg.
+
+ * fast/js/regress/script-tests/negative-zero-modulo.js:
+
2013-09-06 Mike West <[email protected]>
Revalidation header blacklisting should be case-insensitive.
Modified: trunk/LayoutTests/fast/js/regress/script-tests/negative-zero-modulo.js (155219 => 155220)
--- trunk/LayoutTests/fast/js/regress/script-tests/negative-zero-modulo.js 2013-09-06 22:32:08 UTC (rev 155219)
+++ trunk/LayoutTests/fast/js/regress/script-tests/negative-zero-modulo.js 2013-09-06 22:34:29 UTC (rev 155220)
@@ -14,5 +14,5 @@
var y = foo().toString();
if (x != y)
- throw "Error: bad result: " + y;
+ throw "Error: bad result: " + y + " (expected " + x + ")";
Modified: trunk/Source/_javascript_Core/ChangeLog (155219 => 155220)
--- trunk/Source/_javascript_Core/ChangeLog 2013-09-06 22:32:08 UTC (rev 155219)
+++ trunk/Source/_javascript_Core/ChangeLog 2013-09-06 22:34:29 UTC (rev 155220)
@@ -1,3 +1,13 @@
+2013-09-06 Filip Pizlo <[email protected]>
+
+ FTL ArithNeg Int32Use doesn't check negative zero
+ https://bugs.webkit.org/show_bug.cgi?id=120900
+
+ Reviewed by Mark Hahnenberg.
+
+ * ftl/FTLLowerDFGToLLVM.cpp:
+ (JSC::FTL::LowerDFGToLLVM::compileArithNegate):
+
2013-09-06 Anders Carlsson <[email protected]>
Stop using fastNew/fastDelete in _javascript_Core
Modified: trunk/Source/_javascript_Core/ftl/FTLLowerDFGToLLVM.cpp (155219 => 155220)
--- trunk/Source/_javascript_Core/ftl/FTLLowerDFGToLLVM.cpp 2013-09-06 22:32:08 UTC (rev 155219)
+++ trunk/Source/_javascript_Core/ftl/FTLLowerDFGToLLVM.cpp 2013-09-06 22:34:29 UTC (rev 155220)
@@ -984,6 +984,7 @@
LValue overflowResult = m_out.subWithOverflow32(m_out.int32Zero, value);
speculate(Overflow, noValue(), 0, m_out.extractValue(overflowResult, 1));
result = m_out.extractValue(overflowResult, 0);
+ speculate(NegativeZero, noValue(), 0, m_out.isZero32(result));
}
setInt32(result);
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
