[webkit-changes] [155222] trunk/Source/JavaScriptCore

[fpizlo]

Title: [155222] trunk/Source/_javascript_Core

Revision

155222

Author

fpi...@apple.com

Date

2013-09-06 16:05:00 -0700 (Fri, 06 Sep 2013)

Log Message

FTL ArithMod Int32Use doesn't check for negative zero correctly
https://bugs.webkit.org/show_bug.cgi?id=120905

Reviewed by Mark Hahnenberg.

* ftl/FTLLowerDFGToLLVM.cpp:
(JSC::FTL::LowerDFGToLLVM::compileArithMod):

Modified Paths

• trunk/Source/_javascript_Core/ChangeLog
• trunk/Source/_javascript_Core/ftl/FTLLowerDFGToLLVM.cpp

Diff

Modified: trunk/Source/_javascript_Core/ChangeLog (155221 => 155222)

--- trunk/Source/_javascript_Core/ChangeLog	2013-09-06 23:04:13 UTC (rev 155221)
+++ trunk/Source/_javascript_Core/ChangeLog	2013-09-06 23:05:00 UTC (rev 155222)
@@ -1,5 +1,15 @@
 2013-09-06  Filip Pizlo  <fpi...@apple.com>
 
+        FTL ArithMod Int32Use doesn't check for negative zero correctly
+        https://bugs.webkit.org/show_bug.cgi?id=120905
+
+        Reviewed by Mark Hahnenberg.
+
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::compileArithMod):
+
+2013-09-06  Filip Pizlo  <fpi...@apple.com>
+
         FTL ArithNeg Int32Use doesn't check negative zero
         https://bugs.webkit.org/show_bug.cgi?id=120900
 

Modified: trunk/Source/_javascript_Core/ftl/FTLLowerDFGToLLVM.cpp (155221 => 155222)

--- trunk/Source/_javascript_Core/ftl/FTLLowerDFGToLLVM.cpp	2013-09-06 23:04:13 UTC (rev 155221)
+++ trunk/Source/_javascript_Core/ftl/FTLLowerDFGToLLVM.cpp	2013-09-06 23:05:00 UTC (rev 155222)
@@ -855,23 +855,26 @@
             
             m_out.appendTo(continuation, done);
             
+            LValue remainder = m_out.rem(numerator, denominator);
+            
             if (!nodeCanIgnoreNegativeZero(m_node->arithNodeFlags())) {
-                LBasicBlock zeroNumerator = FTL_NEW_BLOCK(m_out, ("ArithMod zero numerator"));
+                LBasicBlock negativeNumerator = FTL_NEW_BLOCK(m_out, ("ArithMod negative numerator"));
                 LBasicBlock numeratorContinuation = FTL_NEW_BLOCK(m_out, ("ArithMod numerator continuation"));
                 
-                m_out.branch(m_out.isZero32(numerator), zeroNumerator, numeratorContinuation);
+                m_out.branch(
+                    m_out.lessThan(numerator, m_out.int32Zero),
+                    negativeNumerator, numeratorContinuation);
                 
-                LBasicBlock innerLastNext = m_out.appendTo(zeroNumerator, numeratorContinuation);
+                LBasicBlock innerLastNext = m_out.appendTo(negativeNumerator, numeratorContinuation);
                 
-                speculate(
-                    NegativeZero, noValue(), 0, m_out.lessThan(denominator, m_out.int32Zero));
+                speculate(NegativeZero, noValue(), 0, m_out.isZero32(remainder));
                 
                 m_out.jump(numeratorContinuation);
                 
                 m_out.appendTo(numeratorContinuation, innerLastNext);
             }
             
-            results.append(m_out.anchor(m_out.rem(numerator, denominator)));
+            results.append(m_out.anchor(remainder));
             m_out.jump(done);
             
             m_out.appendTo(done, lastNext);

_______________________________________________
webkit-changes mailing list
webkit-changes@lists.webkit.org
https://lists.webkit.org/mailman/listinfo/webkit-changes