Diff
Modified: trunk/LayoutTests/ChangeLog (156211 => 156212)
--- trunk/LayoutTests/ChangeLog 2013-09-21 00:00:30 UTC (rev 156211)
+++ trunk/LayoutTests/ChangeLog 2013-09-21 00:07:07 UTC (rev 156212)
@@ -1,3 +1,15 @@
+2013-09-20 Filip Pizlo <[email protected]>
+
+ REGRESSION(r156047): WebCore hangs inside JSC::toInt32(double)
+ https://bugs.webkit.org/show_bug.cgi?id=121648
+
+ Reviewed by Mark Hahnenberg.
+
+ * js/dfg-int52-change-format-expected.txt: Added.
+ * js/dfg-int52-change-format.html: Added.
+ * js/script-tests/dfg-int52-change-format.js: Added.
+ (foo):
+
2013-09-20 Oliver Hunt <[email protected]>
REGRESSION(r153215): New iCloud site crashes
Added: trunk/LayoutTests/js/dfg-int52-change-format-expected.txt (0 => 156212)
--- trunk/LayoutTests/js/dfg-int52-change-format-expected.txt (rev 0)
+++ trunk/LayoutTests/js/dfg-int52-change-format-expected.txt 2013-09-21 00:07:07 UTC (rev 156212)
@@ -0,0 +1,5 @@
+PASS foo(1000000000) is [4000000000,8000000000,-147483648,12000000000] on all iterations including after DFG tier-up.
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
Added: trunk/LayoutTests/js/dfg-int52-change-format.html (0 => 156212)
--- trunk/LayoutTests/js/dfg-int52-change-format.html (rev 0)
+++ trunk/LayoutTests/js/dfg-int52-change-format.html 2013-09-21 00:07:07 UTC (rev 156212)
@@ -0,0 +1,10 @@
+<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
+<html>
+<head>
+<script src=""
+</head>
+<body>
+<script src=""
+<script src=""
+</body>
+</html>
Added: trunk/LayoutTests/js/script-tests/dfg-int52-change-format.js (0 => 156212)
--- trunk/LayoutTests/js/script-tests/dfg-int52-change-format.js (rev 0)
+++ trunk/LayoutTests/js/script-tests/dfg-int52-change-format.js 2013-09-21 00:07:07 UTC (rev 156212)
@@ -0,0 +1,14 @@
+function foo(a) {
+ // Create an int52.
+ var x = a + 3000000000;
+ // Make sure it's left-shifted.
+ var y = x + x;
+ // Now get it to be right-shifted.
+ var z = x >> 1;
+ // And finally, do something that prefers left-shift.
+ var w = y + x;
+ return [x, y, z, w];
+}
+
+dfgShouldBe(foo, "foo(1000000000)", "[4000000000,8000000000,-147483648,12000000000]");
+
Modified: trunk/Source/_javascript_Core/ChangeLog (156211 => 156212)
--- trunk/Source/_javascript_Core/ChangeLog 2013-09-21 00:00:30 UTC (rev 156211)
+++ trunk/Source/_javascript_Core/ChangeLog 2013-09-21 00:07:07 UTC (rev 156212)
@@ -1,3 +1,17 @@
+2013-09-20 Filip Pizlo <[email protected]>
+
+ REGRESSION(r156047): WebCore hangs inside JSC::toInt32(double)
+ https://bugs.webkit.org/show_bug.cgi?id=121648
+
+ Reviewed by Mark Hahnenberg.
+
+ The Int52<->StrictInt52 conversion did the opposite fill() than what it was
+ supposed to. For example when converting a Int52 to a StrictInt52 it would fill
+ as Int52, and vice-versa.
+
+ * dfg/DFGSpeculativeJIT64.cpp:
+ (JSC::DFG::SpeculativeJIT::fillSpeculateInt52):
+
2013-09-20 Oliver Hunt <[email protected]>
REGRESSION(r153215): New iCloud site crashes
Modified: trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT64.cpp (156211 => 156212)
--- trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT64.cpp 2013-09-21 00:00:30 UTC (rev 156211)
+++ trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT64.cpp 2013-09-21 00:07:07 UTC (rev 156212)
@@ -1111,7 +1111,7 @@
unlock(gpr);
gpr = result;
} else
- info.fillStrictInt52(*m_stream, gpr);
+ info.fillInt52(*m_stream, gpr);
m_jit.lshift64(TrustedImm32(JSValue::int52ShiftAmount), gpr);
return gpr;
}
@@ -1128,7 +1128,7 @@
unlock(gpr);
gpr = result;
} else
- info.fillInt52(*m_stream, gpr);
+ info.fillStrictInt52(*m_stream, gpr);
m_jit.rshift64(TrustedImm32(JSValue::int52ShiftAmount), gpr);
return gpr;
}
