Title: [161438] trunk/Source/_javascript_Core
- Revision
- 161438
- Author
- fpi...@apple.com
- Date
- 2014-01-07 11:14:59 -0800 (Tue, 07 Jan 2014)
Log Message
ASSERT in compileArithNegate on pdfjs
https://bugs.webkit.org/show_bug.cgi?id=126584
Reviewed by Mark Hahnenberg.
Check negative zero when we should check it, not when we shouldn't check it. :-/
* dfg/DFGSpeculativeJIT.cpp:
(JSC::DFG::SpeculativeJIT::compileArithNegate):
Modified Paths
Diff
Modified: trunk/Source/_javascript_Core/ChangeLog (161437 => 161438)
--- trunk/Source/_javascript_Core/ChangeLog 2014-01-07 19:10:51 UTC (rev 161437)
+++ trunk/Source/_javascript_Core/ChangeLog 2014-01-07 19:14:59 UTC (rev 161438)
@@ -1,3 +1,15 @@
+2014-01-07 Filip Pizlo <fpi...@apple.com>
+
+ ASSERT in compileArithNegate on pdfjs
+ https://bugs.webkit.org/show_bug.cgi?id=126584
+
+ Reviewed by Mark Hahnenberg.
+
+ Check negative zero when we should check it, not when we shouldn't check it. :-/
+
+ * dfg/DFGSpeculativeJIT.cpp:
+ (JSC::DFG::SpeculativeJIT::compileArithNegate):
+
2014-01-07 Gabor Rapcsanyi <rga...@webkit.org>
pushFinallyContext saves wrong m_labelScopes size
Modified: trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT.cpp (161437 => 161438)
--- trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT.cpp 2014-01-07 19:10:51 UTC (rev 161437)
+++ trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT.cpp 2014-01-07 19:14:59 UTC (rev 161438)
@@ -2900,7 +2900,7 @@
GPRReg resultGPR = result.gpr();
m_jit.move(op1GPR, resultGPR);
m_jit.neg64(resultGPR);
- if (!shouldCheckNegativeZero(node->arithMode())) {
+ if (shouldCheckNegativeZero(node->arithMode())) {
speculationCheck(
NegativeZero, JSValueRegs(), 0,
m_jit.branchTest64(MacroAssembler::Zero, resultGPR));
@@ -2917,7 +2917,7 @@
speculationCheck(
Int52Overflow, JSValueRegs(), 0,
m_jit.branchNeg64(MacroAssembler::Overflow, resultGPR));
- if (!shouldCheckNegativeZero(node->arithMode())) {
+ if (shouldCheckNegativeZero(node->arithMode())) {
speculationCheck(
NegativeZero, JSValueRegs(), 0,
m_jit.branchTest64(MacroAssembler::Zero, resultGPR));
_______________________________________________
webkit-changes mailing list
webkit-changes@lists.webkit.org
https://lists.webkit.org/mailman/listinfo/webkit-changes
