Changeset 116455 in webkit

Timestamp:

May 8, 2012, 2:52:11 PM (13 years ago)

Author:

[email protected]

Message:

SIGFPE on divide in classic interpreter
​https://bugs.webkit.org/show_bug.cgi?id=85917

Rubber stamped by Oliver Hunt.

• interpreter/Interpreter.cpp:

(JSC::Interpreter::privateExecute):

• check for divisor of -1.

Location:

trunk/Source/JavaScriptCore

Files:

• ChangeLog (modified) (1 diff)
• interpreter/Interpreter.cpp (modified) (1 diff)

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2012-05-08  Gavin Barraclough  <[email protected]>
+
+        SIGFPE on divide in classic interpreter
+        https://bugs.webkit.org/show_bug.cgi?id=85917
+
+        Rubber stamped by Oliver Hunt.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+            - check for divisor of -1.
+
 2012-05-07  Oliver Hunt  <[email protected]>
 

trunk/Source/JavaScriptCore/interpreter/Interpreter.cpp

@@ -2449 +2449 @@
         JSValue divisor = callFrame->r(vPC[3].u.operand).jsValue();
 
-        if (dividend.isInt32() && divisor.isInt32() && divisor.asInt32() != 0) {
+        if (dividend.isInt32() && divisor.isInt32() && divisor.asInt32() != 0 && divisor.asInt32() != -1) {
             JSValue result = jsNumber(dividend.asInt32() % divisor.asInt32());
             ASSERT(result);