Changeset 116455 in webkit for trunk/Source/JavaScriptCore/interpreter/Interpreter.cpp

Timestamp:

May 8, 2012, 2:52:11 PM (13 years ago)

Author:

[email protected]

Message:

SIGFPE on divide in classic interpreter
​https://bugs.webkit.org/show_bug.cgi?id=85917

Rubber stamped by Oliver Hunt.

• interpreter/Interpreter.cpp:

(JSC::Interpreter::privateExecute):

• check for divisor of -1.

File:

• trunk/Source/JavaScriptCore/interpreter/Interpreter.cpp (modified) (1 diff)

trunk/Source/JavaScriptCore/interpreter/Interpreter.cpp

@@ -2449 +2449 @@
         JSValue divisor = callFrame->r(vPC[3].u.operand).jsValue();
 
-        if (dividend.isInt32() && divisor.isInt32() && divisor.asInt32() != 0) {
+        if (dividend.isInt32() && divisor.isInt32() && divisor.asInt32() != 0 && divisor.asInt32() != -1) {
             JSValue result = jsNumber(dividend.asInt32() % divisor.asInt32());
             ASSERT(result);