Changeset 161438 in webkit for trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp

Timestamp:

Jan 7, 2014, 11:14:59 AM (12 years ago)

Author:

[email protected]

Message:

ASSERT in compileArithNegate on pdfjs
​https://bugs.webkit.org/show_bug.cgi?id=126584

Reviewed by Mark Hahnenberg.

Check negative zero when we should check it, not when we shouldn't check it. :-/

• dfg/DFGSpeculativeJIT.cpp:

(JSC::DFG::SpeculativeJIT::compileArithNegate):

File:

• trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp (modified) (2 diffs)

trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp

@@ -2901 +2901 @@
             m_jit.move(op1GPR, resultGPR);
             m_jit.neg64(resultGPR);
-            if (!shouldCheckNegativeZero(node->arithMode())) {
+            if (shouldCheckNegativeZero(node->arithMode())) {
                 speculationCheck(
                     NegativeZero, JSValueRegs(), 0,
@@ -2918 +2918 @@
             Int52Overflow, JSValueRegs(), 0,
             m_jit.branchNeg64(MacroAssembler::Overflow, resultGPR));
-        if (!shouldCheckNegativeZero(node->arithMode())) {
+        if (shouldCheckNegativeZero(node->arithMode())) {
             speculationCheck(
                 NegativeZero, JSValueRegs(), 0,