Ignore:
Timestamp:
May 30, 2011, 4:49:51 PM (14 years ago)
Author:
[email protected]
Message:

2011-05-30 Hojong Han <​[email protected]>

Reviewed by Geoffrey Garen.

[JSC] malfunction during arithmetic condition check with negative number (-2147483648)
​https://bugs.webkit.org/show_bug.cgi?id=61416

  • assembler/MacroAssemblerARM.h: (JSC::MacroAssemblerARM::branch32):
  • tests/mozilla/ecma/Expressions/11.12-1.js: (getTestCases):
File:
1 edited

Legend:

Unmodified
Added
Removed

  • trunk/Source/JavaScriptCore/assembler/MacroAssemblerARM.h

    r87356 r87702  
    417417            m_assembler.cmp_r(left, ARMRegisters::S0);
    418418        } else {
    419             ARMWord tmp = m_assembler.getOp2(-right.m_value);
     419            ARMWord tmp = (right.m_value == 0x80000000) ? ARMAssembler::INVALID_IMM : m_assembler.getOp2(-right.m_value);
    420420            if (tmp != ARMAssembler::INVALID_IMM)
    421421                m_assembler.cmn_r(left, tmp);
Note: See TracChangeset for help on using the changeset viewer.