Changeset 93298 in webkit for trunk/Source/JavaScriptCore

Timestamp:

Aug 18, 2011, 4:47:26 AM (14 years ago)

Author:

[email protected]

Message:

[jsfunfuzz] DFG speculative JIT does divide-by-zero checks incorrectly
​https://bugs.webkit.org/show_bug.cgi?id=66426

Source/JavaScriptCore:

Reviewed by Oliver Hunt.

Changed the branchTestPtr to branchTest32.

• dfg/DFGSpeculativeJIT.cpp:

(JSC::DFG::SpeculativeJIT::compile):

LayoutTests:

Reviewed by Oliver Hunt.

Added a trivial test of mod-by-zero, which fails with the previous version
of the DFG speculative JIT.

• fast/js/mod-by-zero-expected.txt: Added.
• fast/js/mod-by-zero.html: Added.
• fast/js/script-tests/mod-by-zero.js: Added.

(mod):

Location:

trunk/Source/JavaScriptCore

Files:

• ChangeLog (modified) (1 diff)
• dfg/DFGSpeculativeJIT.cpp (modified) (1 diff)

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2011-08-18  Filip Pizlo  <[email protected]>
+
+        [jsfunfuzz] DFG speculative JIT does divide-by-zero checks incorrectly
+        https://bugs.webkit.org/show_bug.cgi?id=66426
+
+        Reviewed by Oliver Hunt.
+        
+        Changed the branchTestPtr to branchTest32.
+
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+
 2011-08-17  Thouraya ANDOLSI  <[email protected]>
 

trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp

@@ -813 +813 @@
         GPRReg op2Gpr = op2.gpr();
 
-        speculationCheck(m_jit.branchTestPtr(JITCompiler::Zero, op2Gpr));
+        speculationCheck(m_jit.branchTest32(JITCompiler::Zero, op2Gpr));
 
         GPRReg temp2 = InvalidGPRReg;