Changeset 139835 in webkit

Timestamp:

Jan 15, 2013 9:47:09 PM (11 years ago)

Author:

msaboff@apple.com

Message:

DFG X86: division in the used-as-int case doesn't correctly check for -2^{31/-1
​https://bugs.webkit.org/show_bug.cgi?id=106978}

Reviewed by Filip Pizlo.

Source/JavaScriptCore:

Changed the numerator equal to -2^{31 check to just return if we expect an integer
result, since the check is after we have determined that the denominator is -1.
The int result of -2}31 / -1 is -2^{31, so just return the numerator as the result.}

• dfg/DFGSpeculativeJIT.cpp:

(JSC::DFG::SpeculativeJIT::compileIntegerArithDivForX86):

LayoutTests:

Added a new DFG check for -2^{31 / -1 when we expect and integer result.}

• fast/js/integer-division-neg2tothe32-by-neg1-expected.txt:
• fast/js/script-tests/integer-division-neg2tothe32-by-neg1.js:

(myDivExpectingInt):

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/fast/js/integer-division-neg2tothe32-by-neg1-expected.txt (modified) (1 diff)
• LayoutTests/fast/js/script-tests/integer-division-neg2tothe32-by-neg1.js (modified) (2 diffs)
• Source/JavaScriptCore/ChangeLog (modified) (1 diff)
• Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp (modified) (1 diff)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2013-01-15  Michael Saboff  <msaboff@apple.com>
+
+        DFG X86: division in the used-as-int case doesn't correctly check for -2^31/-1
+        https://bugs.webkit.org/show_bug.cgi?id=106978
+
+        Reviewed by Filip Pizlo.
+
+        Added a new DFG check for -2^31 / -1 when we expect and integer result.
+
+        * fast/js/integer-division-neg2tothe32-by-neg1-expected.txt:
+        * fast/js/script-tests/integer-division-neg2tothe32-by-neg1.js:
+        (myDivExpectingInt):
+
 2013-01-15  Dominic Cooney  <dominicc@chromium.org>
 

trunk/LayoutTests/fast/js/integer-division-neg2tothe32-by-neg1-expected.txt

@@ -2804 +2804 @@
 PASS myOtherModNeg2ToThe31(v) is -0
 PASS myOtherModNeg2ToThe31(3) is -2
+PASS myDivExpectingInt(x, y) is x
 PASS successfullyParsed is true
 

trunk/LayoutTests/fast/js/script-tests/integer-division-neg2tothe32-by-neg1.js

@@ -51 +51 @@
 }
 
+function myDivExpectingInt(a, b) {
+    return (a / b) | 0;
+}
+
 var w = 4;
 var v = 2;
@@ -77 +81 @@
     shouldBe("myOtherModNeg2ToThe31(v)", "-0");
     shouldBe("myOtherModNeg2ToThe31(3)", "-2");
+    shouldBe("myDivExpectingInt(x, y)", "x");
 }
 

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2013-01-15  Michael Saboff  <msaboff@apple.com>
+
+        DFG X86: division in the used-as-int case doesn't correctly check for -2^31/-1
+        https://bugs.webkit.org/show_bug.cgi?id=106978
+
+        Reviewed by Filip Pizlo.
+
+        Changed the numerator equal to -2^31 check to just return if we expect an integer
+        result, since the check is after we have determined that the denominator is -1.
+        The int result of -2^31 / -1 is -2^31, so just return the numerator as the result.
+
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileIntegerArithDivForX86):
+
 2013-01-15  Levi Weintraub  <leviw@chromium.org>
 

trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp

@@ -3319 +3319 @@
     } else {
         JITCompiler::Jump zero = m_jit.branchTest32(JITCompiler::Zero, op2GPR);
-        JITCompiler::Jump notNeg2ToThe31 = m_jit.branch32(JITCompiler::Equal, op1GPR, TrustedImm32(-2147483647-1));
+        JITCompiler::Jump isNeg2ToThe31 = m_jit.branch32(JITCompiler::Equal, op1GPR, TrustedImm32(-2147483647-1));
         zero.link(&m_jit);
         m_jit.move(TrustedImm32(0), eax.gpr());
+        isNeg2ToThe31.link(&m_jit);
         done = m_jit.jump();
-        notNeg2ToThe31.link(&m_jit);
     }