Changeset 199148 in webkit
- Timestamp:
- Apr 6, 2016 9:33:32 PM (8 years ago)
- Location:
- trunk/Source/JavaScriptCore
- Files:
-
- 3 edited
Legend:
- Unmodified
- Added
- Removed
-
trunk/Source/JavaScriptCore/ChangeLog
r199145 r199148 1 2016-04-06 Benjamin Poulain <bpoulain@apple.com> 2 3 [JSC] UInt32ToNumber should be NodeMustGenerate 4 https://bugs.webkit.org/show_bug.cgi?id=156329 5 6 Reviewed by Filip Pizlo. 7 8 It exits on negative numbers on the integer path. 9 10 * dfg/DFGFixupPhase.cpp: 11 (JSC::DFG::FixupPhase::fixupNode): 12 * dfg/DFGNodeType.h: 13 1 14 2016-04-04 Geoffrey Garen <ggaren@apple.com> 2 15 -
trunk/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp
r199128 r199148 142 142 node->setArithMode(Arith::DoOverflow); 143 143 node->setResult(NodeResultDouble); 144 node->clearFlags(NodeMustGenerate); 144 145 } 145 146 break; -
trunk/Source/JavaScriptCore/dfg/DFGNodeType.h
r199128 r199148 120 120 macro(ValueToInt32, NodeResultInt32) \ 121 121 /* Used to box the result of URShift nodes (result has range 0..2^32-1). */\ 122 macro(UInt32ToNumber, NodeResultNumber ) \122 macro(UInt32ToNumber, NodeResultNumber | NodeMustGenerate) \ 123 123 /* Converts booleans to numbers but passes everything else through. */\ 124 124 macro(BooleanToNumber, NodeResultJS) \
Note: See TracChangeset
for help on using the changeset viewer.