Changeset 87702 in webkit

Timestamp:

May 30, 2011 4:49:51 PM (13 years ago)

Author:

commit-queue@webkit.org

Message:

2011-05-30 Hojong Han <​hojong.han@samsung.com>

Reviewed by Geoffrey Garen.

[JSC] malfunction during arithmetic condition check with negative number (-2147483648)
​https://bugs.webkit.org/show_bug.cgi?id=61416

• assembler/MacroAssemblerARM.h: (JSC::MacroAssemblerARM::branch32):
• tests/mozilla/ecma/Expressions/11.12-1.js: (getTestCases):

Location:

trunk/Source/JavaScriptCore

Files:

• ChangeLog (modified) (1 diff)
• assembler/MacroAssemblerARM.h (modified) (1 diff)
• tests/mozilla/ecma/Expressions/11.12-1.js (modified) (1 diff)

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2011-05-30  Hojong Han  <hojong.han@samsung.com>
+
+        Reviewed by Geoffrey Garen.
+
+        [JSC] malfunction during arithmetic condition check with negative number (-2147483648)
+        https://bugs.webkit.org/show_bug.cgi?id=61416
+
+        * assembler/MacroAssemblerARM.h:
+        (JSC::MacroAssemblerARM::branch32):
+        * tests/mozilla/ecma/Expressions/11.12-1.js:
+        (getTestCases):
+
 2011-05-29  Geoffrey Garen  <ggaren@apple.com>
 

trunk/Source/JavaScriptCore/assembler/MacroAssemblerARM.h

@@ -417 +417 @@
             m_assembler.cmp_r(left, ARMRegisters::S0);
         } else {
-            ARMWord tmp = m_assembler.getOp2(-right.m_value);
+            ARMWord tmp = (right.m_value == 0x80000000) ? ARMAssembler::INVALID_IMM : m_assembler.getOp2(-right.m_value);
             if (tmp != ARMAssembler::INVALID_IMM)
                 m_assembler.cmn_r(left, tmp);

trunk/Source/JavaScriptCore/tests/mozilla/ecma/Expressions/11.12-1.js

@@ -70 +70 @@
     array[item++] = new TestCase( SECTION,    "var VAR = true ? , : 'FAILED'", "PASSED",           (VAR = true ? "PASSED" : "FAILED") );
 
+    array[item++] = new TestCase( SECTION,    "item = " + item +"; VAR = (item < -2147483648) ? 'FAILED' : 'PASSED'", "PASSED",           (VAR = (item < -2147483648) ? "FAILED" : "PASSED") );
+
     return ( array );
 }