Changeset 93298 in webkit

Timestamp:

Aug 18, 2011 4:47:26 AM (13 years ago)

Author:

fpizlo@apple.com

Message:

[jsfunfuzz] DFG speculative JIT does divide-by-zero checks incorrectly
​https://bugs.webkit.org/show_bug.cgi?id=66426

Source/JavaScriptCore:

Reviewed by Oliver Hunt.

Changed the branchTestPtr to branchTest32.

• dfg/DFGSpeculativeJIT.cpp:

(JSC::DFG::SpeculativeJIT::compile):

LayoutTests:

Reviewed by Oliver Hunt.

Added a trivial test of mod-by-zero, which fails with the previous version
of the DFG speculative JIT.

• fast/js/mod-by-zero-expected.txt: Added.
• fast/js/mod-by-zero.html: Added.
• fast/js/script-tests/mod-by-zero.js: Added.

(mod):

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/fast/js/mod-by-zero-expected.txt (added)
• LayoutTests/fast/js/mod-by-zero.html (added)
• LayoutTests/fast/js/script-tests/mod-by-zero.js (added)
• Source/JavaScriptCore/ChangeLog (modified) (1 diff)
• Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp (modified) (1 diff)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2011-08-18  Filip Pizlo  <fpizlo@apple.com>
+
+        [jsfunfuzz] DFG speculative JIT does divide-by-zero checks incorrectly
+        https://bugs.webkit.org/show_bug.cgi?id=66426
+
+        Reviewed by Oliver Hunt.
+        
+        Added a trivial test of mod-by-zero, which fails with the previous version
+        of the DFG speculative JIT.
+
+        * fast/js/mod-by-zero-expected.txt: Added.
+        * fast/js/mod-by-zero.html: Added.
+        * fast/js/script-tests/mod-by-zero.js: Added.
+        (mod):
+
 2011-08-18  Steve Block  <steveblock@google.com>
 

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2011-08-18  Filip Pizlo  <fpizlo@apple.com>
+
+        [jsfunfuzz] DFG speculative JIT does divide-by-zero checks incorrectly
+        https://bugs.webkit.org/show_bug.cgi?id=66426
+
+        Reviewed by Oliver Hunt.
+        
+        Changed the branchTestPtr to branchTest32.
+
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+
 2011-08-17  Thouraya ANDOLSI  <thouraya.andolsi@st.com>
 

trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp

@@ -813 +813 @@
         GPRReg op2Gpr = op2.gpr();
 
-        speculationCheck(m_jit.branchTestPtr(JITCompiler::Zero, op2Gpr));
+        speculationCheck(m_jit.branchTest32(JITCompiler::Zero, op2Gpr));
 
         GPRReg temp2 = InvalidGPRReg;