Title: [87702] trunk/Source/_javascript_Core
- Revision
- 87702
- Author
- commit-qu...@webkit.org
- Date
- 2011-05-30 16:49:51 -0700 (Mon, 30 May 2011)
Log Message
2011-05-30 Hojong Han <hojong....@samsung.com>
Reviewed by Geoffrey Garen.
[JSC] malfunction during arithmetic condition check with negative number (-2147483648)
https://bugs.webkit.org/show_bug.cgi?id=61416
* assembler/MacroAssemblerARM.h:
(JSC::MacroAssemblerARM::branch32):
* tests/mozilla/ecma/Expressions/11.12-1.js:
(getTestCases):
Modified Paths
Diff
Modified: trunk/Source/_javascript_Core/ChangeLog (87701 => 87702)
--- trunk/Source/_javascript_Core/ChangeLog 2011-05-30 23:43:58 UTC (rev 87701)
+++ trunk/Source/_javascript_Core/ChangeLog 2011-05-30 23:49:51 UTC (rev 87702)
@@ -1,3 +1,15 @@
+2011-05-30 Hojong Han <hojong....@samsung.com>
+
+ Reviewed by Geoffrey Garen.
+
+ [JSC] malfunction during arithmetic condition check with negative number (-2147483648)
+ https://bugs.webkit.org/show_bug.cgi?id=61416
+
+ * assembler/MacroAssemblerARM.h:
+ (JSC::MacroAssemblerARM::branch32):
+ * tests/mozilla/ecma/Expressions/11.12-1.js:
+ (getTestCases):
+
2011-05-29 Geoffrey Garen <gga...@apple.com>
Reviewed by Sam Weinig.
Modified: trunk/Source/_javascript_Core/assembler/MacroAssemblerARM.h (87701 => 87702)
--- trunk/Source/_javascript_Core/assembler/MacroAssemblerARM.h 2011-05-30 23:43:58 UTC (rev 87701)
+++ trunk/Source/_javascript_Core/assembler/MacroAssemblerARM.h 2011-05-30 23:49:51 UTC (rev 87702)
@@ -416,7 +416,7 @@
m_assembler.ldr_un_imm(ARMRegisters::S0, right.m_value);
m_assembler.cmp_r(left, ARMRegisters::S0);
} else {
- ARMWord tmp = m_assembler.getOp2(-right.m_value);
+ ARMWord tmp = (right.m_value == 0x80000000) ? ARMAssembler::INVALID_IMM : m_assembler.getOp2(-right.m_value);
if (tmp != ARMAssembler::INVALID_IMM)
m_assembler.cmn_r(left, tmp);
else
Modified: trunk/Source/_javascript_Core/tests/mozilla/ecma/Expressions/11.12-1.js (87701 => 87702)
--- trunk/Source/_javascript_Core/tests/mozilla/ecma/Expressions/11.12-1.js 2011-05-30 23:43:58 UTC (rev 87701)
+++ trunk/Source/_javascript_Core/tests/mozilla/ecma/Expressions/11.12-1.js 2011-05-30 23:49:51 UTC (rev 87702)
@@ -69,6 +69,8 @@
array[item++] = new TestCase( SECTION, "var VAR = true ? , : 'FAILED'", "PASSED", (VAR = true ? "PASSED" : "FAILED") );
+ array[item++] = new TestCase( SECTION, "item = " + item +"; VAR = (item < -2147483648) ? 'FAILED' : 'PASSED'", "PASSED", (VAR = (item < -2147483648) ? "FAILED" : "PASSED") );
+
return ( array );
}
function test() {
_______________________________________________
webkit-changes mailing list
webkit-changes@lists.webkit.org
http://lists.webkit.org/mailman/listinfo.cgi/webkit-changes
