wine/gecko
0
0
Fork 0
mirror of https://gitlab.winehq.org/wine/wine-gecko.git synced 2024-09-13 09:24:08 -07:00
Code Issues Packages Projects Releases Wiki Activity

Fixed JSOP_NEG not checking overflow at recording time (bug 465688, r=gal).

Browse Source
This commit is contained in:
David Anderson 2008-11-21 17:17:34 -08:00
parent 56fbffe8c4
commit cea571a94b
2 changed files with 10 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
js/src/jstracer.cpp
View File

@ -5648,7 +5648,8 @@ TraceRecorder::record_JSOP_NEG()
*/ */
if (isPromoteInt(a) && if (isPromoteInt(a) &&
(!JSVAL_IS_INT(v) || JSVAL_TO_INT(v) != 0) && (!JSVAL_IS_INT(v) || JSVAL_TO_INT(v) != 0) &&
(!JSVAL_IS_DOUBLE(v) || !JSDOUBLE_IS_NEGZERO(*JSVAL_TO_DOUBLE(v)))) { (!JSVAL_IS_DOUBLE(v) || !JSDOUBLE_IS_NEGZERO(*JSVAL_TO_DOUBLE(v))) &&
-asNumber(v) == (int)-asNumber(v)) {
a = lir->ins1(LIR_neg, ::demote(lir, a)); a = lir->ins1(LIR_neg, ::demote(lir, a));
lir->insGuard(LIR_xt, lir->ins1(LIR_ov, a), snapshot(OVERFLOW_EXIT)); lir->insGuard(LIR_xt, lir->ins1(LIR_ov, a), snapshot(OVERFLOW_EXIT));
lir->insGuard(LIR_xt, lir->ins2(LIR_eq, a, lir->insImm(0)), snapshot(OVERFLOW_EXIT)); lir->insGuard(LIR_xt, lir->ins2(LIR_eq, a, lir->insImm(0)), snapshot(OVERFLOW_EXIT));

8
js/src/trace-test.js
View File

@ -1940,6 +1940,14 @@ function testBug466128() {
testBug466128.expected = true; testBug466128.expected = true;
test(testBug466128); test(testBug466128);
//test no assert
function testBug465688() {
for each (let d in [-0x80000000, -0x80000000]) - -d;
return true;
}
testBug465688.expected = true;
test(testBug465688);
// BEGIN MANDELBROT STUFF // BEGIN MANDELBROT STUFF
// XXXbz I would dearly like to wrap it up into a function to avoid polluting // XXXbz I would dearly like to wrap it up into a function to avoid polluting
// the global scope, but the function ends up heavyweight, and then we lose on // the global scope, but the function ends up heavyweight, and then we lose on