wine/gecko
0
0
Fork 0
mirror of https://gitlab.winehq.org/wine/wine-gecko.git synced 2024-09-13 09:24:08 -07:00
Code Issues Packages Projects Releases Wiki Activity

Bug 646938 - Fix NaN-check in jsop_stricteq. r=dvander

Browse Source
This commit is contained in:
Jan de Mooij 2011-04-26 10:29:00 +02:00
parent 40d8f2f5d2
commit e7219c101f
2 changed files with 30 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

21
js/src/jit-test/tests/jaeger/bug646938.js Normal file
View File

@ -0,0 +1,21 @@
function f() {
var x = -[NaN][0];
assertEq(x === x, false);
assertEq(x !== x, true);
assertEq(x == x, false);
assertEq(x != x, true);
var y = -("x" / {});
var z = y;
assertEq(y === z, false);
assertEq(y !== z, true);
assertEq(y == z, false);
assertEq(y != z, true);
}
f();
function g(x, y) {
var z = x / y;
assertEq(z === z, false);
}
g(0, 0);

15
js/src/methodjit/FastOps.cpp
View File

@ -1550,20 +1550,23 @@ mjit::Compiler::jsop_stricteq(JSOp op)
return;
}
/* Assume NaN is in canonical form. */
/* Assume NaN is either in canonical form or has the sign bit set (by jsop_neg). */
RegisterID result = frame.allocReg(Registers::SingleByteRegs);
RegisterID treg = frame.tempRegForType(lhs);
RegisterID treg = frame.copyTypeIntoReg(lhs);
Assembler::Condition oppositeCond = (op == JSOP_STRICTEQ) ? Assembler::NotEqual : Assembler::Equal;
/* Ignore the sign bit. */
masm.lshiftPtr(Imm32(1), treg);
#ifndef JS_CPU_X64
static const int CanonicalNaNType = 0x7FF80000;
masm.setPtr(oppositeCond, treg, Imm32(CanonicalNaNType), result);
static const int ShiftedCanonicalNaNType = 0x7FF80000 << 1;
masm.setPtr(oppositeCond, treg, Imm32(ShiftedCanonicalNaNType), result);
#else
static const void *CanonicalNaNType = (void *)0x7FF8000000000000;
masm.move(ImmPtr(CanonicalNaNType), Registers::ScratchReg);
static const void *ShiftedCanonicalNaNType = (void *)(0x7FF8000000000000 << 1);
masm.move(ImmPtr(ShiftedCanonicalNaNType), Registers::ScratchReg);
masm.setPtr(oppositeCond, treg, Registers::ScratchReg, result);
#endif
frame.freeReg(treg);
frame.popn(2);
frame.pushTypedPayload(JSVAL_TYPE_BOOLEAN, result);