106978 2013-01-15 20:59:53 -0800 DFG X86: division in the used-as-int case doesn't correctly check for -2^31/-1 2013-01-16 02:26:18 -0800 1 1 1 Unclassified WebKit JavaScriptCore 528+ (Nightly build) All All RESOLVED FIXED InRadar P2 Normal --- 1 msaboff msaboff d-r oldest_to_newest 808021 0 msaboff 2013-01-15 20:59:53 -0800 From <rdar://problem/13021805> Try this program: function foo(a, b) { return (a / b) | 0; } for (var i = 0; i < 200; ++i) print(foo(-2147483647-1, -1)); Expected result: prints -2147483648 200 times. Actual result: crash. The reason is that the !nodeUsedAsNumber(node.arithNodeFlags()) case of ArithDiv doesn't correctly handle -2^31/-1. 808041 1 msaboff 2013-01-15 21:48:28 -0800 Committed r139835: <http://trac.webkit.org/changeset/139835> 808202 2 d-r 2013-01-16 02:26:18 -0800 Expected test results fixed, see bug 106991.