Bug 106978 – DFG X86: division in the used-as-int case doesn't correctly check for -2^31/-1

• Component: JavaScriptCore
• Status: RESOLVED FIXED

[Michael Saboff]

From <rdar://problem/13021805>

Try this program:

function foo(a, b) {
    return (a / b) | 0;
}

for (var i = 0; i < 200; ++i)
    print(foo(-2147483647-1, -1));

Expected result: prints -2147483648 200 times.

Actual result: crash.

The reason is that the !nodeUsedAsNumber(node.arithNodeFlags()) case of ArithDiv doesn't correctly handle -2^31/-1.

[Michael Saboff]

Committed r139835: <http://trac.webkit.org/changeset/139835>

[Dominik Röttsches (drott)]

Expected test results fixed, see bug 106991.