Bug 116767

Summary: We broke (-2^31/-1)|0 in the DFG
Product: WebKit Reporter: Filip Pizlo <fpizlo>
Component: JavaScriptCoreAssignee: Filip Pizlo <fpizlo>
Status: RESOLVED FIXED    
Severity: Normal CC: barraclough, ggaren, mark.lam, mhahnenberg, msaboff, oliver, sam
Priority: P2    
Version: 528+ (Nightly build)   
Hardware: All   
OS: All   
Attachments:
Description Flags
the patch kling: review+

Filip Pizlo
Reported 2013-05-25 14:31:04 PDT
Patch forthcoming.
Attachments
the patch (22.16 KB, patch)
2013-05-25 15:44 PDT, Filip Pizlo 		kling: review+
DetailsFormatted DiffDiff
View All Add attachment proposed patch, testcase, etc.
Filip Pizlo
Comment 1 2013-05-25 15:44:41 PDT
Created attachment 202894 [details] the patch
Andreas Kling
Comment 2 2013-05-25 16:25:41 PDT
Comment on attachment 202894 [details] the patch View in context: https://bugs.webkit.org/attachment.cgi?id=202894&action=review r=me > Source/JavaScriptCore/ChangeLog:9 > + The bug is that we were assuming that inthe -2^31 case, we already had -2^31 > + in the result register. This was a wrong assumption. Fatfinger, in the.
Filip Pizlo
Comment 3 2013-05-25 16:30:59 PDT
(In reply to comment #2) > (From update of attachment 202894 [details]) > View in context: https://bugs.webkit.org/attachment.cgi?id=202894&action=review > > r=me > > > Source/JavaScriptCore/ChangeLog:9 > > + The bug is that we were assuming that inthe -2^31 case, we already had -2^31 > > + in the result register. This was a wrong assumption. > > Fatfinger, in the. Thanks, fixed!
Filip Pizlo
Comment 4 2013-05-25 16:31:32 PDT
Landed in http://trac.webkit.org/changeset/150694
Note You need to log in before you can comment on or make changes to this bug.