Bug 116767 - We broke (-2^31/-1)|0 in the DFG
Summary: We broke (-2^31/-1)|0 in the DFG
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: JavaScriptCore (show other bugs)
Version: 528+ (Nightly build)
Hardware: All All
: P2 Normal
Assignee: Filip Pizlo
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2013-05-25 14:31 PDT by Filip Pizlo
Modified: 2013-05-25 16:31 PDT (History)
7 users (show)

See Also:

Attachments
the patch (22.16 KB, patch)
2013-05-25 15:44 PDT, Filip Pizlo 		kling: review+
Details | Formatted Diff | Diff
View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Filip Pizlo 2013-05-25 14:31:04 PDT 
Patch forthcoming.
Comment 1 Filip Pizlo 2013-05-25 15:44:41 PDT 
Created attachment 202894 [details]
the patch
Comment 2 Andreas Kling 2013-05-25 16:25:41 PDT 
Comment on attachment 202894 [details]
the patch

View in context: https://bugs.webkit.org/attachment.cgi?id=202894&action=review

r=me

> Source/JavaScriptCore/ChangeLog:9
> +        The bug is that we were assuming that inthe -2^31 case, we already had -2^31
> +        in the result register. This was a wrong assumption.

Fatfinger, in the.
Comment 3 Filip Pizlo 2013-05-25 16:30:59 PDT 
(In reply to comment #2)
> (From update of attachment 202894 [details])
> View in context: https://bugs.webkit.org/attachment.cgi?id=202894&action=review
> 
> r=me
> 
> > Source/JavaScriptCore/ChangeLog:9
> > +        The bug is that we were assuming that inthe -2^31 case, we already had -2^31
> > +        in the result register. This was a wrong assumption.
> 
> Fatfinger, in the.

Thanks, fixed!
Comment 4 Filip Pizlo 2013-05-25 16:31:32 PDT 
Landed in http://trac.webkit.org/changeset/150694