Right shift operators (>> and >>>) fail when the left operand is a large negative number and the right operand is an immediate number. var largeNeg=-2715228072; alert(largeNeg >>> 5); // wrong when using ARM assembler. It seems branchTruncateDoubleToInt32() doesn't work as expected by the caller (JIT::emitRightShiftSlowCase). Turning off supportsFloatingPointTruncate() for MacroAssemberARM can simply solve the problem. I noticed this comment in MacroAssemberARMv7.h: // On x86(_64) the MacroAssembler provides an interface to truncate a double to an integer. // If a value is not representable as an integer, and possibly for some values that are, // (on x86 INT_MIN, since this is indistinguishable from results for out-of-range/NaN input) // a branch will be taken. It is not clear whether this interface will be well suited to // other platforms. On ARMv7 the hardware truncation operation produces multiple possible // failure values (saturates to INT_MIN & INT_MAX, NaN reulsts in a value of 0). This is a // temporary solution while we work out what this interface should be. Either we need to // decide to make this interface work on all platforms, rework the interface to make it more // generic, or decide that the MacroAssembler cannot practically be used to abstracted these // operations, and make clients go directly to the m_assembler to plant truncation instructions. // In short, FIXME:. bool supportsFloatingPointTruncate() const { return false; } Should we also turn off supportsFloatingPointTruncate() for ARM?
Created attachment 106457 [details] the patch that turns off this optimization
Comment on attachment 106457 [details] the patch that turns off this optimization Clearing flags on attachment: 106457 Committed r94622: <http://trac.webkit.org/changeset/94622>
All reviewed patches have been landed. Closing bug.