Patch forthcoming.
<rdar://problem/11067382>
Created attachment 132414 [details] the patch
Created attachment 132748 [details] the patch
Landed in http://trac.webkit.org/changeset/111355
Comment on attachment 132748 [details] the patch View in context: https://bugs.webkit.org/attachment.cgi?id=132748&action=review Reopen, because it broke the 32 bit build. Unfortunately EWS didn't notice it, because -Werror was disabled because of an other bug. :( > Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp:2486 > + speculationCheck(Overflow, JSValueRegs(), NoNode, m_jit.branch32(JITCompiler::Equal, op1GPR, TrustedImm32(-2147483648))); ../../../../Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp:2486: error: this decimal constant is unsigned only in ISO C90 > Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp:2489 > + JITCompiler::Jump notNeg2ToThe31 = m_jit.branch32(JITCompiler::Equal, op1GPR, TrustedImm32(-2147483648)); ../../../../Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp:2489: error: this decimal constant is unsigned only in ISO C90
.
Created attachment 132800 [details] proposed 32bit buildfix
Comment on attachment 132800 [details] proposed 32bit buildfix rs=me
Comment on attachment 132800 [details] proposed 32bit buildfix Landed in http://trac.webkit.org/changeset/111381
Thanks for the build fix!
Where’s the regression test for the crash?
(In reply to comment #11) > Where’s the regression test for the crash? http://trac.webkit.org/changeset/111481 That includes a test that checks corner cases for both division and modulo.