-
fpizlo@apple.com authored
https://bugs.webkit.org/show_bug.cgi?id=116767 Source/JavaScriptCore: Reviewed by Andreas Kling. The bug is that we were assuming that in the -2^31 case, we already had -2^31 in the result register. This was a wrong assumption. * dfg/DFGSpeculativeJIT.cpp: (JSC::DFG::SpeculativeJIT::compileIntegerArithDivForX86): LayoutTests: Reviewed by Andreas Kling. * fast/js/dfg-div-by-neg1-and-then-or-zero-interesting-reg-alloc-expected.txt: Added. * fast/js/dfg-div-by-neg1-and-then-or-zero-interesting-reg-alloc.html: Added. * fast/js/dfg-div-by-zero-and-then-or-zero-interesting-reg-alloc-expected.txt: Added. * fast/js/dfg-div-by-zero-and-then-or-zero-interesting-reg-alloc.html: Added. * fast/js/dfg-div-neg2tothe31-by-one-and-then-or-zero-with-interesting-reg-alloc-expected.txt: Added. * fast/js/dfg-div-neg2tothe31-by-one-and-then-or-zero-with-interesting-reg-alloc.html: Added. * fast/js/jsc-test-list: * fast/js/script-tests/dfg-div-by-neg1-and-then-or-zero-interesting-reg-alloc.js: Added. (foo): * fast/js/script-tests/dfg-div-by-zero-and-then-or-zero-interesting-reg-alloc.js: Added. (foo): * fast/js/script-tests/dfg-div-neg2tothe31-by-one-and-then-or-zero-with-interesting-reg-alloc.js: Added. (foo): git-svn-id: http://svn.webkit.org/repository/webkit/trunk@150694 268f45cc-cd09-0410-ab3c-d52691b4dbfc
3a048c08