Trap 5 (most likely int $3) in jsc-layout-tests.yaml/js/script-tests/integer-division-neg2tothe32-by-neg1.js.layout-dfg-eager-no-cjit
https://bugs.webkit.org/show_bug.cgi?id=122420

Source/JavaScriptCore: 

Reviewed by Michael Saboff.
        
For the (-2^31/-1)|0 case, we were returning the left operand (i.e. -2^31) but we were
failing to account for the possibility that this operand has high-bit garbage and
int32Result() requires that the high bits are zero.

* dfg/DFGSpeculativeJIT.cpp:
(JSC::DFG::SpeculativeJIT::compileArithDiv):

LayoutTests: 

Reviewed by Michael Saboff.

* js/script-tests/integer-division-neg2tothe32-by-neg1.js:



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@157043 268f45cc-cd09-0410-ab3c-d52691b4dbfc