Title: [209658] trunk/Source/_javascript_Core
- Revision
- 209658
- Author
- utatane....@gmail.com
- Date
- 2016-12-10 01:29:08 -0800 (Sat, 10 Dec 2016)
Log Message
REGRESSION(r208791): Assertion in testb3
https://bugs.webkit.org/show_bug.cgi?id=165651
Reviewed by Saam Barati.
Accidentally we always use edx/rdx for the result of UDiv/UMod.
But it is incorrect. We should use eax/rax for the result of UDiv.
* b3/B3LowerToAir.cpp:
(JSC::B3::Air::LowerToAir::lowerX86UDiv):
Modified Paths
Diff
Modified: trunk/Source/_javascript_Core/ChangeLog (209657 => 209658)
--- trunk/Source/_javascript_Core/ChangeLog 2016-12-10 08:57:42 UTC (rev 209657)
+++ trunk/Source/_javascript_Core/ChangeLog 2016-12-10 09:29:08 UTC (rev 209658)
@@ -1,3 +1,16 @@
+2016-12-10 Yusuke Suzuki <utatane....@gmail.com>
+
+ REGRESSION(r208791): Assertion in testb3
+ https://bugs.webkit.org/show_bug.cgi?id=165651
+
+ Reviewed by Saam Barati.
+
+ Accidentally we always use edx/rdx for the result of UDiv/UMod.
+ But it is incorrect. We should use eax/rax for the result of UDiv.
+
+ * b3/B3LowerToAir.cpp:
+ (JSC::B3::Air::LowerToAir::lowerX86UDiv):
+
2016-12-09 Michael Saboff <msab...@apple.com>
Unreviewed build fix for 32 bit builds.
Modified: trunk/Source/_javascript_Core/b3/B3LowerToAir.cpp (209657 => 209658)
--- trunk/Source/_javascript_Core/b3/B3LowerToAir.cpp 2016-12-10 08:57:42 UTC (rev 209657)
+++ trunk/Source/_javascript_Core/b3/B3LowerToAir.cpp 2016-12-10 09:29:08 UTC (rev 209658)
@@ -2842,7 +2842,7 @@
Air::Opcode div = m_value->type() == Int32 ? X86UDiv32 : X86UDiv64;
ASSERT(op == UDiv || op == UMod);
- X86Registers::RegisterID result = op == Div ? X86Registers::eax : X86Registers::edx;
+ X86Registers::RegisterID result = op == UDiv ? X86Registers::eax : X86Registers::edx;
append(Move, tmp(m_value->child(0)), eax);
append(Xor64, edx, edx);
_______________________________________________
webkit-changes mailing list
webkit-changes@lists.webkit.org
https://lists.webkit.org/mailman/listinfo/webkit-changes
