[INFER] Call stubcc.leave() on negative zero in JSOP_MOD, bug 649973.
authorBrian Hackett <bhackett1024@gmail.com>
Thu, 14 Apr 2011 15:46:47 -0700
changeset 74945 1d02bc0921260e83f5f2daf737c4e077436e8c5b
parent 74944 dca50d9a5047bc9865bdb7390d8d39e24968a329
child 74946 f3a11a539c790e7ad435132615e40a664c67cfb7
push id2
push userbsmedberg@mozilla.com
push dateFri, 19 Aug 2011 14:38:13 +0000
bugs649973
milestone6.0a1
[INFER] Call stubcc.leave() on negative zero in JSOP_MOD, bug 649973.
js/src/jit-test/tests/jaeger/bug649824.js
js/src/jit-test/tests/jaeger/bug649973.js
js/src/methodjit/FastArithmetic.cpp
new file mode 100644
--- /dev/null
+++ b/js/src/jit-test/tests/jaeger/bug649824.js
@@ -0,0 +1,6 @@
+var o = {
+    w: 2,
+    x: 3
+};
+var o = 430717;
+o.x = 4;
new file mode 100644
--- /dev/null
+++ b/js/src/jit-test/tests/jaeger/bug649973.js
@@ -0,0 +1,2 @@
+x = 2147483647;
+(x+10, false) ? [x % x] : [2 * x];
--- a/js/src/methodjit/FastArithmetic.cpp
+++ b/js/src/methodjit/FastArithmetic.cpp
@@ -1049,16 +1049,17 @@ mjit::Compiler::jsop_mod()
     else
         frame.pushNumber(X86Registers::edx);
 
     if (slowPath)
         stubcc.rejoin(Changes(1));
 
     if (gotNegZero.isSet()) {
         stubcc.linkExit(gotNegZero.getJump(), Uses(2));
+        stubcc.leave();
         OOL_STUBCALL(stubs::NegZeroHelper);
         stubcc.rejoin(Changes(1));
     }
 #endif
 
     return true;
 }