nephele
/
haikuwebkit
1
0
Fork 0
Code Issues Releases Activity
haikuwebkit/LayoutTests/js/dfg-int52-change-format-exp...

6 lines
166 B
Plaintext
Raw Permalink Normal View History

REGRESSION(r156047): WebCore hangs inside JSC::toInt32(double) https://bugs.webkit.org/show_bug.cgi?id=121648 Source/JavaScriptCore: Reviewed by Mark Hahnenberg. The Int52<->StrictInt52 conversion did the opposite fill() than what it was supposed to. For example when converting a Int52 to a StrictInt52 it would fill as Int52, and vice-versa. * dfg/DFGSpeculativeJIT64.cpp: (JSC::DFG::SpeculativeJIT::fillSpeculateInt52): LayoutTests: Reviewed by Mark Hahnenberg. * js/dfg-int52-change-format-expected.txt: Added. * js/dfg-int52-change-format.html: Added. * js/script-tests/dfg-int52-change-format.js: Added. (foo): Canonical link: https://commits.webkit.org/139724@main git-svn-id: https://svn.webkit.org/repository/webkit/trunk@156212 268f45cc-cd09-0410-ab3c-d52691b4dbfc
2013-09-21 00:07:07 +00:00
PASS foo(1000000000) is [4000000000,8000000000,-147483648,12000000000] on all iterations including after DFG tier-up.
PASS successfullyParsed is true
TEST COMPLETE