Magic-Mirror/gecko-dev
1
0
Fork 0
mirror of https://github.com/mozilla/gecko-dev.git synced 2024-11-06 09:05:45 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Bug 1015656: Fix overflows on ARM's ceil inline implementation; r=mjrosenb

Browse Source
This commit is contained in:
Benjamin Bouvier 2014-05-27 11:31:38 +02:00
parent fca92d889d
commit 2b0df4da82
2 changed files with 10 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
js/src/jit-test/tests/ion/ceil.js
View File

@ -47,6 +47,7 @@ function testBailout(value) {
var INT_MAX = Math.pow(2, 31) - 1;
var INT_MIN = INT_MAX + 1 | 0;
var UINT_MAX = Math.pow(2, 32) - 1;
// Values in ]-1; -0]
testBailout(-0);
@ -55,5 +56,10 @@ testBailout(-.5);
// single precision
testBailout(INT_MAX + .5);
testBailout(INT_MIN - 129);
// (UINT_MAX; +inf] have special behavior on ARM
testBailout(UINT_MAX);
testBailout(UINT_MAX + .5);
testBailout(UINT_MAX + 1);
testBailout(UINT_MAX + 2);
// BatNaN
testBailout(NaN);

6
js/src/jit/arm/MacroAssembler-arm.cpp
View File

@ -4229,9 +4229,10 @@ MacroAssemblerARMCompat::ceil(FloatRegister input, Register output, Label *bail)
ma_vcvt_U32_F64(ScratchFloatReg, ScratchFloatReg);
compareDouble(ScratchFloatReg, input);
ma_add(output, Imm32(1), output, NoSetCond, NotEqual);
// Bail out if the add overflowed or the result is negative
// Bail out if the add overflowed or the result is non positive
ma_mov(output, output, SetCond);
ma_b(bail, Signed);
ma_b(bail, Zero);
bind(&fin);
}
@ -4280,9 +4281,10 @@ MacroAssemblerARMCompat::ceilf(FloatRegister input, Register output, Label *bail
ma_vcvt_U32_F32(ScratchFloatReg, ScratchFloatReg);
compareFloat(ScratchFloatReg, input);
ma_add(output, Imm32(1), output, NoSetCond, NotEqual);
// Bail out if the add overflowed or the result is negative
// Bail out if the add overflowed or the result is non positive
ma_mov(output, output, SetCond);
ma_b(bail, Signed);
ma_b(bail, Zero);
bind(&fin);
}