[Webkit-unassigned] [Bug 86330] DFG performs incorrect constant folding on double-to-uint32 conversion in Uint32Array PutByVal

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=86330





--- Comment #6 from Filip Pizlo <fpizlo at apple.com>  2012-05-13 22:55:45 PST ---
(In reply to comment #5)
> (From update of attachment 141638 [details])
> View in context: https://bugs.webkit.org/attachment.cgi?id=141638&action=review
> 
> Can you add a regression test for this? Normally we don’t land fixes without tests.

Of course, I will LayoutTest-ify the attached test case.

> 
> > Source/JavaScriptCore/ChangeLog:9
> > +        static_cast<int>(d) is wrong, since JS semantics require us to use toInt32(d).
> 
> Sure would be nice to be more specific here about how close static_cast<int> was or wasn’t, such as what values it would give a wrong value for.

Fixed the ChangeLog.

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.