[Webkit-unassigned] [Bug 94779] To reduce cost of converting type during modulo for integers

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=94779





--- Comment #13 from Filip Pizlo <fpizlo at apple.com>  2012-09-17 19:59:36 PST ---
(In reply to comment #12)
> (In reply to comment #11)
> > (From update of attachment 160691 [details] [details])
> > View in context: https://bugs.webkit.org/attachment.cgi?id=160691&action=review
> > 
> > > Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp:2554
> > > +    callOperation(operationModOnInts, result.gpr(), op1GPR, op2GPR);
> > 
> > Have you tested -2^31%-1
> 
> That case is included in integer-division-neg2tothe32-by-neg1.js as I know.
> I ran that case with loop count greater than 1000 to make sure going though DFG.

Here's my concern: the C operation a%b where a is -2^31 and b is -1 has undefined behavior AFAIK. Your patch doesn't prevent that case from executing.

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.