commit 7af1b44b33b57ded900a97942d6ea6a37d20f8cb
author commit-queue@webkit.org <commit-queue@webkit.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc> Mon May 30 23:49:51 2011 +0000
committer commit-queue@webkit.org <commit-queue@webkit.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc> Mon May 30 23:49:51 2011 +0000
tree 4e8ed25b1f6acf6a7e1f0a6520c5c09d11725f00
parent ac53211927513cdd1d51e4d52a83fb74c7edab11

2011-05-30  Hojong Han  <hojong.han@samsung.com>

        Reviewed by Geoffrey Garen.

        [JSC] malfunction during arithmetic condition check with negative number (-2147483648)
        https://bugs.webkit.org/show_bug.cgi?id=61416

        * assembler/MacroAssemblerARM.h:
        (JSC::MacroAssemblerARM::branch32):
        * tests/mozilla/ecma/Expressions/11.12-1.js:
        (getTestCases):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@87702 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Source/JavaScriptCore/assembler/MacroAssemblerARM.h

diff --git a/Source/JavaScriptCore/assembler/MacroAssemblerARM.h b/Source/JavaScriptCore/assembler/MacroAssemblerARM.h
index 7c47461..6d8479f 100644
--- a/Source/JavaScriptCore/assembler/MacroAssemblerARM.h
+++ b/Source/JavaScriptCore/assembler/MacroAssemblerARM.h
@@ -416,7 +416,7 @@
             m_assembler.ldr_un_imm(ARMRegisters::S0, right.m_value);
             m_assembler.cmp_r(left, ARMRegisters::S0);
         } else {
-            ARMWord tmp = m_assembler.getOp2(-right.m_value);
+            ARMWord tmp = (right.m_value == 0x80000000) ? ARMAssembler::INVALID_IMM : m_assembler.getOp2(-right.m_value);
             if (tmp != ARMAssembler::INVALID_IMM)
                 m_assembler.cmn_r(left, tmp);
             else