Math.abs() returns negative
authorbasile_clement@apple.com <basile_clement@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Fri, 1 May 2015 22:35:36 +0000 (22:35 +0000)
committerbasile_clement@apple.com <basile_clement@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Fri, 1 May 2015 22:35:36 +0000 (22:35 +0000)
commit1f96d3f5bc0213a2854af086c895ecdbbd3a7d57
treea14c68ebc4eec04f29dc8f8332f414edf7f01493
parent0599f8779dfaa9cc4ecd12bd1f00840599d67713
Math.abs() returns negative
https://bugs.webkit.org/show_bug.cgi?id=137827

Reviewed by Michael Saboff.

Math.abs() on doubles was mistakenly assumed by the DFG AI to be the
identity function.

* dfg/DFGAbstractInterpreterInlines.h:
(JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
* tests/stress/math-abs-positive.js: Added, was previously failing.
(foo):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@183692 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Source/JavaScriptCore/ChangeLog
Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h
Source/JavaScriptCore/tests/stress/math-abs-positive.js [new file with mode: 0644]