Bug 1122401: Check that the remainder is null in unsigned soft divisions on ARM or bailout; r=dougc

--HG--
extra : rebase_source : 01ffcfe9a6b882fbdec508b4b93c459d77a9a732

js/src/jit-test/tests/ion/bug1122401.js

@@ -0,0 +1,5 @@
+function f(x) {
+    return Math.round((x >>> 0) / 2) >> 0;
+}
+f(2);
+assertEq(f(1), 1);

js/src/jit/arm/CodeGenerator-arm.cpp

@@ -624,6 +624,7 @@ CodeGeneratorARM::visitSoftDivI(LSoftDivI *ins)
         masm.callWithABI(AsmJSImm_aeabi_idivmod);
     else
         masm.callWithABI(JS_FUNC_TO_DATA_PTR(void *, __aeabi_idivmod));
+
     // idivmod returns the quotient in r0, and the remainder in r1.
     if (!mir->canTruncateRemainder()) {
         MOZ_ASSERT(mir->fallible());
@@ -2105,6 +2106,14 @@ CodeGeneratorARM::visitSoftUDivOrMod(LSoftUDivOrMod *ins)
     else
         masm.callWithABI(JS_FUNC_TO_DATA_PTR(void *, __aeabi_uidivmod));
 
+    // uidivmod returns the quotient in r0, and the remainder in r1.
+    MInstruction *mir = ins->mir();
+    if (mir->isDiv() && !mir->toDiv()->canTruncateRemainder()) {
+        MOZ_ASSERT(mir->toDiv()->fallible());
+        masm.ma_cmp(r1, Imm32(0));
+        bailoutIf(Assembler::NonZero, ins->snapshot());
+    }
+
     masm.bind(&afterDiv);
 }
 

js/src/jit/arm/LIR-arm.h

@@ -440,6 +440,10 @@ class LSoftUDivOrMod : public LBinaryMath<3>
         setTemp(1, temp2);
         setTemp(2, temp3);
     }
+
+    MInstruction *mir() {
+        return mir_->toInstruction();
+    }
 };
 
 class LAsmJSLoadFuncPtr : public LInstructionHelper<1, 1, 1>