Prevent register clobbering to fix negative zero check in SoftModulo.

This fix is not relevant for x86 architectures.
Covered by integer-division-neg2tothe32-by-neg1 JavaScript test.

Change-Id: I8ffd1280063305bc98c564f5df57c76cc5b1d7a6
Reviewed-by: Allan Sandfeld Jensen <allan.jensen@digia.com>

1 files changed, 7 insertions, 1 deletions

diff --git a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp
index 325a876a2..1348f94be 100644
--- a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp
+++ b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp
@@ -3051,7 +3051,13 @@ void SpeculativeJIT::compileSoftModulo(Node* node)
     FPRResult result(this);
     
     flushRegisters();
-    callOperation(operationFModOnInts, result.fpr(), op1GPR, op2GPR);
+    if (!nodeCanIgnoreNegativeZero(node->arithNodeFlags())) {
+        // NegativeZero check will need op1GPR and fmod call is likely to clobber it.
+        m_jit.push(op1GPR);
+        callOperation(operationFModOnInts, result.fpr(), op1GPR, op2GPR);
+        m_jit.pop(op1GPR);
+    } else
+        callOperation(operationFModOnInts, result.fpr(), op1GPR, op2GPR);
     
     FPRTemporary scratch(this);
     GPRTemporary intResult(this);