1 files changed, 7 insertions, 1 deletions
diff --git a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp
index 325a876a2..1348f94be 100644
--- a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp
+++ b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp
@@ -3051,7 +3051,13 @@ void SpeculativeJIT::compileSoftModulo(Node* node)
     FPRResult result(this);
     
     flushRegisters();
-    callOperation(operationFModOnInts, result.fpr(), op1GPR, op2GPR);
+    if (!nodeCanIgnoreNegativeZero(node->arithNodeFlags())) {
+        // NegativeZero check will need op1GPR and fmod call is likely to clobber it.
+        m_jit.push(op1GPR);
+        callOperation(operationFModOnInts, result.fpr(), op1GPR, op2GPR);
+        m_jit.pop(op1GPR);
+    } else
+        callOperation(operationFModOnInts, result.fpr(), op1GPR, op2GPR);
     
     FPRTemporary scratch(this);
     GPRTemporary intResult(this);