478779 - uint addition after an overflow results in a value 1 too high

Status: VERIFIED INVALID

(Tamarin Graveyard :: Virtual Machine, defect)

Description

[Jeff Dyer]

Flash version: 9,0,45,0
Flex Builder version: 2.0.1.167022
Unsure of the JDK version, this problem occurs on Windows XP SP2, but unsure about other OSes

Steps to reproduce:
1.
Write and run the following code:

var test1:uint = 16369516 * 1140671485;
var test2:uint = (16369516 * 1140671485 + 12820163);
var test4:uint = test1 + 12820163;
 
 Actual Results:
According to the debugger:

test1 = 2949077436 [0xafc759bc]
test2 = 2961897600 [0xb08af880]
test4 = 2961897599 [0xb08af87f]

 Expected Results:
This is how C behaves:
test1 = 2949077436 [0xafc759bc]
test2 = 2961897599 [0xb08af87f]
test4 = 2961897599 [0xb08af87f]

 
 Workaround (if any):
The one shown only works in some circumstances.  In others, the workaround is off by one.  If I had to guess, an operation needs to be completed to clear a carry flag in a register, or a Number is the backing data structure for a uint, but that REALLY shouldn't be the case.  ints are supposed to produce precise results, even when they overflow.
 
 
Transferred Comments:

Trevor Baker - Tue Jan 27 16:29:12 CST 2009
send to internal review for prioritization


This bug transferred from: http://bugs.adobe.com/jira/browse/ASC-2899

Comment 1

[Edwin Smith]

This is not a bug, the math operators + and * are defined as working on IEEE748 64bit doubles when working on any numbers.  Assignment of double->uint is working correctly as defined by the ECMAScript ToUInt32() internal operator.

js, AS3 != C