TM: 0 vs -0 issue with "c %= -1"

RESOLVED FIXED

Status

()

Core
JavaScript Engine
RESOLVED FIXED
9 years ago
8 years ago

People

(Reporter: Jesse Ruderman, Assigned: gal)

Tracking

(Blocks: 1 bug, {regression, testcase})

unspecified
x86
Mac OS X
regression, testcase
Points:
---
Bug Flags:
in-testsuite +

Firefox Tracking Flags

(Not tracked)

Details

Attachments

(1 attachment)

(Reporter)

Description

9 years ago
var v = 0;
for (var i = 0; i < 2; ++i) {
    c = v;
    v -= 1;
    for (var j = 0; j < 2; ++j) {
         c %= -1;
    }
}
print(1/c);

Without JIT: -Infinity
With JIT:    Infinity
(Assignee)

Comment 1

9 years ago
Looks like recent fallout from my integer demotion patch. I doubt this happens on 191.
Assignee: general → gal
Created attachment 387568 [details] [diff] [review]
possible fix

There is an analogous bug in division as well. I'm not sure if LIR_fmod solution was the best, it seems like we shouldn't bother recording an integer path if v1 is negative at all (constant or not). Easy change if that's the case.
Attachment #387568 - Flags: review?(gal)
(Assignee)

Updated

9 years ago
Attachment #387568 - Flags: review?(gal) → review+
http://hg.mozilla.org/tracemonkey/rev/c8489ee35bb2
Status: NEW → RESOLVED
Last Resolved: 9 years ago
Resolution: --- → FIXED

Comment 5

8 years ago
trace-test testModuloWithNegative1
Flags: in-testsuite+
You need to log in before you can comment on or make changes to this bug.