498549 - TM: If the result of a demoted multiplication is 0, must undemote or we lose -0

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

e = 0
let(f = function(y) {++y;
    for each(b in [0, 1 / 0, 0 / 0, 0]) {
        e *= --y
    }
}) {
    f(2)
}
print(uneval(this))

There's a "-0" in the output without -j but no "-0" in the output with -j. Does not seem to affect 1.9.1 branch.

===

$ ~/Desktop/tm-28982-568959fa4956/js-dbg-tm-intelmac 
js> e = 0
0
js> let(f = function(y) {++y;
    for each(b in [0, 1 / 0, 0 / 0, 0]) {
        e *= --y
    }
}) {
    f(2)
}
js> print(uneval(this))
({e:-0, b:0})

$ ~/Desktop/tm-28982-568959fa4956/js-dbg-tm-intelmac -j
js> e = 0
0
js> let(f = function(y) {++y;
    for each(b in [0, 1 / 0, 0 / 0, 0]) {
        e *= --y
    }
}) {
    f(2)
}
js> print(uneval(this))
({e:0, b:0})

Comment 1

[Andreas Gal :gal]

Attachment: patch

-0 sucks

Comment 2

[David Anderson [:dvander] - inactive, e-mail if emergency]

Comment on attachment 383446 [details] [diff] [review]
patch

:(

Comment 3

[Robert Sayre]

http://hg.mozilla.org/mozilla-central/rev/434d3673d304

Comment 4

[Mike Beltzner [:beltzner, not reading bugmail]]

Mass change: adding fixed1.9.2 keyword

(This bug was identified as a mozilla1.9.2 blocker which was fixed before the mozilla-1.9.2 repository was branched (August 13th, 2009) as per this query: http://is.gd/2ydcb - if this bug is not actually fixed on mozilla1.9.2, please remove the keyword. Apologies for the bugspam)

Comment 5

[Christian Holler (:decoder)]

Bug in removed tracer code, setting in-testsuite- flag.