Closed Bug 618863 Opened 13 years ago Closed 13 years ago

TypeInference: kraken imaging-gaussian-blur correctness bug

Categories

(Core :: JavaScript Engine, defect)

Product:
Core
Component:
JavaScript Engine
Platform:
x86
macOS
Type:
defect
Priority:
Not set
Severity:
normal

Tracking

()

Status:
RESOLVED FIXED

People

(Reporter: jandem, Unassigned)

References

Details

(Whiteboard: fixed-in-jaegermonkey) 

The problem can be reduced to this:
---
function f() {
    for(var i=0; i<3; i++) {
	var x = -i / 100;
	assertEq(x * -100, i);
    }
}
f();
---
It does x = -i and seems to ignore the whole division.
The problem was in the jsop_neg(), if it had an int32 operand and known-double result then the result would be marked as double but still have an int32 bit representation.

http://hg.mozilla.org/projects/jaegermonkey/rev/f86f3107b697
Status: NEW → RESOLVED
Closed: 13 years ago
Resolution: --- → FIXED
Whiteboard: fixed-in-jaegermonkey
You need to log in before you can comment on or make changes to this bug.