TypeInference: kraken imaging-gaussian-blur correctness bug

RESOLVED FIXED

Status

()

defect
RESOLVED FIXED
9 years ago
9 years ago

People

(Reporter: jandem, Unassigned)

Tracking

(Blocks 1 bug)

Firefox Tracking Flags

(Not tracked)

Details

(Whiteboard: fixed-in-jaegermonkey)

The problem can be reduced to this:
---
function f() {
    for(var i=0; i<3; i++) {
	var x = -i / 100;
	assertEq(x * -100, i);
    }
}
f();
---
It does x = -i and seems to ignore the whole division.
The problem was in the jsop_neg(), if it had an int32 operand and known-double result then the result would be marked as double but still have an int32 bit representation.

http://hg.mozilla.org/projects/jaegermonkey/rev/f86f3107b697
Status: NEW → RESOLVED
Closed: 9 years ago
Resolution: --- → FIXED
Whiteboard: fixed-in-jaegermonkey
You need to log in before you can comment on or make changes to this bug.