Closed
Bug 692332
Opened 13 years ago
Closed 13 years ago
IonMonkey: Miscompilation of 1/x.
Categories
(Core :: JavaScript Engine, defect)
Tracking
()
RESOLVED
FIXED
People
(Reporter: sstangl, Unassigned)
Details
Attachments
(2 files)
14.16 KB,
image/png
|
Details | |
596 bytes,
patch
|
dvander
:
review+
|
Details | Diff | Splinter Review |
The following code miscompiles on x64:
> function f(x) { return 1/x; }
f(3) returns 1. The MIR is correct, but the LIR contains two LInteger(1) instructions, and the generated assembly overwrites the parameter of |3| with |1|, although the regalloc does not show any intended use of that register.
Fixing this fixes SS' math-spectral-norm.
Reporter | ||
Comment 1•13 years ago
|
||
Oh, the LIR is just totally incorrect. It is explicitly calculating 1/1 (v4,v5).
Reporter | ||
Comment 2•13 years ago
|
||
Attachment #565089 -
Flags: review?(dvander)
Comment on attachment 565089 [details] [diff] [review] sup nice
Attachment #565089 -
Flags: review?(dvander) → review+
Reporter | ||
Comment 4•13 years ago
|
||
http://hg.mozilla.org/projects/ionmonkey/rev/86b68bdba42f
Status: NEW → RESOLVED
Closed: 13 years ago
Resolution: --- → FIXED
You need to log in
before you can comment on or make changes to this bug.
Description
•