736141 - IonMonkey: x + 0 equals x only when x can't be -0

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Hannes Verschore [:h4writer]]

During GVN we fold values. E.g. in the addition we fold the addition to x + 0 to x.
This isn't true if x equals -0. 

testcase:

function test(i) {
    return i * 0 + 0;
}

// Compile double variant
for(var i=0; i<100; i++){
    test(-i);
}

var x = test(-100);
// Prints if x == -0
print((x===0 && (1/x)===-Infinity));

prints true in Ionmonkey, false in interpreter.

Reason:
-0 + 0 = +0 // positive zero
but we remove the addition (as 0 is the identity function of addition)

So the test function becomes:

function test(i){
   return i * 0
}

Which gives negative zero when i < 0

Comment 1

[Hannes Verschore [:h4writer]]

Another fault in foldsto:

function test(i) {
    return 0 - i;
}

is folded to:

function test(i) {
    return i; // NOTICE THE LACK OF SIGN
}

Comment 2

[Hannes Verschore [:h4writer]]

Attachment: Patch for both issues

This fixes both issues. I'll add both testcases and commit msg after review.

Comment 3

[Robert Longson [:longsonr]]

s/substraction/subtraction/

Comment 4

[David Anderson [:dvander] - inactive, e-mail if emergency]

Comment on attachment 606278 [details] [diff] [review]
Patch for both issues

Review of attachment 606278 [details] [diff] [review]:
-----------------------------------------------------------------

Nice catch!

Comment 5

[Hannes Verschore [:h4writer]]

Attachment: Patch for both issues

Robert's nit addressed, together with commit description and author. Ready for checkin.

Comment 6

[Ryan VanderMeulen [:RyanVM]]

Jan, can you check this in?

Comment 7

[Jan de Mooij [:jandem]]

(In reply to Ryan VanderMeulen from comment #6)
> Jan, can you check this in?

Sure: http://hg.mozilla.org/projects/ionmonkey/rev/3a4607b336a8