Closed Bug 736141 Opened 12 years ago Closed 12 years ago

IonMonkey: x + 0 equals x only when x can't be -0

Categories

(Core :: JavaScript Engine, defect)

x86_64
Linux
defect
Not set
normal

Tracking

()

RESOLVED FIXED

People

(Reporter: h4writer, Assigned: h4writer)

Details

Attachments

(1 file, 1 obsolete file)

During GVN we fold values. E.g. in the addition we fold the addition to x + 0 to x.
This isn't true if x equals -0. 

testcase:

function test(i) {
    return i * 0 + 0;
}

// Compile double variant
for(var i=0; i<100; i++){
    test(-i);
}

var x = test(-100);
// Prints if x == -0
print((x===0 && (1/x)===-Infinity));

prints true in Ionmonkey, false in interpreter.

Reason:
-0 + 0 = +0 // positive zero
but we remove the addition (as 0 is the identity function of addition)

So the test function becomes:

function test(i){
   return i * 0
}

Which gives negative zero when i < 0
Another fault in foldsto:

function test(i) {
    return 0 - i;
}

is folded to:

function test(i) {
    return i; // NOTICE THE LACK OF SIGN
}
Attached patch Patch for both issues (obsolete) — Splinter Review
This fixes both issues. I'll add both testcases and commit msg after review.
Attachment #606278 - Flags: review?(dvander)
Assignee: general → hv1989
s/substraction/subtraction/
Comment on attachment 606278 [details] [diff] [review]
Patch for both issues

Review of attachment 606278 [details] [diff] [review]:
-----------------------------------------------------------------

Nice catch!
Attachment #606278 - Flags: review?(dvander) → review+
Robert's nit addressed, together with commit description and author. Ready for checkin.
Attachment #606278 - Attachment is obsolete: true
Attachment #606517 - Flags: review+
Keywords: checkin-needed
Whiteboard: checkin on ionmonkey branch
Jan, can you check this in?
(In reply to Ryan VanderMeulen from comment #6)
> Jan, can you check this in?

Sure: http://hg.mozilla.org/projects/ionmonkey/rev/3a4607b336a8
Status: NEW → RESOLVED
Closed: 12 years ago
Keywords: checkin-needed
Resolution: --- → FIXED
Whiteboard: checkin on ionmonkey branch
You need to log in before you can comment on or make changes to this bug.