738941 - Very weird JS multiplying bug

Status: RESOLVED DUPLICATE of bug 716119

(Core :: JavaScript Engine, defect)

Description

[Jáchym Toušek]

Attachment: demo.zip

User Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:11.0) Gecko/20100101 Firefox/11.0
Build ID: 20120312181643

Steps to reproduce:

Go to the page http://demo.m33.cz/ (It's the same as the attached zip archive contents). There is demo of my project. In firefox it generates an alert with "BUG!" message after few seconds. In any other browser it does not.

On the page there is this code:

//application.js, line 112
function signum(n) {
	 return n > 0 ? 1 : n < 0 ? -1 : 0;
}

//...

//application.js, line 149
var tmx = mx;
var tmy = my;

mx *= signum(dx) * signum(m);
my *= signum(dy) * signum(m);

if (signum(dy) === -1 && signum(m) === -1 && my != tmy ) {
	alert('BUG!');
}



Actual results:

If you look at the condition, when both signum(dy) and signum(m) are -1 then "tmy" should be identical to "my". Yet it is not. For some reason "my" is "- tmy".


Expected results:

Well x * (-1) * (-1) should be x, not -x.

Comment 1

[Alice0775 White]

It seems to be fixed by Bug 716119

Comment 2

[Jáchym Toušek]

Seems that way. Firefox 12 beta works fine.