763883 - IonMonkey: (ARM) -x does not deal with INT_MIN properly

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Marty Rosenberg [:mjrosenb]]

Attachment: /home/mrosenberg/patches/fixNegate-r0.patch

It currently produces INT_MIN rather than -INT_MIN.

Comment 1

[Marty Rosenberg [:mjrosenb]]

Attachment: /home/mrosenberg/patches/fixNegate-r1.patch

with more qrefresh

Comment 2

[Jacob Bramley [:jbramley]]

Comment on attachment 632206 [details] [diff] [review]
/home/mrosenberg/patches/fixNegate-r1.patch

Review of attachment 632206 [details] [diff] [review]:
-----------------------------------------------------------------

r+ with the simple nits fixed.

::: js/src/ion/arm/CodeGenerator-arm.cpp
@@ +350,5 @@
>  {
>      const LAllocation *lhs = ins->getOperand(0);
>      const LAllocation *rhs = ins->getOperand(1);
>      const LDefinition *dest = ins->getDef(0);
> +    fprintf(stderr, "subtracting...\n");

This is surely debug code!

@@ +388,5 @@
> +            if (mul->canOverflow()) {
> +                masm.ma_cmp(ToRegister(dest), Imm32(INT_MIN));
> +                c = Assembler::Equal;
> +            }
> +            masm.ma_rsb(ToRegister(lhs), Imm32(0), ToRegister(dest));

Oh, it's simpler than that. I don't know why I didn't think of it when we discussed this on IRC, but you can simply do this:

rsbs dest, lhs, #0
bvs bailout

That is, the operation dest=0-lhs results in (signed) overflow iff lhs=INT_MIN, so you don't need a separate comparison.

Comment 3

[Marty Rosenberg [:mjrosenb]]

Landed: http://hg.mozilla.org/projects/ionmonkey/rev/15afceb8e292