Closed
Bug 783493
Opened 12 years ago
Closed 12 years ago
IonMonkey: Folding 0 / x to 0 is invalid if x <= 0
Categories
(Core :: JavaScript Engine, defect)
Core
JavaScript Engine
Tracking
()
RESOLVED
DUPLICATE
of bug 758376
People
(Reporter: jandem, Unassigned)
References
Details
I was just fuzzing Ion tip to test a patch and it came up with the following (reduced): function f() { var x = 0; if (x / x == x) x = 33; assertEq(x, 0); } f(); This fails on revision 2b38908d7d54 with --ion-eager. Small bug in MDiv::foldsTo: // 0 / x -> 0 // x / 1 -> x if (IsConstant(lhs(), 0) || IsConstant(rhs(), 1)) return lhs(); 0 / 0 is NaN. Note that there's similar problem if x is negative (result is -0 instead of 0): function f(y) { var x = 0; assertEq(x / y, -0); } f(-3); f(-12); test.js:3: Error: Assertion failed: got 0, expected -0
Comment 1•12 years ago
|
||
I thought we ran into and fixed this before? I vaguely remember this being discussed a few months ago.
Hrm, yeah, maybe a dupe of bug 758376?
Reporter | ||
Comment 3•12 years ago
|
||
(In reply to David Anderson [:dvander] from comment #2) > Hrm, yeah, maybe a dupe of bug 758376? Yeah, can you land the patch there? Thanks.
Status: NEW → RESOLVED
Closed: 12 years ago
Resolution: --- → DUPLICATE
You need to log in
before you can comment on or make changes to this bug.
Description
•