Closed Bug 783493 Opened 12 years ago Closed 12 years ago

IonMonkey: Folding 0 / x to 0 is invalid if x <= 0

Categories

(Core :: JavaScript Engine, defect)

defect
Not set
normal

Tracking

()

RESOLVED DUPLICATE of bug 758376

People

(Reporter: jandem, Unassigned)

References

Details

I was just fuzzing Ion tip to test a patch and it came up with the following (reduced):

function f() {
    var x = 0;
    if (x / x == x)
        x = 33;
    assertEq(x, 0);
}
f();

This fails on revision 2b38908d7d54 with --ion-eager.

Small bug in MDiv::foldsTo:

// 0 / x -> 0
// x / 1 -> x
if (IsConstant(lhs(), 0) || IsConstant(rhs(), 1))
    return lhs();

0 / 0 is NaN.

Note that there's similar problem if x is negative (result is -0 instead of 0):

function f(y) {
    var x = 0;
    assertEq(x / y, -0);
}
f(-3);
f(-12);

test.js:3: Error: Assertion failed: got 0, expected -0
I thought we ran into and fixed this before?  I vaguely remember this being discussed a few months ago.
(In reply to David Anderson [:dvander] from comment #2)
> Hrm, yeah, maybe a dupe of bug 758376?

Yeah, can you land the patch there? Thanks.
Status: NEW → RESOLVED
Closed: 12 years ago
Resolution: --- → DUPLICATE
You need to log in before you can comment on or make changes to this bug.