783493 - IonMonkey: Folding 0 / x to 0 is invalid if x <= 0

Status: RESOLVED DUPLICATE of bug 758376

(Core :: JavaScript Engine, defect)

Description

[Jan de Mooij [:jandem]]

I was just fuzzing Ion tip to test a patch and it came up with the following (reduced):

function f() {
    var x = 0;
    if (x / x == x)
        x = 33;
    assertEq(x, 0);
}
f();

This fails on revision 2b38908d7d54 with --ion-eager.

Small bug in MDiv::foldsTo:

// 0 / x -> 0
// x / 1 -> x
if (IsConstant(lhs(), 0) || IsConstant(rhs(), 1))
    return lhs();

0 / 0 is NaN.

Note that there's similar problem if x is negative (result is -0 instead of 0):

function f(y) {
    var x = 0;
    assertEq(x / y, -0);
}
f(-3);
f(-12);

test.js:3: Error: Assertion failed: got 0, expected -0

Comment 1

[Kannan Vijayan [:djvj]]

I thought we ran into and fixed this before?  I vaguely remember this being discussed a few months ago.

Comment 2

[David Anderson [:dvander] - inactive, e-mail if emergency]

Hrm, yeah, maybe a dupe of bug 758376?

Comment 3

[Jan de Mooij [:jandem]]

(In reply to David Anderson [:dvander] from comment #2)
> Hrm, yeah, maybe a dupe of bug 758376?

Yeah, can you land the patch there? Thanks.