801830 - Ionmonkey: wrong negative zero check removal for Mull

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Hannes Verschore [:h4writer]]

Attachment: Testcase triggering bug

Should return "true". Reporting the returned value is a negative zero.
For IM (--ion-eager for this testcase) it returns false (i.e. not a negative zero).

Reason: MMul uses congruentTo to check if two definitions are the same. It should use the function EqualValues (or check the valuenumber).

Comment 1

[Hannes Verschore [:h4writer]]

Attachment: Patch

Comment 2

[Marty Rosenberg [:mjrosenb]]

Comment on attachment 671581 [details] [diff] [review]
Patch

Review of attachment 671581 [details] [diff] [review]:
-----------------------------------------------------------------

Ok, it really looks like we don't want to use congruentTo in most cases.  I'm trying to think of what we need it for ever, and am drawing a bit of a blank.

Comment 3

[Hannes Verschore [:h4writer]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/b21bafeb5b50
Sorry, I forgot to mention the reviewer :(

(In reply to Marty Rosenberg [:mjrosenb] from comment #2)
> Ok, it really looks like we don't want to use congruentTo in most cases. 
> I'm trying to think of what we need it for ever, and am drawing a bit of a
> blank.

Indeed EqualValues should be used. GVN uses congruenTo to determine if two definitions are the same. But uses more information to make the final decision. 
E.g. arr[1] and arr[1] are congruent to each other. But when there is a call between both accesses, the call could adjust the value. Therefore EqualValues will report false in that case.

Comment 4

[Terrence Cole [:terrence]]

Whoops, looks like I /was/ wrong in bug 689779.

Comment 5

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/b21bafeb5b50