Last Comment Bug 878435 - OdinMonkey: (0 > (0x80000000 | 0)) is wrong
: OdinMonkey: (0 > (0x80000000 | 0)) is wrong
Status: RESOLVED FIXED
: testcase
Product: Core
Classification: Components
Component: JavaScript Engine (show other bugs)
: Trunk
: x86_64 Mac OS X
: -- normal (vote)
: mozilla24
Assigned To: Benjamin Bouvier [:bbouvier]
:
Mentors:
Depends on:
Blocks: jsfunfuzz odinfuzz
  Show dependency treegraph
 
Reported: 2013-06-01 05:51 PDT by Jesse Ruderman
Modified: 2013-06-07 12:31 PDT (History)
5 users (show)
ryanvm: in‑testsuite+
See Also:
Crash Signature:
(edit)
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---


Attachments
proposed fix + test case (1.62 KB, patch)
2013-06-06 17:05 PDT, Benjamin Bouvier [:bbouvier]
luke: review+
Details | Diff | Review

Description Jesse Ruderman 2013-06-01 05:51:30 PDT
function g()
{
  "use asm";
  function f()
  {
    return (0 > (0x80000000 | 0)) | 0;
  }
  return f;
}

print(g()());

asm.js result: 0
normal result: 1
Comment 1 Benjamin Bouvier [:bbouvier] 2013-06-06 17:05:10 PDT
Created attachment 759513 [details] [diff] [review]
proposed fix + test case

Looking at the code showed that the constant 0 was directly put in the output register. This happened because the comparison was folded during GVN. The only single problem is that the comparison occurred on *unsigned* int32 values, hence the patch.
Comment 2 Luke Wagner [:luke] 2013-06-06 18:11:23 PDT
Comment on attachment 759513 [details] [diff] [review]
proposed fix + test case

D'oh!  Fixnums are both signed and unsigned... nice find and perfect fix!
Comment 3 Ryan VanderMeulen [:RyanVM] 2013-06-07 05:25:10 PDT
https://hg.mozilla.org/integration/mozilla-inbound/rev/aa9a0b34bbd8
Comment 5 Ryan VanderMeulen [:RyanVM] 2013-06-07 08:08:23 PDT
Going to go out on a limb that opt builds don't care for disassemble.
Comment 6 Ryan VanderMeulen [:RyanVM] 2013-06-07 08:17:03 PDT
Whoops, I meant to backout bug 878495, not this one. Re-landed.
https://hg.mozilla.org/integration/mozilla-inbound/rev/5a6922661215
Comment 7 Ryan VanderMeulen [:RyanVM] 2013-06-07 12:31:20 PDT
https://hg.mozilla.org/mozilla-central/rev/5a6922661215

Note You need to log in before you can comment on or make changes to this bug.