Closed Bug 878435 Opened 6 years ago Closed 6 years ago

OdinMonkey: (0 > (0x80000000 | 0)) is wrong

Categories

(Core :: JavaScript Engine, defect)

x86_64
macOS
defect
Not set

Tracking

()

RESOLVED FIXED
mozilla24

People

(Reporter: jruderman, Assigned: bbouvier)

References

(Blocks 1 open bug)

Details

(Keywords: testcase)

Attachments

(1 file)

function g()
{
  "use asm";
  function f()
  {
    return (0 > (0x80000000 | 0)) | 0;
  }
  return f;
}

print(g()());

asm.js result: 0
normal result: 1
Looking at the code showed that the constant 0 was directly put in the output register. This happened because the comparison was folded during GVN. The only single problem is that the comparison occurred on *unsigned* int32 values, hence the patch.
Assignee: general → bbouvier
Status: NEW → ASSIGNED
Attachment #759513 - Flags: review?(luke)
Comment on attachment 759513 [details] [diff] [review]
proposed fix + test case

D'oh!  Fixnums are both signed and unsigned... nice find and perfect fix!
Attachment #759513 - Flags: review?(luke) → review+
Keywords: checkin-needed
Going to go out on a limb that opt builds don't care for disassemble.
https://hg.mozilla.org/mozilla-central/rev/5a6922661215
Status: ASSIGNED → RESOLVED
Closed: 6 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla24
You need to log in before you can comment on or make changes to this bug.