878435 - OdinMonkey: (0 > (0x80000000 | 0)) is wrong

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Jesse Ruderman]

function g()
{
  "use asm";
  function f()
  {
    return (0 > (0x80000000 | 0)) | 0;
  }
  return f;
}

print(g()());

asm.js result: 0
normal result: 1

Comment 1

[Benjamin Bouvier [:bbouvier] (inactive)]

Attachment: proposed fix + test case

Looking at the code showed that the constant 0 was directly put in the output register. This happened because the comparison was folded during GVN. The only single problem is that the comparison occurred on *unsigned* int32 values, hence the patch.

Comment 2

[Luke Wagner [:luke]]

Comment on attachment 759513 [details] [diff] [review]
proposed fix + test case

D'oh!  Fixnums are both signed and unsigned... nice find and perfect fix!

Comment 3

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/aa9a0b34bbd8

Comment 4

[Ryan VanderMeulen [:RyanVM]]

Backed out for test failures.
https://hg.mozilla.org/integration/mozilla-inbound/rev/8cf56f52e57c

https://tbpl.mozilla.org/php/getParsedLog.php?id=23901715&tree=Mozilla-Inbound

Comment 5

[Ryan VanderMeulen [:RyanVM]]

Going to go out on a limb that opt builds don't care for disassemble.

Comment 6

[Ryan VanderMeulen [:RyanVM]]

Whoops, I meant to backout bug 878495, not this one. Re-landed.
https://hg.mozilla.org/integration/mozilla-inbound/rev/5a6922661215

Comment 7

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/5a6922661215