Bug 1308802: IonMonkey - Folding ToInt32 shouldn't happen for negative zero, r=nbp
authorHannes Verschore <hv1989@gmail.com>
Wed, 19 Oct 2016 11:50:01 +0200
changeset 318634 a9ee75a0ae5a70198dc86bb6d6d1edeebaa04564
parent 318633 494b04936295e3826d16172bb68cc25c3c5d043b
child 318635 815de87b6dbaad501c84fa221630e9597f0caaf6
push id20725
push userphilringnalda@gmail.com
push dateThu, 20 Oct 2016 01:36:01 +0000
treeherderfx-team@998ad5a74da8 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersnbp
bugs1308802
milestone52.0a1
Bug 1308802: IonMonkey - Folding ToInt32 shouldn't happen for negative zero, r=nbp
js/src/jit-test/tests/ion/bug1308802.js
js/src/jit/MIR.cpp
new file mode 100644
--- /dev/null
+++ b/js/src/jit-test/tests/ion/bug1308802.js
@@ -0,0 +1,8 @@
+
+function test() {
+    for (var i = 0; i < 2; ++i) {
+        assertEq(Math.max(-0), -0);
+    }
+}
+test();
+
--- a/js/src/jit/MIR.cpp
+++ b/js/src/jit/MIR.cpp
@@ -4063,17 +4063,17 @@ MToInt32::foldsTo(TempAllocator& alloc)
                        convert == MacroAssembler::IntConversion_NumbersOrBoolsOnly);
             return MConstant::New(alloc, Int32Value(input->toConstant()->toBoolean()));
           case MIRType::Int32:
             return MConstant::New(alloc, Int32Value(input->toConstant()->toInt32()));
           case MIRType::Float32:
           case MIRType::Double:
             int32_t ival;
             // Only the value within the range of Int32 can be substituted as constant.
-            if (mozilla::NumberEqualsInt32(input->toConstant()->numberToDouble(), &ival))
+            if (mozilla::NumberIsInt32(input->toConstant()->numberToDouble(), &ival))
                 return MConstant::New(alloc, Int32Value(ival));
             break;
           default:
             break;
         }
     }
 
     if (input->type() == MIRType::Int32)