Bug 878429 - IonMonkey: don't conflate 0 and -0 in IsConstant (r=jandem)
authorLuke Wagner <luke@mozilla.com>
Mon, 10 Jun 2013 16:22:57 -0700
changeset 134581 8e30d56cf29d43ed0a43d905767ed96987254df2
parent 134580 9ce9c145e07238c62803c509c6f7d0db1b366402
child 134582 841ffd181e14667ea9a272ba169429db688caa8e
push id29283
push userlwagner@mozilla.com
push dateMon, 10 Jun 2013 23:42:33 +0000
treeherdermozilla-inbound@1eff67ffe6b9 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersjandem
bugs878429
milestone24.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 878429 - IonMonkey: don't conflate 0 and -0 in IsConstant (r=jandem)
js/src/ion/MIR.cpp
js/src/jit-test/tests/basic/testBug878429.js
--- a/js/src/ion/MIR.cpp
+++ b/js/src/ion/MIR.cpp
@@ -854,17 +854,24 @@ MBitNot::infer()
         specialization_ = MIRType_None;
     else
         specialization_ = MIRType_Int32;
 }
 
 static inline bool
 IsConstant(MDefinition *def, double v)
 {
-    return def->isConstant() && def->toConstant()->value().toNumber() == v;
+    if (!def->isConstant())
+        return false;
+
+    // Compare as bits to avoid conflating, e.g., -0 and 0.
+    mozilla::detail::DoublePun lhs, rhs;
+    lhs.d = def->toConstant()->value().toNumber();
+    rhs.d = v;
+    return lhs.u == rhs.u;
 }
 
 MDefinition *
 MBinaryBitwiseInstruction::foldsTo(bool useValueNumbers)
 {
     if (specialization_ != MIRType_Int32)
         return this;
 
new file mode 100644
--- /dev/null
+++ b/js/src/jit-test/tests/basic/testBug878429.js
@@ -0,0 +1,9 @@
+function negZeroMinusNegZero()
+{
+  var x = -0.0;
+  var y = -0.0;
+  return +(x - y);
+}
+
+assertEq(1 / negZeroMinusNegZero(), Infinity);
+assertEq(1 / negZeroMinusNegZero(), Infinity);