Bug 831087 - IonMonkey: Differential Testing: Getting different output w/without --ion-eager with /=. r=mjrosenb, a=lsblakk
--- a/js/src/ion/MIR.cpp
+++ b/js/src/ion/MIR.cpp
@@ -780,26 +780,26 @@ void
MDiv::analyzeEdgeCasesForward()
{
// This is only meaningful when doing integer division.
if (specialization_ != MIRType_Int32)
return;
// Try removing divide by zero check
if (rhs()->isConstant() && !rhs()->toConstant()->value().isInt32(0))
- canBeDivideByZero_ = false;
+ canBeDivideByZero_ = false;
// If lhs is a constant int != INT32_MIN, then
// negative overflow check can be skipped.
if (lhs()->isConstant() && !lhs()->toConstant()->value().isInt32(INT32_MIN))
- setCanBeNegativeZero(false);
+ canBeNegativeOverflow_ = false;
// If rhs is a constant int != -1, likewise.
if (rhs()->isConstant() && !rhs()->toConstant()->value().isInt32(-1))
- setCanBeNegativeZero(false);
+ canBeNegativeOverflow_ = false;
// If lhs is != 0, then negative zero check can be skipped.
if (lhs()->isConstant() && !lhs()->toConstant()->value().isInt32(0))
setCanBeNegativeZero(false);
// If rhs is >= 0, likewise.
if (rhs()->isConstant()) {
const js::Value &val = rhs()->toConstant()->value();
new file mode 100644
--- /dev/null
+++ b/js/src/jit-test/tests/ion/bug831087.js
@@ -0,0 +1,15 @@
+function isNegZero(x) {
+ return x===0 && (1/x)===-Infinity;
+}
+
+try {
+ for (y = 0; y < 1; y++) {
+ x = y;
+ }
+} catch (e) {}
+
+function f() {
+ (x /= -9)
+}
+f()
+assertEq(isNegZero(this.x), true);