Bug 831087 - IonMonkey: Differential Testing: Getting different output w/without --ion-eager with /=. r=mjrosenb, a=lsblakk
authorHannes Verschore <hv1989@gmail.com>
Mon, 21 Jan 2013 13:26:26 -0800
changeset 123770 26eda9e60b4df2ee68a9c37c40f459c531df0e05
parent 123769 90839133382ebbf7651be9fefbf6e69124461ac1
child 123771 ee5b2e692449a2c4bdd83924d4e0e14f7a44dae5
push idunknown
push userunknown
push dateunknown
reviewersmjrosenb, lsblakk
bugs831087
milestone20.0a2
Bug 831087 - IonMonkey: Differential Testing: Getting different output w/without --ion-eager with /=. r=mjrosenb, a=lsblakk
js/src/ion/MIR.cpp
js/src/jit-test/tests/ion/bug831087.js
--- a/js/src/ion/MIR.cpp
+++ b/js/src/ion/MIR.cpp
@@ -780,26 +780,26 @@ void
 MDiv::analyzeEdgeCasesForward()
 {
     // This is only meaningful when doing integer division.
     if (specialization_ != MIRType_Int32)
         return;
 
     // Try removing divide by zero check
     if (rhs()->isConstant() && !rhs()->toConstant()->value().isInt32(0))
-        canBeDivideByZero_ =  false;
+        canBeDivideByZero_ = false;
 
     // If lhs is a constant int != INT32_MIN, then
     // negative overflow check can be skipped.
     if (lhs()->isConstant() && !lhs()->toConstant()->value().isInt32(INT32_MIN))
-        setCanBeNegativeZero(false);
+        canBeNegativeOverflow_ = false;
 
     // If rhs is a constant int != -1, likewise.
     if (rhs()->isConstant() && !rhs()->toConstant()->value().isInt32(-1))
-        setCanBeNegativeZero(false);
+        canBeNegativeOverflow_ = false;
 
     // If lhs is != 0, then negative zero check can be skipped.
     if (lhs()->isConstant() && !lhs()->toConstant()->value().isInt32(0))
         setCanBeNegativeZero(false);
 
     // If rhs is >= 0, likewise.
     if (rhs()->isConstant()) {
         const js::Value &val = rhs()->toConstant()->value();
new file mode 100644
--- /dev/null
+++ b/js/src/jit-test/tests/ion/bug831087.js
@@ -0,0 +1,15 @@
+function isNegZero(x) {
+  return x===0 && (1/x)===-Infinity;
+}
+
+try {
+    for (y = 0; y < 1; y++) {
+        x = y;
+    }
+} catch (e) {}
+
+function f() {
+    (x /= -9)
+}
+f()
+assertEq(isNegZero(this.x), true);