Bug 505003 - TM: Different values for modulo of negative number (-2 % 2). r=graydon.
authorJason Orendorff <jorendorff@mozilla.com>
Fri, 23 Oct 2009 13:15:10 -0500
changeset 34335 d01080e63d116c297be1976080c02bf100d8d909
parent 34334 90c7b4ae73ef0a9769851cb984b5315a3b85e85d
child 34336 b388d4491981da093603a764fddcaa99be9dd06e
push id1
push userroot
push dateTue, 26 Apr 2011 22:38:44 +0000
treeherdermozilla-beta@bfdb6e623a36 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersgraydon
bugs505003
milestone1.9.3a1pre
Bug 505003 - TM: Different values for modulo of negative number (-2 % 2). r=graydon.
js/src/jstracer.cpp
js/src/trace-test/tests/basic/testModuloWithNegative2.js
--- a/js/src/jstracer.cpp
+++ b/js/src/jstracer.cpp
@@ -8151,17 +8151,17 @@ TraceRecorder::alu(LOpcode v, jsdouble v
 
         /* If the result is not 0, it is always within the integer domain. */
         LIns* branch = lir->insBranch(LIR_jf, lir->ins_eq0(result), NULL);
 
         /*
          * If the result is zero, we must exit if the lhs is negative since
          * the result is -0 in this case, which is not in the integer domain.
          */
-        guard(false, lir->ins2i(LIR_lt, d1, 0), exit);
+        guard(false, lir->ins2i(LIR_lt, d0, 0), exit);
         branch->setTarget(lir->ins0(LIR_label));
         break;
       }
 #endif
 
       default:
         v = (LOpcode)((int)v & ~LIR64);
         result = lir->ins2(v, d0, d1);
new file mode 100644
--- /dev/null
+++ b/js/src/trace-test/tests/basic/testModuloWithNegative2.js
@@ -0,0 +1,7 @@
+function f(v, e) {
+    for (var i = 0; i < 9; i++)
+        v %= e;
+    return v;
+}
+f(0, 1);
+assertEq(f(-2, 2), -0);