Bug 1072691: IonMonkey: Fix case of negative zero when folding ternary structure, r=nbp

This commit is contained in:
Hannes Verschore 2014-09-26 15:15:23 +02:00
parent fcbc6ca309
commit 72be8668ab
2 changed files with 19 additions and 2 deletions

View File

@ -0,0 +1,17 @@
function test(a) {
return (a)?a:0;
}
function test2(a) {
return (a)?0:a;
}
function isNegativeZero(x) {
return x===0 && (1/x)===-Infinity;
}
test(0)
assertEq(isNegativeZero(test(-0)), false)
assertEq(isNegativeZero(test(-0)), false)
assertEq(isNegativeZero(test2(-0)), true)
assertEq(isNegativeZero(test2(-0)), true)

View File

@ -1222,10 +1222,10 @@ MPhi::foldsTernary()
if (testArg != test->input())
return nullptr;
// If testArg is a number type we can:
// If testArg is an int32 type we can:
// - fold testArg ? testArg : 0 to testArg
// - fold testArg ? 0 : testArg to 0
if (IsNumberType(testArg->type()) && c->vp()->toNumber() == 0) {
if (testArg->type() == MIRType_Int32 && c->vp()->toNumber() == 0) {
// When folding to the constant we need to hoist it.
if (trueDef == c && !c->block()->dominates(block()))
c->block()->moveBefore(pred->lastIns(), c);