From e6d8c010cd78d89d8d8eb02b658e537cf12f28a5 Mon Sep 17 00:00:00 2001 From: Hannes Verschore Date: Tue, 30 Aug 2016 10:57:06 +0200 Subject: [PATCH] Bug 1293542 - IonMonkey: Fix the logic of pow, r=sunfish --- js/src/jit-test/tests/ion/bug1293542.js | 7 +++++++ js/src/jit/x86-shared/CodeGenerator-x86-shared.cpp | 11 ++++++----- 2 files changed, 13 insertions(+), 5 deletions(-) create mode 100644 js/src/jit-test/tests/ion/bug1293542.js diff --git a/js/src/jit-test/tests/ion/bug1293542.js b/js/src/jit-test/tests/ion/bug1293542.js new file mode 100644 index 000000000000..70183a246e7b --- /dev/null +++ b/js/src/jit-test/tests/ion/bug1293542.js @@ -0,0 +1,7 @@ + +function f(x) { + return (x ** (1 / ~4294967297)) && x; +}; +for (var i = 0; i < 2; ++i) { + assertEq(f(-Infinity), 0); +} diff --git a/js/src/jit/x86-shared/CodeGenerator-x86-shared.cpp b/js/src/jit/x86-shared/CodeGenerator-x86-shared.cpp index 934d57800ee0..9f16eddda8b6 100644 --- a/js/src/jit/x86-shared/CodeGenerator-x86-shared.cpp +++ b/js/src/jit/x86-shared/CodeGenerator-x86-shared.cpp @@ -878,8 +878,8 @@ CodeGeneratorX86Shared::visitPowHalfD(LPowHalfD* ins) masm.branchDouble(cond, input, scratch, &sqrt); // Math.pow(-Infinity, 0.5) == Infinity. - masm.zeroDouble(input); - masm.subDouble(scratch, input); + masm.zeroDouble(output); + masm.subDouble(scratch, output); masm.jump(&done); masm.bind(&sqrt); @@ -888,11 +888,12 @@ CodeGeneratorX86Shared::visitPowHalfD(LPowHalfD* ins) if (!ins->mir()->operandIsNeverNegativeZero()) { // Math.pow(-0, 0.5) == 0 == Math.pow(0, 0.5). Adding 0 converts any -0 to 0. masm.zeroDouble(scratch); - masm.addDouble(scratch, input); + masm.addDouble(input, scratch); + masm.vsqrtsd(scratch, output, output); + } else { + masm.vsqrtsd(input, output, output); } - masm.vsqrtsd(input, output, output); - masm.bind(&done); }