Closed
Bug 517038
Opened 15 years ago
Closed 13 years ago
Any time 0 is multiplied by an integer, we end up taking an OVERFLOW_EXIT (== BRANCH_EXIT for branching purposes and such)
Categories
(Core :: JavaScript Engine, defect)
Tracking
()
RESOLVED
WONTFIX
People
(Reporter: bzbarsky, Unassigned)
References
Details
Attachments
(1 file)
|
(deleted),
application/x-javascript
|
Details |
The attached testcase hits two OVERFLOW_EXITs and one trace abort, presumably due to this guard in TraceRecorder::alu in the |default| case:
if (v == LIR_mul) // make sure we don't lose a -0
guard(false, lir->ins_eq0(result), exit);
This causes issues in a real-life testcase that has the following structure (after inlining):
function renderLevel(minimumLevel,level,y){
for (var x=0;x<243/level;x++){
node.style.left =(x*level)+'px';
}
}
In particular, the second time renderLevel is called, we will side-exit the loop with an OVERFLOW_EXIT because the multiplication by x will give 0.
I ran into this while looking at bug 424715.
|
||
Comment 1•13 years ago
|
||
Obsolete with the removal of tracejit.
Status: NEW → RESOLVED
Closed: 13 years ago
Resolution: --- → WONTFIX
You need to log in
before you can comment on or make changes to this bug.
Description
•