(function(){ print(8>>1); })(); ./js 4 ./js -m 0

Easy one-character fix.

Comment on attachment 463073 [details] [diff] [review] Patch r=me but we should really just be calling JSOpBinaryTryConstantFold() here, as per bug 578517 comment #13

And by "here" I mean at the top of the function.

My mistake, thanks for picking up the patch, Alan. I'm learning that I need to write more tests than just a few sanity checks for my ops.

Added a few test cases and made it call JSOpBinaryTryConstantFold instead. We need to go through ValueToECMAInt32 for shifts, so I reworked JSOpBinaryTryConstantFold a bit.

(In reply to comment #4) No worries - can't catch everything, this is what the fuzzer is for ;)

Comment on attachment 463084 [details] [diff] [review] Patch, v2 Sorry Alan, forgot that the folder needed changes. Thanks for taking.

Comment on attachment 463084 [details] [diff] [review] Patch, v2 >+ /* TODO: Check for conversion failure. */ Conversion failure isn't possible on a primitive, IIRC.

Indeed, primitives convert infallibly (may result in NaN -> 0, -0 -> 0, e.g.). The L and R locals stand out much better, even though prevailing style avoids capitalizing local and member names. Maybe that would help in general, although it starts to get shout-y. "l" is obviously a bad local name because it looks like a 1 in too many fonts. /be