[Webkit-unassigned] [Bug 68166] New: unsigned bit shift fails under certain conditions - REPRODUCIBLE

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=68166

           Summary: unsigned bit shift fails under certain conditions -
                    REPRODUCIBLE
           Product: WebKit
           Version: 528+ (Nightly build)
          Platform: PC
        OS/Version: Windows 7
            Status: UNCONFIRMED
          Severity: Normal
          Priority: P2
         Component: JavaScriptCore
        AssignedTo: webkit-unassigned at lists.webkit.org
        ReportedBy: keith.thorne at nokia.com


A code snippet will explain it best:

        var i = 0,
            value = -1698987653.3475556;

        var j = (value >>> (i * 8)) % 256;

(I know that the value is a weird number, but it is what I had in this case).

So, in the above code snippet on Webkit for windows, the formula will return -2 as the answer, which is wrong, as it should return 254 (as it does on all other browsers).
If, however, you do this:

       var value = -1698987653.3475556;

       var j = (value >>> (0 * 8)) % 256;

Note that I have just replaced the i with a 0, the returned value is correct. If the initial value is positive, then the first code snippet works as expected, so the point is, with a negative value and an assigned variable instead of a hard coded integer, the unsigned right shift will fail.

NOTE: the modular is simply there because I had it in my code, it does not really make a difference to the bug itself
NOTE 2: I did not try this with an unsigned left shift
NOTE 3: A signed right shift works as expected.

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.