[Webkit-unassigned] [Bug 166413] New: Math.min changes behavior with negative zero when tiering up

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=166413

            Bug ID: 166413
           Summary: Math.min changes behavior with negative zero when
                    tiering up
    Classification: Unclassified
           Product: WebKit
           Version: WebKit Nightly Build
          Hardware: Unspecified
                OS: Unspecified
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: JavaScriptCore
          Assignee: webkit-unassigned at lists.webkit.org
          Reporter: keith_miller at apple.com

It looks like the code converts the min(a, b) into a < b ? a : b. This does not work for -0.0 and 0.0: 

Test case:

function test(value, iter) {
    if (Infinity/value !== -Infinity)
        throw new Error(iter);
}
noInline(test);

function foo(a, b, iter) {
    test(Math.min(a, b), iter);
}
noInline(foo);

for (let i = 0; i < 10000; i++) {
    foo(-0.0, 0.0, i);
}

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.webkit.org/pipermail/webkit-unassigned/attachments/20161222/cfd6c2ff/attachment.html>