diff --git a/js/src/builtin/ParallelArray.js b/js/src/builtin/ParallelArray.js index 0d6631d8f6c0..e4cd21294f83 100644 --- a/js/src/builtin/ParallelArray.js +++ b/js/src/builtin/ParallelArray.js @@ -123,10 +123,6 @@ function StepIndices(shape, indices) { } } -function IsInteger(v) { - return (v | 0) === v; -} - // Constructor // // We split the 3 construction cases so that we don't case on arguments. @@ -835,8 +831,7 @@ function ParallelArrayScatter(targets, defaultValue, conflictFunc, length, mode) for (; indexPos < indexEnd; indexPos++) { var x = self.get(indexPos); - var t = targets[indexPos]; - checkTarget(indexPos, t); + var t = checkTarget(indexPos, targets[indexPos]); if (t < outputStart || t >= outputEnd) continue; if (conflicts[t]) @@ -891,8 +886,7 @@ function ParallelArrayScatter(targets, defaultValue, conflictFunc, length, mode) var conflicts = localConflicts[sliceId]; while (indexPos < indexEnd) { var x = self.get(indexPos); - var t = targets[indexPos]; - checkTarget(indexPos, t); + var t = checkTarget(indexPos, targets[indexPos]); if (conflicts[t]) x = collide(x, localbuffer[t]); UnsafeSetElement(localbuffer, t, x, @@ -937,8 +931,7 @@ function ParallelArrayScatter(targets, defaultValue, conflictFunc, length, mode) for (var i = 0; i < targetsLength; i++) { var x = self.get(i); - var t = targets[i]; - checkTarget(i, t); + var t = checkTarget(i, targets[i]); if (conflicts[t]) x = collide(x, buffer[t]); @@ -950,11 +943,14 @@ function ParallelArrayScatter(targets, defaultValue, conflictFunc, length, mode) } function checkTarget(i, t) { - if ((t | 0) !== t) - ThrowError(JSMSG_PAR_ARRAY_SCATTER_BAD_TARGET, i); + if (TO_INT32(t) !== t) + ThrowError(JSMSG_PAR_ARRAY_SCATTER_BAD_TARGET, i); - if (t < 0 || t >= length) - ThrowError(JSMSG_PAR_ARRAY_SCATTER_BOUNDS); + if (t < 0 || t >= length) + ThrowError(JSMSG_PAR_ARRAY_SCATTER_BOUNDS); + + // It's not enough to return t, as -0 | 0 === -0. + return TO_INT32(t); } } diff --git a/js/src/builtin/Utilities.js b/js/src/builtin/Utilities.js index f08d2a9e301e..fd52573d644f 100644 --- a/js/src/builtin/Utilities.js +++ b/js/src/builtin/Utilities.js @@ -24,6 +24,7 @@ */ /* Utility macros */ +#define TO_INT32(x) (x | 0) #define TO_UINT32(x) (x >>> 0) /* cache built-in functions before applications can change them */ diff --git a/js/src/jit-test/tests/parallelarray/bug857846.js b/js/src/jit-test/tests/parallelarray/bug857846.js new file mode 100644 index 000000000000..88139ea220aa --- /dev/null +++ b/js/src/jit-test/tests/parallelarray/bug857846.js @@ -0,0 +1,7 @@ +function testNegativeZeroScatter() { + // Don't crash. + var p = new ParallelArray([0]); + var r = p.scatter([-0], 0, undefined, 1); +} + +testNegativeZeroScatter();