Do not return the constant singleton float -0.0 from UnaryOpStub, because it may...

Review URL: http://codereview.chromium.org/3748007

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@5631 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

diff --git a/src/x64/code-stubs-x64.cc b/src/x64/code-stubs-x64.cc
index b050ec8..d592037 100644 (file)
--- a/src/x64/code-stubs-x64.cc
+++ b/src/x64/code-stubs-x64.cc
@@ -1413,20 +1413,8 @@ void GenericUnaryOpStub::Generate(MacroAssembler* masm) {
         __ j(equal, &done);
       }
       __ SmiNeg(rax, rax, &done);
+      __ jmp(&slow);  // zero, if not handled above, and Smi::kMinValue.
 
-      // Either zero or Smi::kMinValue, neither of which become a smi when
-      // negated. We handle negative zero here if required. We always enter
-      // the runtime system if we have Smi::kMinValue.
-      if (negative_zero_ == kStrictNegativeZero) {
-        __ SmiCompare(rax, Smi::FromInt(0));
-        __ j(not_equal, &slow);
-        __ Move(rax, Factory::minus_zero_value());
-        __ jmp(&done);
-      } else  {
-        __ SmiCompare(rax, Smi::FromInt(Smi::kMinValue));
-        __ j(equal, &slow);
-        __ jmp(&done);
-      }
       // Try floating point case.
       __ bind(&try_float);
     } else if (FLAG_debug_code) {

diff --git a/test/mjsunit/smi-negative-zero.js b/test/mjsunit/smi-negative-zero.js
index 6906443..ea2fa5a 100644 (file)
--- a/test/mjsunit/smi-negative-zero.js
+++ b/test/mjsunit/smi-negative-zero.js
@@ -98,3 +98,16 @@ assertEquals(-Infinity, one / (-4 % 2), "fiskhest1");
 assertEquals(-Infinity, one / (-4 % -2), "fiskhest2");
 assertEquals(Infinity, one / (4 % 2), "fiskhest3");
 assertEquals(Infinity, one / (4 % -2), "fiskhest4");
+
+
+// This tests against a singleton -0.0 object being overwritten.gc
+x = 0;
+z = 3044;
+
+function foo(x) {
+  var y = -x + z;
+  return -x;
+}
+
+assertEquals(0, foo(x));
+assertEquals(0, foo(x));