Bug 166413 – Math.min changes behavior with negative zero when tiering up

• Component: JavaScriptCore
• Status: NEW

[Keith Miller]

It looks like the code converts the min(a, b) into a < b ? a : b. This does not work for -0.0 and 0.0: 

Test case:

function test(value, iter) {
    if (Infinity/value !== -Infinity)
        throw new Error(iter);
}
noInline(test);

function foo(a, b, iter) {
    test(Math.min(a, b), iter);
}
noInline(foo);

for (let i = 0; i < 10000; i++) {
    foo(-0.0, 0.0, i);
}

[Radar WebKit Bug Importer]

<rdar://problem/29783164>