php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login

go to bug id or search bugs for

Bug #48418 NaN > NaN, NaN > 0, NaN < 0 return true
Submitted: 2009-05-28 18:57 UTC Modified: 2015-06-14 23:01 UTC
Votes:16
Avg. Score:4.2 ± 0.8
Reproduced:13 of 13 (100.0%)
Same Version:7 (53.8%)
Same OS:6 (46.2%)
From: phplists at stanvassilev dot com Assigned: cmb (profile)
Status: Closed Package: Math related
PHP Version: 5.*, 6 (2009-08-04) OS: *
Private report: No CVE-ID: None
View Developer Edit
 [2009-05-28 18:57 UTC] phplists at stanvassilev dot com 
Description:
------------
Tested on Gentoo, CentOS, OSX. 

This is possibly NOT related to the Windows NaN bug, as Windows is NOT 
affected by this issue. 

However, please test if any fix doesn't cause regression on Windows.

NaN > NaN, NaN > 0, NaN < 0 return true, while they should return false 
in all cases (any comparison where either side is NaN, should return 
false).

Reproduce code:
---------------
$NaN = sqrt(-1);
var_dump($NaN > $NaN);
var_dump($NaN > 0);
var_dump($NaN < 0); 

Expected result:
----------------
float(NAN)
bool(false)
bool(false)
bool(false)

Actual result:
--------------
float(NAN)
bool(true)
bool(true)
bool(true)

Patches

Pull Requests

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2009-05-28 19:05 UTC] phplists at stanvassilev dot com 
And to add a note:

$NaN >= $NaN
$NaN >= 0
$NaN <= 0

These also return true and must return false.
 [2009-05-30 19:48 UTC] kalle@php.net 
C:\php\src>php -v
PHP 5.3.0RC3-dev (cli) (built: May 29 2009 09:57:23)
Copyright (c) 1997-2009 The PHP Group
Zend Engine v2.3.0, Copyright (c) 1998-2009 Zend Technologies

C:\php\src>php -r "$nan = sqrt(-1); var_dump($nan, $nan > $nan, $nan < 0, $nan > 0);"
float(NAN)
bool(true)
bool(true)
bool(true)

Same on Windows
 [2009-10-13 05:14 UTC] chrisstocktonaz at gmail dot com 
Sorry for the extra noise, took a harder look and here is the real fix.

Index: Zend/zend_operators.c
===================================================================
--- Zend/zend_operators.c	(revision 289604)
+++ Zend/zend_operators.c	(working copy)
@@ -1360,17 +1360,17 @@
 
 			case TYPE_PAIR(IS_DOUBLE, IS_LONG):
 				Z_DVAL_P(result) = Z_DVAL_P(op1) - (double)Z_LVAL_P(op2);
-				ZVAL_LONG(result, ZEND_NORMALIZE_BOOL(Z_DVAL_P(result)));
+				ZVAL_LONG(result, zend_isnan(Z_DVAL_P(op1)) ? 1 : ZEND_NORMALIZE_BOOL(Z_DVAL_P(result)));
 				return SUCCESS;
 
 			case TYPE_PAIR(IS_LONG, IS_DOUBLE):
 				Z_DVAL_P(result) = (double)Z_LVAL_P(op1) - Z_DVAL_P(op2);
-				ZVAL_LONG(result, ZEND_NORMALIZE_BOOL(Z_DVAL_P(result)));
+				ZVAL_LONG(result, zend_isnan(Z_DVAL_P(op2)) ? 1 : ZEND_NORMALIZE_BOOL(Z_DVAL_P(result)));
 				return SUCCESS;
 
 			case TYPE_PAIR(IS_DOUBLE, IS_DOUBLE):
 				Z_DVAL_P(result) = Z_DVAL_P(op1) - Z_DVAL_P(op2);
-				ZVAL_LONG(result, ZEND_NORMALIZE_BOOL(Z_DVAL_P(result)));
+				ZVAL_LONG(result, (zend_isnan(Z_DVAL_P(op1)) || zend_isnan(Z_DVAL_P(op2))) ? 1 : ZEND_NORMALIZE_BOOL(Z_DVAL_P(result)));
 				return SUCCESS;
 
 			case TYPE_PAIR(IS_ARRAY, IS_ARRAY):
 [2010-01-10 08:19 UTC] for-bugs at hnw dot jp 
This is good fix. The fix affects only following comparisons:
 
 * NaN < [any number]
 * Inf < Inf
 * -Inf < -Inf

They are all ture on my machine, but all should be false.
 [2010-01-10 11:49 UTC] for-bugs at hnw dot jp 
Sorry, previous post was incollect. chrisstocktonaz's patch fixes my first comparison. I think following patch is better.

--- php-5.3.1-orig/Zend/zend_operators.c        2010-01-10 20:41:36.000000000 +0900
+++ php-5.3.1/Zend/zend_operators.c     2010-01-10 20:44:58.000000000 +0900
@@ -1360,16 +1360,19 @@
 
                        case TYPE_PAIR(IS_DOUBLE, IS_LONG):
                                Z_DVAL_P(result) = Z_DVAL_P(op1) - (double)Z_LVAL_P(op2);
+                               if (zend_isnan(Z_DVAL_P(result))) { Z_DVAL_P(result) = 1; }
                                ZVAL_LONG(result, ZEND_NORMALIZE_BOOL(Z_DVAL_P(result)));
                                return SUCCESS;
 
                        case TYPE_PAIR(IS_LONG, IS_DOUBLE):
                                Z_DVAL_P(result) = (double)Z_LVAL_P(op1) - Z_DVAL_P(op2);
+                               if (zend_isnan(Z_DVAL_P(result))) { Z_DVAL_P(result) = 1; }
                                ZVAL_LONG(result, ZEND_NORMALIZE_BOOL(Z_DVAL_P(result)));
                                return SUCCESS;
 
                        case TYPE_PAIR(IS_DOUBLE, IS_DOUBLE):
                                Z_DVAL_P(result) = Z_DVAL_P(op1) - Z_DVAL_P(op2);
+                               if (zend_isnan(Z_DVAL_P(result))) { Z_DVAL_P(result) = 1; }
                                ZVAL_LONG(result, ZEND_NORMALIZE_BOOL(Z_DVAL_P(result)));
                                return SUCCESS;
 [2015-06-14 23:01 UTC] cmb@php.net
-Status: Verified +Status: Closed -Assigned To: +Assigned To: cmb
 [2015-06-14 23:01 UTC] cmb@php.net 
This bug has been fixed as of PHP 5.4.0, see
<http://3v4l.org/2KCXi>.
 
PHP Copyright © 2001-2025 The PHP Group
All rights reserved. 		Last updated: Sat Nov 29 19:00:01 2025 UTC