1054568 - Differential Testing: Different output message involving right-shift zero

Status: RESOLVED FIXED

(Core :: JavaScript Engine: JIT, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

function f(y) {
    return (y | 0) - (y >>> 0) / 15 ^ 0
}
f(1 / 0)
print(f(1))

$ ./js-dbg-opt-64-dm-nsprBuild-darwin-174e75a23eaf --fuzzing-safe --ion-offthread-compile=off 237264.js
0

$ ./js-dbg-opt-64-dm-nsprBuild-darwin-174e75a23eaf --fuzzing-safe --ion-offthread-compile=off --ion-eager 237264.js
1

Tested this on m-c rev 174e75a23eaf.

My configure flags are:

CC="clang -Qunused-arguments" CXX="clang++ -Qunused-arguments" AR=ar sh /Users/skywalker/trees/mozilla-central/js/src/configure --target=x86_64-apple-darwin12.5.0 --enable-debug --enable-optimize --enable-gczeal --enable-debug-symbols --disable-tests --enable-more-deterministic --with-ccache --enable-nspr-build

Jan/Hannes, any idea what's going on here?

Comment 1

[Hannes Verschore [:h4writer]]

This looks like a truncation fault.

=> (1 - 0.1) | 0 
=> 0.9 | 0
=> 0

IonMonkey compiles as:
=> 1 | 0 - 0.1 | 0 
=> 1 - 0
=> 1

Needinfo to sunfish, nbp

Comment 2

[Dan Gohman [:sunfish]]

Attachment: udiv-remainder.patch

This patch makes unsigned division more consistent with signed division, and fixes this bug.

Comment 3

[Dan Gohman [:sunfish]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/b2d42dbdbfc8

Comment 4

[Ed Morley [:emorley]]

https://hg.mozilla.org/mozilla-central/rev/b2d42dbdbfc8