Differential Testing: Different output message involving ternary constructs

RESOLVED FIXED in Firefox 35

Status

()

Core
JavaScript Engine: JIT
--
major
RESOLVED FIXED
4 years ago
4 years ago

People

(Reporter: gkw, Assigned: h4writer)

Tracking

(Blocks: 2 bugs, {regression, testcase})

Trunk
mozilla35
x86_64
Mac OS X
regression, testcase
Points:
---
Dependency tree / graph

Firefox Tracking Flags

(firefox35 fixed)

Details

Attachments

(1 attachment)

(Reporter)

Description

4 years ago
function f(y) {
    return ((y ? y : 0) ? 0 : y)
}
m = [0xf]
f(m[0])
print(f(m[0]))

$ ./js-dbg-opt-64-dm-nsprBuild-darwin-eaa80e4597a2 --fuzzing-safe --no-threads --ion-eager testcase.js
15

$ ./js-dbg-opt-64-dm-nsprBuild-darwin-eaa80e4597a2 --fuzzing-safe --no-threads --baseline-eager testcase.js
0

Tested this on m-c rev eaa80e4597a2.

My configure flags are:

CC="clang -Qunused-arguments" CXX="clang++ -Qunused-arguments" AR=ar sh /Users/skywalker/trees/mozilla-central/js/src/configure --target=x86_64-apple-darwin12.5.0 --enable-debug --enable-optimize --enable-nspr-build --enable-more-deterministic --with-ccache --enable-gczeal --enable-debug-symbols --disable-tests

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   https://hg.mozilla.org/mozilla-central/rev/6465e8acae5e
user:        Hannes Verschore
date:        Tue Sep 23 09:42:05 2014 +0200
summary:     Bug 1064537: IonMonkey: Try folding ternary constructs, r=nbp

Hannes, is bug 1064537 likely related?
Flags: needinfo?(hv1989)
(Assignee)

Comment 1

4 years ago
Created attachment 8500954 [details] [diff] [review]
Patch

Since we increased the scope to use dominator tree information, the test and the phi can be far away and a lot can happen in between. As a result the true branch can dominate both predecessors of the MPhi. In that case the optimization is bogus. So disallow this.
Assignee: nobody → hv1989
Attachment #8500954 - Flags: review?(nicolas.b.pierron)
Flags: needinfo?(hv1989)
Comment on attachment 8500954 [details] [diff] [review]
Patch

Review of attachment 8500954 [details] [diff] [review]:
-----------------------------------------------------------------

Whoa, I was not aware of resolution of Bug 1028580.
Attachment #8500954 - Flags: review?(nicolas.b.pierron) → review+
https://hg.mozilla.org/mozilla-central/rev/9da8f4e52207
Status: NEW → RESOLVED
Last Resolved: 4 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla35
You need to log in before you can comment on or make changes to this bug.