1122344 - Differential Testing: Different output message involving Math.round

Status: RESOLVED FIXED

(Core :: JavaScript Engine: JIT, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

function f() {
    print(Math.round(Math.fround(Math.expm1(Math.log2(4294967297)) | 0)))
};
f();
f();

$ ./js-dbg-opt-64-dm-nsprBuild-darwin-89a190592267 --fuzzing-safe --no-threads --ion-eager a2cjs.js
-13527757
-13527756

$ ./js-dbg-opt-64-dm-nsprBuild-darwin-89a190592267 --fuzzing-safe --no-threads --baseline-eager a2cjs.js
-13527757
-13527757

Tested this on m-c rev 89a190592267.

My configure flags are:

CC="clang -Qunused-arguments" CXX="clang++ -Qunused-arguments" AR=ar AUTOCONF=/usr/local/Cellar/autoconf213/2.13/bin/autoconf213 sh /Users/skywalker/trees/mozilla-central/js/src/configure --target=x86_64-apple-darwin12.5.0 --enable-debug --enable-optimize --enable-nspr-build --enable-more-deterministic --with-ccache --enable-gczeal --enable-debug-symbols --disable-tests

autoBisect is running.

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   https://hg.mozilla.org/mozilla-central/rev/a1b396e1f1dd
user:        Benjamin Bouvier
date:        Fri Feb 28 12:07:05 2014 +0100
summary:     Bug 930477: Specialize Round for Float32; r=jandem,mjrosenb

Benjamin, is bug 930477 a possible regressor?

Comment 2

[Benjamin Bouvier [:bbouvier] (inactive)]

Attachment: Fix rounding of big negative float32 values in Ion on x86

So that's the case from bug 1073910, showing up on x86.  It's already fixed on
ARM, but with some different implementation.  My new theory is that numbers
in [0.5, -0] should be added 0.5, and all other numbers 0.499999...

(These rounding errors are frustrating, but I cannot craft a nice single test
case file that would try all numbers.  I think the functions Math.round and
Math.round(Math.fround()) would need to get cloned at call-site in such a
perfect test case file, and each value should be tested against its own clone.
Tried a few things, but there's always sometimes that gets wrong at some
point...)

Comment 3

[Benjamin Bouvier [:bbouvier] (inactive)]

https://treeherder.mozilla.org/#/jobs?repo=try&revision=d5063d4f57e4

Comment 4

[Benjamin Bouvier [:bbouvier] (inactive)]

https://hg.mozilla.org/integration/mozilla-inbound/rev/d827cec0d975

Comment 5

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/d827cec0d975