1122403 - Differential Testing: Different output message involving asm.js

Status: RESOLVED FIXED

(Core :: JavaScript Engine: JIT, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

function g() {
    "use asm";
    function f() {
        return (1 & (1 / 0xffffffff)) | 0
    }
    return f
}
print(g()())

$ ./js-dbg-opt-32-dm-nsprBuild-darwin-89a190592267 --fuzzing-safe --no-threads --ion-eager 6059.js
1

$ ./js-dbg-opt-32-dm-nsprBuild-darwin-89a190592267 --fuzzing-safe --no-threads --baseline-eager --no-fpu 6059.js
0

Tested this on m-c rev 89a190592267.

My configure flags are:

LD=ld CROSS_COMPILE=1 CC="clang -Qunused-arguments -msse2 -mfpmath=sse -arch i386" RANLIB=ranlib CXX="clang++ -Qunused-arguments -msse2 -mfpmath=sse -arch i386" AS=$CC AR=ar STRIP="strip -x -S" HOST_CC="clang -Qunused-arguments -msse2 -mfpmath=sse" AUTOCONF=/usr/local/Cellar/autoconf213/2.13/bin/autoconf213 HOST_CXX="clang++ -Qunused-arguments -msse2 -mfpmath=sse" sh /Users/skywalker/trees/mozilla-central/js/src/configure --target=i386-apple-darwin9.2.0 --enable-macos-target=10.5 --enable-debug --enable-optimize --enable-nspr-build --enable-more-deterministic --with-ccache --enable-gczeal --enable-debug-symbols --disable-tests

autoBisect is running.

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

I can't seem to get a good bisection result. Setting needinfo? from Luke as a start.

Comment 2

[Luke Wagner [:luke]]

Odin produces the expression MAsmJSReturn(MBitAnd(1, MDiv(unsigned=true, 1, 0xffffffff))) and GVN replaces this with the constant 1.  Confirming this, toggling "--ion-gvn=on/off" changes the output when asm.js is enabled.

Comment 3

[Dan Gohman [:sunfish]]

Constant folding isn't handling unsigned div or mod properly. It's doing a plain divide, so 1/0xffffffff is evaluated as 1/-1.

Comment 4

[Dan Gohman [:sunfish]]

Attachment: fold-unsigned-div.patch

Constant folding of div and mod needs to be aware of the unsigned flag.

Comment 6

[Dan Gohman [:sunfish]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/a0171e579f20

Comment 7

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/a0171e579f20