1124448 - Differential Testing: Different output message involving Math.max

Status: RESOLVED DUPLICATE of bug 1122402

(Core :: JavaScript Engine: JIT, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

function f(y) {
    (Math.max(-2147483649 >> 0, y >>> 0) | 0) >= false ? x : y
}
n = [0, -1]
for (var j = 0; j < 2; ++j) {
    try {
        print(f(n[j]))
    } catch (e) {}
}

$   ./js-dbg-opt-64-dm-nsprBuild-darwin-b7650eab6339 --fuzzing-safe --no-threads --ion-eager 8236.js

$   ./js-dbg-opt-64-dm-nsprBuild-darwin-b7650eab6339 --fuzzing-safe --no-threads --ion-eager --ion-check-range-analysis --no-sse3 8236.js
undefined

Tested this on m-c rev b7650eab6339.

My configure flags are:

CC="clang -Qunused-arguments" CXX="clang++ -Qunused-arguments" AR=ar AUTOCONF=/usr/local/Cellar/autoconf213/2.13/bin/autoconf213 sh /Users/skywalker/trees/mozilla-central/js/src/configure --target=x86_64-apple-darwin12.5.0 --enable-debug --enable-optimize --enable-nspr-build --enable-more-deterministic --with-ccache --enable-gczeal --enable-debug-symbols --disable-tests

autoBisect is running.

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Another bug that seems to go back before end-2013 ( https://hg.mozilla.org/mozilla-central/rev/df3c2a1e86d3 ).

Jan, any idea how to move this forward?

Comment 2

[Jan de Mooij [:jandem]]

Simpler test below.

$ ./js/src/js --ion-eager --no-threads test.js
test.js:7:0 Error: Assertion failed: got 1, expected 0

Works with --ion-range-analysis=off so I assume it's a RA bug.

function f(y) {
    var x1 = Math.max(-2147483649 >> 0, y >>> 0);
    var x2 = x1 | 0;
    return (x2 >= 0) ? 1 : 0;
}
assertEq(f(0), 1);
assertEq(f(-1), 0);

Comment 3

[Jan de Mooij [:jandem]]

It also works with --ion-check-range-analysis. A bit weird, I hope that flag is not hiding bugs it should be catching.

Comment 4

[Nicolas B. Pierron [:nbp]]

I guess this is likely a similar issue as Bug 1122402.

(In reply to Jan de Mooij [:jandem] from comment #3)
> It also works with --ion-check-range-analysis. A bit weird, I hope that flag
> is not hiding bugs it should be catching.

The reason is that the guards inserted by the assertion are not removable, so "-1 >>> 0" is still executed, and bails as expected.

Comment 5

[Dan Gohman [:sunfish]]

Is this fixed by the patch to bug 1122402?

Comment 6

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Nope it isn't, but then again, the patch there didn't fix the issue in that bug either.

Comment 7

[Nicolas B. Pierron [:nbp]]

Testing with the fixed patch from Bug 1122402, I cannot reproduce the differential behavior reported in comment 2.

I will push both test cases as part of Bug 1122402.

Comment 8

[Dan Gohman [:sunfish]]

The bug is resolved; clearing needinfo.