1126066 - Differential Testing: Different output message involving Math.max

Status: RESOLVED FIXED

(Core :: JavaScript Engine: JIT, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

function f(x) {
    0 < (Math.max(x >>> 0, (2147483649 !== 0) >> 0) | 0) ? undefined() : x;
};
try {
    f(4294967296);
    f(4294967296);
} catch (e) {}
try {
    print(f(2147483649));
    f(4294967296);
} catch (e) {}


$ ./js-dbg-opt-32-dm-nsprBuild-armSim-darwin-95c76c3b0172 --fuzzing-safe --no-threads --ion-eager testcase.js

$ ./js-dbg-opt-32-dm-nsprBuild-armSim-darwin-95c76c3b0172 --fuzzing-safe --no-threads --ion-eager --ion-check-range-analysis --no-sse3 testcase.js
undefined

Tested this on m-c rev 95c76c3b0172.

My configure flags are:

LD=ld CROSS_COMPILE=1 CC="clang -Qunused-arguments -msse2 -mfpmath=sse -arch i386" RANLIB=ranlib CXX="clang++ -Qunused-arguments -msse2 -mfpmath=sse -arch i386" AS=$CC AR=ar STRIP="strip -x -S" HOST_CC="clang -Qunused-arguments -msse2 -mfpmath=sse" AUTOCONF=/usr/local/Cellar/autoconf213/2.13/bin/autoconf213 HOST_CXX="clang++ -Qunused-arguments -msse2 -mfpmath=sse" sh /Users/skywalker/trees/mozilla-central/js/src/configure --target=i386-apple-darwin9.2.0 --enable-macos-target=10.5 --enable-arm-simulator --enable-debug --enable-optimize --enable-nspr-build --enable-more-deterministic --with-ccache --enable-gczeal --enable-debug-symbols --disable-tests

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   https://hg.mozilla.org/mozilla-central/rev/1b13ea9bf489
user:        Hannes Verschore
date:        Wed Sep 10 23:21:12 2014 +0200
summary:     Bug 1064251 - IonMonkey: Fold strict (not) equal on constant numbers, r=sstangl

Hannes, is bug 1064251 a likely regressor?

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

I suspect this may be bug 1124448 or bug 1122402.

Comment 2

[Hannes Verschore [:h4writer]]

(In reply to Gary Kwong [:gkw] [:nth10sd] from comment #1)
> I suspect this may be bug 1124448 or bug 1122402.

I suspect too. I'll take a look later in the week. (Hoping bug 1122402 has progressed and fixes this too).

Comment 3

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

I think this is fixed, and likely by bug 1122402.