Closed Bug 1129088 Opened 5 years ago Closed 5 years ago

Differential Testing: Different output message involving Uint8ClampedArray

Categories

(Core :: JavaScript Engine: JIT, defect, major)

defect
Not set
major

Tracking

()

RESOLVED FIXED
mozilla38
Tracking Status
firefox35 --- unaffected
firefox36 + fixed
firefox37 + fixed
firefox38 + fixed

People

(Reporter: gkw, Assigned: sunfish)

References

(Blocks 2 open bugs)

Details

(Keywords: regression, testcase)

Attachments

(1 file)

x = new Uint8ClampedArray
function f(y) {
    print(x[5] = y)
}
f(Number.MIN_VALUE)
f(1)

$ ./js-dbg-64-dm-nsprBuild-darwin-58e4264903ba --fuzzing-safe --no-threads --ion-eager 15.js
5e-324
1.5

$ ./js-dbg-64-dm-nsprBuild-darwin-58e4264903ba --fuzzing-safe --no-threads --baseline-eager 15.js
5e-324
1

Tested this on m-c rev 58e4264903ba.

My configure flags are:

CC="clang -Qunused-arguments" CXX="clang++ -Qunused-arguments" AR=ar AUTOCONF=/usr/local/Cellar/autoconf213/2.13/bin/autoconf213 sh /Users/skywalker/trees/mozilla-central/js/src/configure --target=x86_64-apple-darwin12.5.0 --enable-debug --enable-optimize --enable-nspr-build --enable-more-deterministic --with-ccache --enable-gczeal --enable-debug-symbols --disable-tests

autoBisect is running.
autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   https://hg.mozilla.org/mozilla-central/rev/0088d5bbeecb
user:        Dan Gohman
date:        Tue Nov 18 14:25:57 2014 -0800
summary:     Bug 1100685 - IonMonkey: Don't use tempCopy for LClampDToUint8. r=jandem

Dan, is bug 1100685 a likely regressor?
Blocks: 1100685
Flags: needinfo?(sunfish)
Yes, but 1100685 is the regressor. It turns out LClampDToUint8 does need its temp after all.
Assignee: nobody → sunfish
Flags: needinfo?(sunfish)
I was mistaken; LClampDToUint8 does need its temp after all. This reverts the earlier patch and adds a comment.
Attachment #8560540 - Flags: review?(jdemooij)
Comment on attachment 8560540 [details] [diff] [review]
revert-bug-1100685.patch

Review of attachment 8560540 [details] [diff] [review]:
-----------------------------------------------------------------

Sorry, I should have noticed this.
Attachment #8560540 - Flags: review?(jdemooij) → review+
[Tracking Requested - why for this release]:
Just a backout of a small patch, would be great if we could take this to avoid subtle correctness bugs.
https://hg.mozilla.org/mozilla-central/rev/042f7f7638b8
Status: NEW → RESOLVED
Closed: 5 years ago
OS: Mac OS X → All
Hardware: x86_64 → All
Resolution: --- → FIXED
Target Milestone: --- → mozilla38
Dan, Jan, could you fill the uplift request to aurora & beta? Thanks
Flags: needinfo?(sunfish)
Flags: needinfo?(jdemooij)
Comment on attachment 8560540 [details] [diff] [review]
revert-bug-1100685.patch

Approval Request Comment
[Feature/regressing bug #]: bug 1100685
[User impact if declined]: JS programs may behave incorrectly if they hit the bug
[Describe test coverage new/current, TreeHerder]: TreeHerder
[Risks and why]: Low risk; the fix is just reverting the earlier patch.
[String/UUID change made/needed]: none
Flags: needinfo?(sunfish)
Flags: needinfo?(jdemooij)
Attachment #8560540 - Flags: approval-mozilla-beta?
Attachment #8560540 - Flags: approval-mozilla-aurora?
Attachment #8560540 - Flags: approval-mozilla-beta?
Attachment #8560540 - Flags: approval-mozilla-beta+
Attachment #8560540 - Flags: approval-mozilla-aurora?
Attachment #8560540 - Flags: approval-mozilla-aurora+
You need to log in before you can comment on or make changes to this bug.