1129088 - Differential Testing: Different output message involving Uint8ClampedArray

Status: RESOLVED FIXED

(Core :: JavaScript Engine: JIT, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

x = new Uint8ClampedArray
function f(y) {
    print(x[5] = y)
}
f(Number.MIN_VALUE)
f(1)

$ ./js-dbg-64-dm-nsprBuild-darwin-58e4264903ba --fuzzing-safe --no-threads --ion-eager 15.js
5e-324
1.5

$ ./js-dbg-64-dm-nsprBuild-darwin-58e4264903ba --fuzzing-safe --no-threads --baseline-eager 15.js
5e-324
1

Tested this on m-c rev 58e4264903ba.

My configure flags are:

CC="clang -Qunused-arguments" CXX="clang++ -Qunused-arguments" AR=ar AUTOCONF=/usr/local/Cellar/autoconf213/2.13/bin/autoconf213 sh /Users/skywalker/trees/mozilla-central/js/src/configure --target=x86_64-apple-darwin12.5.0 --enable-debug --enable-optimize --enable-nspr-build --enable-more-deterministic --with-ccache --enable-gczeal --enable-debug-symbols --disable-tests

autoBisect is running.

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   https://hg.mozilla.org/mozilla-central/rev/0088d5bbeecb
user:        Dan Gohman
date:        Tue Nov 18 14:25:57 2014 -0800
summary:     Bug 1100685 - IonMonkey: Don't use tempCopy for LClampDToUint8. r=jandem

Dan, is bug 1100685 a likely regressor?

Comment 2

[Dan Gohman [:sunfish]]

Yes, but 1100685 is the regressor. It turns out LClampDToUint8 does need its temp after all.

Comment 3

[Dan Gohman [:sunfish]]

Attachment: revert-bug-1100685.patch

I was mistaken; LClampDToUint8 does need its temp after all. This reverts the earlier patch and adds a comment.

Comment 4

[Jan de Mooij [:jandem]]

Comment on attachment 8560540 [details] [diff] [review]
revert-bug-1100685.patch

Review of attachment 8560540 [details] [diff] [review]:
-----------------------------------------------------------------

Sorry, I should have noticed this.

Comment 5

[Jan de Mooij [:jandem]]

[Tracking Requested - why for this release]:
Just a backout of a small patch, would be great if we could take this to avoid subtle correctness bugs.

Comment 6

[Dan Gohman [:sunfish]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/042f7f7638b8

Comment 7

[Phil Ringnalda (:philor)]

https://hg.mozilla.org/mozilla-central/rev/042f7f7638b8

Comment 8

[Sylvestre Ledru [:Sylvestre]]

Dan, Jan, could you fill the uplift request to aurora & beta? Thanks

Comment 9

[Dan Gohman [:sunfish]]

Comment on attachment 8560540 [details] [diff] [review]
revert-bug-1100685.patch

Approval Request Comment
[Feature/regressing bug #]: bug 1100685
[User impact if declined]: JS programs may behave incorrectly if they hit the bug
[Describe test coverage new/current, TreeHerder]: TreeHerder
[Risks and why]: Low risk; the fix is just reverting the earlier patch.
[String/UUID change made/needed]: none

Comment 10

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/releases/mozilla-aurora/rev/f8f587ceebcb
https://hg.mozilla.org/releases/mozilla-beta/rev/3ef577b545b8

Can we land a test for this? :)