Differential Testing: Different output message involving Math.tan

RESOLVED DUPLICATE of bug 1122401

Status

()

Core
JavaScript Engine: JIT
--
major
RESOLVED DUPLICATE of bug 1122401
3 years ago
3 years ago

People

(Reporter: gkw, Unassigned)

Tracking

(Blocks: 2 bugs, {regression, testcase})

Trunk
x86_64
Mac OS X
regression, testcase
Points:
---
Dependency tree / graph

Firefox Tracking Flags

(firefox38 affected)

Details

(Reporter)

Description

3 years ago
function f(x, y) {
    return (x - (Math.tan() >>> 0) / (Math.tan(y) >>> 0) | 0)
}
f(8, 4)
print(f(1, 0))

$ ./js-dbg-32-dm-nsprBuild-armSim-darwin-38058cb42a0e --fuzzing-safe --no-threads --ion-eager testcase.js
1

$ ./js-dbg-32-dm-nsprBuild-armSim-darwin-38058cb42a0e --fuzzing-safe --no-threads --baseline-eager testcase.js
0

Tested this on m-c rev 38058cb42a0e.

My configure flags are:

LD=ld CROSS_COMPILE=1 CC="clang -Qunused-arguments -msse2 -mfpmath=sse -arch i386" RANLIB=ranlib CXX="clang++ -Qunused-arguments -msse2 -mfpmath=sse -arch i386" AS=$CC AR=ar STRIP="strip -x -S" HOST_CC="clang -Qunused-arguments -msse2 -mfpmath=sse" AUTOCONF=/usr/local/Cellar/autoconf213/2.13/bin/autoconf213 HOST_CXX="clang++ -Qunused-arguments -msse2 -mfpmath=sse" sh /Users/skywalker/trees/mozilla-central/js/src/configure --target=i386-apple-darwin9.2.0 --enable-macos-target=10.5 --enable-arm-simulator --enable-debug --enable-optimize --enable-nspr-build --enable-more-deterministic --with-ccache --enable-gczeal --enable-debug-symbols --disable-tests

python -u ~/fuzzing/js/compileShell.py -b "--enable-debug --enable-optimize --enable-more-deterministic --enable-nspr-build --32 --enable-arm-simulator -R ~/trees/mozilla-central" -r 38058cb42a0e

This seems to only happen with the ARM simulator and not on a regular debug 32-bit build, so setting needinfo? from Marty as a start.
Flags: needinfo?(mrosenberg)
(Reporter)

Comment 1

3 years ago
This goes back before end-2013 too. ( https://hg.mozilla.org/mozilla-central/rev/df3c2a1e86d3 )
Same issue as bug 1122401: we end up with a truncated division, a SoftUDiv is generated and we don't look at the remainder.  I've tested with my patches (awaiting for review there), and the differential behavior is then fixed.  Adding the test case to my patch in bug 1122401.
Status: NEW → RESOLVED
Last Resolved: 3 years ago
Flags: needinfo?(mrosenberg)
Resolution: --- → DUPLICATE
Duplicate of bug: 1122401
You need to log in before you can comment on or make changes to this bug.