Closed Bug 1132396 Opened 5 years ago Closed 5 years ago

Differential Testing: Different output message involving Math.tan

Categories

(Core :: JavaScript Engine: JIT, defect, major)

x86_64
macOS
defect
Not set
major

Tracking

()

RESOLVED DUPLICATE of bug 1122401
Tracking Status
firefox38 --- affected

People

(Reporter: gkw, Unassigned)

References

(Blocks 2 open bugs)

Details

(Keywords: regression, testcase)

function f(x, y) {
    return (x - (Math.tan() >>> 0) / (Math.tan(y) >>> 0) | 0)
}
f(8, 4)
print(f(1, 0))

$ ./js-dbg-32-dm-nsprBuild-armSim-darwin-38058cb42a0e --fuzzing-safe --no-threads --ion-eager testcase.js
1

$ ./js-dbg-32-dm-nsprBuild-armSim-darwin-38058cb42a0e --fuzzing-safe --no-threads --baseline-eager testcase.js
0

Tested this on m-c rev 38058cb42a0e.

My configure flags are:

LD=ld CROSS_COMPILE=1 CC="clang -Qunused-arguments -msse2 -mfpmath=sse -arch i386" RANLIB=ranlib CXX="clang++ -Qunused-arguments -msse2 -mfpmath=sse -arch i386" AS=$CC AR=ar STRIP="strip -x -S" HOST_CC="clang -Qunused-arguments -msse2 -mfpmath=sse" AUTOCONF=/usr/local/Cellar/autoconf213/2.13/bin/autoconf213 HOST_CXX="clang++ -Qunused-arguments -msse2 -mfpmath=sse" sh /Users/skywalker/trees/mozilla-central/js/src/configure --target=i386-apple-darwin9.2.0 --enable-macos-target=10.5 --enable-arm-simulator --enable-debug --enable-optimize --enable-nspr-build --enable-more-deterministic --with-ccache --enable-gczeal --enable-debug-symbols --disable-tests

python -u ~/fuzzing/js/compileShell.py -b "--enable-debug --enable-optimize --enable-more-deterministic --enable-nspr-build --32 --enable-arm-simulator -R ~/trees/mozilla-central" -r 38058cb42a0e

This seems to only happen with the ARM simulator and not on a regular debug 32-bit build, so setting needinfo? from Marty as a start.
Flags: needinfo?(mrosenberg)
This goes back before end-2013 too. ( https://hg.mozilla.org/mozilla-central/rev/df3c2a1e86d3 )
Same issue as bug 1122401: we end up with a truncated division, a SoftUDiv is generated and we don't look at the remainder.  I've tested with my patches (awaiting for review there), and the differential behavior is then fixed.  Adding the test case to my patch in bug 1122401.
Status: NEW → RESOLVED
Closed: 5 years ago
Flags: needinfo?(mrosenberg)
Resolution: --- → DUPLICATE
Duplicate of bug: 1122401
You need to log in before you can comment on or make changes to this bug.