Closed
Bug 1186271
Opened 9 years ago
Closed 9 years ago
Differential Testing: Different output message involving Math.imul
Categories
(Core :: JavaScript Engine: JIT, defect)
Core
JavaScript Engine: JIT
Tracking
()
RESOLVED
FIXED
mozilla42
Tracking | Status | |
---|---|---|
firefox42 | --- | fixed |
People
(Reporter: gkw, Assigned: h4writer)
Details
(Keywords: regression, testcase)
Attachments
(1 file)
1.98 KB,
patch
|
nbp
:
review+
|
Details | Diff | Splinter Review |
function f(x) { print(Math.imul(-4294967295, x >>> 0) / 9 | 0); } f(4294967296); f(2147483648); $ ./js-dbg-64-dm-nsprBuild-darwin-1875a5584e5f --fuzzing-safe --no-threads --ion-eager testcase.js 0 238609294 $ ./js-dbg-64-dm-nsprBuild-darwin-1875a5584e5f --fuzzing-safe --no-threads --baseline-eager testcase.js 0 -238609294 Tested this on m-c rev 1875a5584e5f. My configure flags are: CC="clang -Qunused-arguments" CXX="clang++ -Qunused-arguments" AR=ar AUTOCONF=/usr/local/Cellar/autoconf213/2.13/bin/autoconf213 sh /Users/skywalker/trees/mozilla-central/js/src/configure --target=x86_64-apple-darwin12.5.0 --enable-debug --enable-nspr-build --enable-more-deterministic --with-ccache --enable-gczeal --enable-debug-symbols --disable-tests python -u ~/funfuzz/js/compileShell.py -b "--enable-debug --enable-more-deterministic --enable-nspr-build" -r 1875a5584e5f This seems to go back prior to rev a459b02a9ca4. Not sure if I'll be able to get a better bisection. Hannes, do you know if you could take this one?
Flags: needinfo?(hv1989)
Assignee | ||
Comment 1•9 years ago
|
||
Bisecting gave me: The first bad revision is: changeset: 138237:05bfd456e558 user: Brian Hackett <bhackett1024@gmail.com> date: Thu Jul 11 17:11:04 2013 -0600 summary: Bug 891534 - Use asm.js ops for truncated unsigned div/mod, allow div ops to be marked as truncated, r=jandem. Looking into it.
Flags: needinfo?(hv1989)
Assignee | ||
Comment 2•9 years ago
|
||
Simplifying / gvn: > Math.imul(1, foo) is not equal to > foo like in normal multiplication. Imul does a truncation of the result and the actual result should be: > foo | 0 I solved this more generally than testing in MMul if the mode integer is set. Since this issue will arrive whenever a binary instructions set itself as truncated. Which currently only MMul does for imul.
Assignee: nobody → hv1989
Attachment #8637893 -
Flags: review?(nicolas.b.pierron)
Updated•9 years ago
|
Attachment #8637893 -
Flags: review?(nicolas.b.pierron) → review+
Comment 4•9 years ago
|
||
https://hg.mozilla.org/mozilla-central/rev/63a925e3a025
Status: NEW → RESOLVED
Closed: 9 years ago
Flags: in-testsuite+
Resolution: --- → FIXED
Target Milestone: --- → mozilla42
You need to log in
before you can comment on or make changes to this bug.
Description
•