Closed Bug 1274429 Opened 4 years ago Closed 4 years ago

Differential Testing: Different output message involving --ion-pgo=on

Categories

(Core :: JavaScript Engine: JIT, defect, major)

x86_64
All
defect
Not set
major

Tracking

()

RESOLVED FIXED
Tracking Status
firefox49 --- affected

People

(Reporter: gkw, Assigned: nbp)

References

Details

(Keywords: testcase)

function f(x) {
    return (x >> 0 ? Math.fround(x >> Math) + Math.fround(Math.asinh(-0xf) >>> 0) : Math.w);
};
function g(y) {
    return !f(f(Math.hypot(~y))) * Math.round(1);
};
for (var i = 0; i < 999; ++i) {
    print(g());
}


$ ./js-dbg-64-dm-clang-darwin-c4449eab07d3 --fuzzing-safe --no-threads --ion-eager testcase.js
$ ./js-dbg-64-dm-clang-darwin-c4449eab07d3 --fuzzing-safe --ion-eager --ion-pgo=on testcase.js

Diff'ing between the 2 outputs show:

@@ -341,7 +341,7 @@
 0
 0
 0
-0
+1
 0
 0
 0

Tested this on m-c rev c4449eab07d3.

My configure flags are:

CC="clang -Qunused-arguments" CXX="clang++ -Qunused-arguments" AR=ar AUTOCONF=/usr/local/Cellar/autoconf213/2.13/bin/autoconf213 sh /Users/skywalker/trees/mozilla-central/js/src/configure --target=x86_64-apple-darwin14.5.0 --disable-jemalloc --enable-debug --enable-more-deterministic --with-ccache --enable-gczeal --enable-debug-symbols --disable-tests

python -u ~/funfuzz/js/compileShell.py -b "--enable-debug --enable-more-deterministic" -r c4449eab07d3

This testcase can be intermittent. This essentially blocks compareJIT testing with --ion-pgo=on.

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   https://hg.mozilla.org/mozilla-central/rev/2e29695fee87
user:        Nicolas B. Pierron
date:        Tue May 17 17:15:53 2016 +0000
summary:     Bug 1261826 part 10 - Only increment code coverage counters on jump targets. r=bhackett

Nicolas, is bug 1261826 a likely regressor?
Flags: needinfo?(nicolas.b.pierron)
Actually, I'll turn off --ion-pgo=on testing until this is fixed.
Assignee: nobody → nicolas.b.pierron
Status: NEW → ASSIGNED
Ok, this sounds like a real issue, I will investigate more, in the mean time Bug 1261826 part 10.1 should "hide" the current issue, but I do not think this a proper fix for this issue.

I expect to land Bug 1261826 part 10.1 as soon as inbound re-open, so you might be able to turn pgo=on fuzzing again after that.
This issue should no longer reproduce after https://hg.mozilla.org/integration/mozilla-inbound/rev/c2b51f5ad843 , but I will keep investigating until I fully understand what is going on.
per comment 3, this issue is fixed, and there is no need to keep it open.
Status: ASSIGNED → RESOLVED
Closed: 4 years ago
Flags: needinfo?(nicolas.b.pierron)
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.