1274429 - Differential Testing: Different output message involving --ion-pgo=on

Status: RESOLVED FIXED

(Core :: JavaScript Engine: JIT, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

function f(x) {
    return (x >> 0 ? Math.fround(x >> Math) + Math.fround(Math.asinh(-0xf) >>> 0) : Math.w);
};
function g(y) {
    return !f(f(Math.hypot(~y))) * Math.round(1);
};
for (var i = 0; i < 999; ++i) {
    print(g());
}


$ ./js-dbg-64-dm-clang-darwin-c4449eab07d3 --fuzzing-safe --no-threads --ion-eager testcase.js
$ ./js-dbg-64-dm-clang-darwin-c4449eab07d3 --fuzzing-safe --ion-eager --ion-pgo=on testcase.js

Diff'ing between the 2 outputs show:

@@ -341,7 +341,7 @@
 0
 0
 0
-0
+1
 0
 0
 0

Tested this on m-c rev c4449eab07d3.

My configure flags are:

CC="clang -Qunused-arguments" CXX="clang++ -Qunused-arguments" AR=ar AUTOCONF=/usr/local/Cellar/autoconf213/2.13/bin/autoconf213 sh /Users/skywalker/trees/mozilla-central/js/src/configure --target=x86_64-apple-darwin14.5.0 --disable-jemalloc --enable-debug --enable-more-deterministic --with-ccache --enable-gczeal --enable-debug-symbols --disable-tests

python -u ~/funfuzz/js/compileShell.py -b "--enable-debug --enable-more-deterministic" -r c4449eab07d3

This testcase can be intermittent. This essentially blocks compareJIT testing with --ion-pgo=on.

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   https://hg.mozilla.org/mozilla-central/rev/2e29695fee87
user:        Nicolas B. Pierron
date:        Tue May 17 17:15:53 2016 +0000
summary:     Bug 1261826 part 10 - Only increment code coverage counters on jump targets. r=bhackett

Nicolas, is bug 1261826 a likely regressor?

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Actually, I'll turn off --ion-pgo=on testing until this is fixed.

Comment 2

[Nicolas B. Pierron [:nbp]]

Ok, this sounds like a real issue, I will investigate more, in the mean time Bug 1261826 part 10.1 should "hide" the current issue, but I do not think this a proper fix for this issue.

I expect to land Bug 1261826 part 10.1 as soon as inbound re-open, so you might be able to turn pgo=on fuzzing again after that.

Comment 3

[Nicolas B. Pierron [:nbp]]

This issue should no longer reproduce after https://hg.mozilla.org/integration/mozilla-inbound/rev/c2b51f5ad843 , but I will keep investigating until I fully understand what is going on.

Comment 4

[Nicolas B. Pierron [:nbp]]

per comment 3, this issue is fixed, and there is no need to keep it open.