Closed Bug 1278623 Opened 7 years ago Closed 7 years ago

Open-coded x86 popcnt32 computes the wrong result

Categories

(Core :: JavaScript Engine: JIT, defect)

Product:
Core
Component:
JavaScript Engine: JIT
Platform:
x86
All
Type:
defect
Priority:
Not set
Severity:
normal

Tracking

()

Status:
RESOLVED FIXED
Milestone:
mozilla50
Tracking Flags:
Tracking Status
firefox50 --- fixed

People

(Reporter: lth, Assigned: lth)

Details

Attachments

(1 file)

bug1278623-popcnt.patch
1.05 KB, patch
bbouvier
: review+
Details | Diff | Splinter Review 
The reason is that tmp is used uninitialized (it should be initialized to input, I believe, but I will investigate properly).  This may have been a merge bug or something like that, because I seem to remember that I did see the code do that previously.

We're not seeing this because every machine we're testing on has the POPCNT instruction.  cc'ing the (German) Inquisition.
Note, this patch sits in the middle of my patch queue right now and the parent node ID in the patch does not exist in the Mozilla repos.
Attachment #8760837 - Flags: review?(bbouvier)
OS: Unspecified → All
Hardware: Unspecified → x86
Popcnt appears to be wasm-only and no uplift should be necessary.
Comment on attachment 8760837 [details] [diff] [review]
bug1278623-popcnt.patch

Review of attachment 8760837 [details] [diff] [review]:
-----------------------------------------------------------------

Great catch.
Attachment #8760837 - Flags: review?(bbouvier) → review+
https://hg.mozilla.org/mozilla-central/rev/1ba05c136eec
Status: ASSIGNED → RESOLVED
Closed: 7 years ago
status-firefox50: --- → fixed
Resolution: --- → FIXED
Target Milestone: --- → mozilla50
You need to log in before you can comment on or make changes to this bug.