Differential Testing: Different output message involving Math functions

RESOLVED FIXED in Firefox 52

Status

()

defect
P1
major
RESOLVED FIXED
3 years ago
3 years ago

People

(Reporter: gkw, Assigned: h4writer)

Tracking

(Blocks 2 bugs, {testcase})

Trunk
mozilla52
x86_64
All
Points:
---
Dependency tree / graph

Firefox Tracking Flags

(firefox52 fixed)

Details

Attachments

(1 attachment)

Reporter

Description

3 years ago
for (var i = 0; i < 2; ++i) {
    print(uneval(Math.max(-0)));
}

$ ./js-dbg-64-dm-clang-darwin-313a2d049350 --fuzzing-safe --no-threads --baseline-eager --no-ion testcase.js
-0
-0

$ ./js-dbg-64-dm-clang-darwin-313a2d049350 --fuzzing-safe --no-threads --ion-eager testcase.js
-0
0

Tested this on m-c rev 313a2d049350.

My configure flags are:

CC="clang -Qunused-arguments" CXX="clang++ -Qunused-arguments" AR=ar AUTOCONF=/usr/local/Cellar/autoconf213/2.13/bin/autoconf213 sh /Users/skywalker/trees/mozilla-central/js/src/configure --target=x86_64-apple-darwin14.5.0 --disable-jemalloc --enable-debug --enable-more-deterministic --with-ccache --enable-gczeal --enable-debug-symbols --disable-tests

python -u ~/funfuzz/js/compileShell.py -b "--enable-debug --enable-more-deterministic" -r 313a2d049350

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   https://hg.mozilla.org/mozilla-central/rev/6e6438f5d89f
user:        André Bargull
date:        Thu Oct 06 23:38:16 2016 -0700
summary:     Bug 1303788 - Add support for trailing comma in argument and parameter lists (ES2017). r=arai

Andre, is bug 1303788 a likely regressor?
Flags: needinfo?(andrebargull)
not likely, and I confirmed the same behavior on the parent revision of 6e6438f5d89f (95bf06da8e8d)
Reporter

Comment 2

3 years ago
I re-ran autoBisect, this is probably more likely.

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   https://hg.mozilla.org/mozilla-central/rev/07e3fec694b1
user:        ZongShen Shen
date:        Thu Jan 22 09:27:43 2015 -0800
summary:     Bug 1123064 - IonMonkey: Fold constant numbers in MToInt32, r=h4writer

Hannes/Andy, is bug 1123064 a likely regressor?
Blocks: 1123064
No longer blocks: 1303788
Flags: needinfo?(hv1989)
Flags: needinfo?(andy.zsshen)
Flags: needinfo?(andrebargull)
Assignee

Comment 3

3 years ago
Posted patch PatchSplinter Review
NumberIsInt32 also catches "-0", which NumberEqualsInt32 didn't do, causing this bug.
Assignee: nobody → hv1989
Flags: needinfo?(hv1989)
Flags: needinfo?(andy.zsshen)
Attachment #8801740 - Flags: review?(nicolas.b.pierron)
Assignee

Updated

3 years ago
Priority: -- → P1
Comment on attachment 8801740 [details] [diff] [review]
Patch

Review of attachment 8801740 [details] [diff] [review]:
-----------------------------------------------------------------

::: js/src/jit-test/tests/ion/bug1308802.js
@@ +1,3 @@
> +
> +function test() {
> +    for (var i = 0; i < 2; ++i) {

maybe-nit: for (var i = false; !!i; i = inIon()) {
Attachment #8801740 - Flags: review?(nicolas.b.pierron) → review+

Comment 5

3 years ago
Pushed by hv1989@gmail.com:
https://hg.mozilla.org/integration/mozilla-inbound/rev/a9ee75a0ae5a
IonMonkey - Folding ToInt32 shouldn't happen for negative zero, r=nbp

Comment 6

3 years ago
bugherder
https://hg.mozilla.org/mozilla-central/rev/a9ee75a0ae5a
Status: NEW → RESOLVED
Closed: 3 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla52
You need to log in before you can comment on or make changes to this bug.