1329774 - wasm: differential testing issue with i64.rotl

Status: RESOLVED FIXED

(Core :: JavaScript Engine: JIT, defect, P1)

Description

[Benjamin Bouvier [:bbouvier] (inactive)]

let exports;
try {
    exports = wasmEvalText(`
    (module
        (func (export "func_0") (result i32)
            ;; Top level expr.
            i64.const 2486929126729435110
            i64.const 4107780046588991405
            i32.const 3019254524
            select
            i64.const 11414806695682901182
            i64.const 13245963136209577951
            i64.rotl
            i32.const 2334321502
            i32.const 2603189215
            i32.div_u
            select
            ;; Top level expr.
            i64.const 2196129247693584342
            i64.ctz
            i32.const 2323435689
            i32.const 2889871566
            i32.shl
            select
            ;; Top level expr.
            i64.clz
            ;; Top level expr.
            f32.const -0
            ;; Top level expr.
            f64.const 1
            f64.const -13.37
            i32.const 4123811276
            select
            f64.floor
            ;; Emptying the result stack.
            i64.reinterpret/f64
            f64.convert_s/i64
            f32.demote/f64
            f32.mul
            f64.promote/f32
            i64.trunc_s/f64
            i64.add
            i32.wrap/i64
        )

    )
    `).exports;
} catch(e) {
    print(e);
    throw new Error('INVALID_TESTCASE');
}


// Printing globals.
// Calling into functions.
print("function 0:");
printValue(exports.func_0())

/*

Shell: /home/ben/mozilla/builds/do64/dist/bin/js
Mode: ion
Exception's arguments:
	Differential output when running against /home/ben/mozilla/builds/do64/dist/bin/js in ion mode: expected

function 0: 0 (x86)

, got

function 0: 3 (x64)

*/

Comment 1

[Benjamin Bouvier [:bbouvier] (inactive)]

Reduced test case:

const wasmEvalText = (txt, maybeImports) => new WebAssembly.Instance(new WebAssembly.Module(wasmTextToBinary(txt)), maybeImports);

setJitCompilerOption('wasm.test-mode', 1);

let { exports } = wasmEvalText(`
    (module
        (func (export "run") (result i64)
            i64.const 1
            i64.const 31
            i64.rotl
        )
    )
`);

let i64 = exports.run();
assertEq(i64.low, -(2**31)); // 1 on x86
assertEq(i64.high, 0);

Code generation of i64.rotl is wrong when the rotation count is 31. I'm on it.

Comment 2

[Benjamin Bouvier [:bbouvier] (inactive)]

Attachment: rotl.patch

Simple typo in codegen.

Approval Request Comment
[Feature/Bug causing the regression]: wasm i64 (bug 1246648)
[User impact if declined]: correctness issues
[Is this code covered by automated tests?]: yes
[Has the fix been verified in Nightly?]: yes
[Needs manual test from QE? If yes, steps to reproduce]: no
[List of other uplifts needed for the feature/fix]: none
[Is the change risky?]: no
[Why is the change risky/not risky?]: only one char modified in code source
[String changes made/needed]: n/a

Comment 3

[Julien Cristau [:jcristau]]

track wasm issue for 52

Comment 4

[Hannes Verschore [:h4writer]]

Comment on attachment 8825404 [details] [diff] [review]
rotl.patch

Review of attachment 8825404 [details] [diff] [review]:
-----------------------------------------------------------------

Good catch!

Comment 5

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/mozilla-inbound/rev/36e0e97d1c1b
Fix code generation for 64-bits integer left rotation on x86; r=h4writer

Comment 6

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

https://hg.mozilla.org/mozilla-central/rev/36e0e97d1c1b

Comment 7

[Julien Cristau [:jcristau]]

Comment on attachment 8825404 [details] [diff] [review]
rotl.patch

wasm codegen fix for aurora52

Comment 8

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/releases/mozilla-aurora/rev/dd712d721295