1528597 - Differential Testing: Different output message involving IonMonkey on ARM64

Status: RESOLVED FIXED

(Core :: JavaScript Engine: JIT, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

setJitCompilerOption('ion.enable', 1);
function f(x, y) {
    return (x >>> x % Math.cosh(y))
}
function g(f, x) {
    for (let i = 0; i < 2; ++i)
        print(f(x[i], x[0]))
}
g(f, [2147483649, -2147483648]);

$ ./js-dbg-64-dm-linux-aarch64-bf8ca7933ead --fuzzing-safe --ion-offthread-compile=off --ion-eager testcase.js
1073741824
-2147483648

$ ./js-dbg-64-dm-linux-aarch64-bf8ca7933ead --fuzzing-safe --ion-offthread-compile=off --baseline-eager --no-ion testcase.js
1073741824
2147483648

Tested this on m-c rev bf8ca7933ead. This seems specific to ARM64, at least on native ARM64 EC2 systems. ARM64 simulator binaries on x86_64 also seem to be affected.

My configure flags are:

AR=ar sh ./configure --enable-debug --enable-more-deterministic --with-ccache --enable-gczeal --enable-debug-symbols --disable-tests --disable-cranelift

python3 -u -m funfuzz.js.compile_shell -b "--enable-debug --enable-more-deterministic" -r bf8ca7933ead

autobisectjs shows this is probably related to the following changeset:

The first bad revision is:
changeset: https://hg.mozilla.org/mozilla-central/rev/2b3012fa3cbf
user: Sean Stangl
date: Tue Feb 12 22:50:27 2019 +0000
summary: Bug 1523015 - Summary: Enable Ion on ARM64, but disable in-browser by pref. r=nbp

Sean, this is IonMonkey on ARM64, setting needinfo? from you as a start.

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

I'd like to elevate this to [fuzzblocker] status, it's quite prevalent throughout ARM64 testing on compare_jit.

Comment 2

[Nicolas B. Pierron [:nbp]]

Attachment: Bug 1528597 - ARM64: Fix CodeGenerator::visiShiftI Ursh case doing more than other architecture and baseline.

Comment 3

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/e4bda8b288b3
ARM64: Fix CodeGenerator::visiShiftI Ursh case doing more than other architecture and baseline. r=sstangl

Comment 4

[Razvan Maries]

https://hg.mozilla.org/mozilla-central/rev/e4bda8b288b3