499889 - TraceMonkey: fmod/fdiv/fmul speculation causes trace-test failures on ARM.

Status: RESOLVED WORKSFORME

(Core :: JavaScript Engine, defect)

Description

[Jacob Bramley [:jbramley]]

The oracle-based demototion of fmod/fdiv/fmul (introduced by bug 474443) seems to cause trace-test failures on ARM, even though the speculation itself is disabled on ARM. This was introduced as revision 812a94dc7dd5.

Specifically, I see the following failures (on 812a94dc7dd5) that pass on the previous revision (c23ad8dfa7eb):

TEST-UNEXPECTED-FAIL | trace-test.js | arith : expected number ( 9800 )  != actual number ( -94 ) 
TEST-UNEXPECTED-FAIL | trace-test.js | dependentStrings : expected string ( "ab2cd2ef2gh2ij2kl2mn2op2qr2st2" )  != actual string ( "ab2cd2ef2ab2000000" ) 
TEST-UNEXPECTED-FAIL | trace-test.js | testReallyDeepNestedExit : expected number ( 198 )  != actual number ( 190 ) 

Adding my createMandelSet fix (from bug 495239) also triggers failures in the createMandelSet tests, though it does stop them from crashing!

My createMandelSet fix adjusts register allocation, but _should_ have no effect on the computed result of a compiled expression. I suspect, therefore, that the addition of the createMandelSet failures is actually the same bug as caused the new failures listed above. Indeed, my createMandelSet patch causes no problem at all on the previous revision (c23ad8dfa7eb). However, it is difficult to be certain without further investigation.

---

Andreas: I have assigned this to you as you seem to have submitted the patches for bug 474443 (which introduced the failures). Is this reasonable?

Thanks,
Jacob

Comment 1

[Jacob Bramley [:jbramley]]

The current tip (a3b713829615) has only one failure:

TEST-UNEXPECTED-FAIL | trace-test.js | dependentStrings : expected string ( "ab2cd2ef2gh2ij2kl2mn2op2qr2st2" )  != actual string ( "ab2cd2ef2gh2ij2kl20000" )

Comment 2

[Robert Sayre]

http://hg.mozilla.org/mozilla-central/rev/46370f001a04

Comment 3

[Jacob Bramley [:jbramley]]

Nope; there is no patch for this one. Revision 46370f001a04 is for bug 495239.

Also, the current tip still fails createMandelSet in the same way as it did before, so I have reopened this bug.

I don't see the other failures any more, though I haven't investigated to find out which change-set made them go away.

Comment 4

[Jacob Bramley [:jbramley]]

I haven't seen this for ages, and I doubt that it's worth digging out a revision from a year ago to investigate it, so I'm closing the bug.