505003 - TM: Different values for modulo of negative number (-2 % 2)

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect, P2)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

v = 1
for (e = 0; e < 3; ++e) {
    v -= (e = (v ^ e))
    for (c = 0; c < 3; ++c) {
        v %= (function () {
            return (e)
        })()
    }
}
print(uneval(this))

outputs a different value for "v" on TM branch with and without -j.

=====

$ ~/Desktop/tm-30366-b8d41dbdef7f/js-opt-tm-intelmac 
js> v = 1
1
js> for (e = 0; e < 3; ++e) {
    v -= (e = (v ^ e))
    for (c = 0; c < 3; ++c) {
        v %= (function () {
            return (e)
        })()
    }
}
0
js> print(uneval(this))
({v:-0, e:3, c:3})
js> 

$ ~/Desktop/tm-30366-b8d41dbdef7f/js-opt-tm-intelmac -j
js> v = 1
1
js> for (e = 0; e < 3; ++e) {
    v -= (e = (v ^ e))
    for (c = 0; c < 3; ++c) {
        v %= (function () {
            return (e)
        })()
    }
}
0
js> print(uneval(this))
({v:0, e:3, c:3})
js>

Comment 1

[David Mandelin [:dmandelin]]

Looks like it might be an FP rounding issue.

Comment 2

[David Mandelin [:dmandelin]]

Attachment: Slightly reduced test case

Comment 3

[Jason Orendorff [:jorendorff]]

function f(v, e) {
    for (var i = 0; i < 3; i++)
        v %= e;
    return v;
}

f(0, 1);
assertEq(f(-2, 2), -0);

First time through, we record an integer modulus operation. We also emit a guard that should trip if the result is -0. Second time through, the result should be -0 but when we get back into the interpreter it's 0.

Investigating.

Comment 4

[Jason Orendorff [:jorendorff]]

We aren't side-exiting.

  26: eq2 = eq ld2, 0
  27: xt1: xt eq2 -> pc=0xa02dd3c imacpc=(nil) sp+16 rp+0 (GuardID=002)
  28: div1 = div ld1, ld2
  29: mod1 = mod div1
  30: eq3 = eq mod1, 0
  31: jf eq3 -> label2
  32: lt1 = lt ld2, 0
  33: xt2: xt lt1 -> pc=0xa02dd3c imacpc=(nil) sp+16 rp+0 (GuardID=003)
  34: label2:

On line 32, we should be checking for negative lhs (ld1), not negative rhs (ld2).

Comment 5

[Jason Orendorff [:jorendorff]]

Attachment: v1

one-character fix + test

Comment 6

[Jason Orendorff [:jorendorff]]

http://hg.mozilla.org/tracemonkey/rev/d01080e63d11

Comment 7

[Robert Sayre]

http://hg.mozilla.org/mozilla-central/rev/d01080e63d11

Comment 8

[Robert Sayre]

http://hg.mozilla.org/releases/mozilla-1.9.2/rev/d0191bdf4746

Comment 9

[John B. Proffitt]

Gentlemen,

I am a stranger here, and I freely admit that I don't know what you're doing, exactly, and I don't want to take the time to figure that out.  Neither do I want to waste your time.

What I do know is that programming language libraries implement math functions like mod and div differently, and they don't necessarily do what you would expect.  In the general case where operands to these functions may have either sign, it behooves the careful programmer to test the output.  More at <a href="http://en.wikipedia.org/wiki/Modular_arithmetic">Wikipedia</a>.  The short version is that the mathematical operations mod and remainder are often confused or conflated, and they are NOT the same.

Comment 10

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

A type of test for this bug has already been landed because it is already marked in-testsuite+ -> VERIFIED.