Last Comment Bug 716119 - Miscompilation of conditional expressions
: Miscompilation of conditional expressions
Status: RESOLVED FIXED
: regression
Product: Core
Classification: Components
Component: JavaScript Engine (show other bugs)
: 9 Branch
: x86 Linux
: -- normal (vote)
: mozilla12
Assigned To: Brian Hackett (:bhackett)
:
:
Mentors:
: 738941 (view as bug list)
Depends on:
Blocks:
  Show dependency treegraph
 
Reported: 2012-01-06 15:57 PST by Jérôme Vouillon
Modified: 2012-03-24 11:08 PDT (History)
7 users (show)
See Also:
Crash Signature:
(edit)
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---
affected
+
-
-


Attachments
patch (3.53 KB, patch)
2012-01-12 19:51 PST, Brian Hackett (:bhackett)
dvander: review+
Details | Diff | Splinter Review

Description Jérôme Vouillon 2012-01-06 15:57:48 PST
The Javascript code at http://www.pps.jussieu.fr/~vouillon/bug/ is not interpreted correctly by Firefox 9: it should display a nice graph, but instead displays ellipses all over the place.

I have tracked this down to what looks like the miscompilation of the conditional expression (pi_A9_<alpha_Hl_?1:0) on line 4881 in hypertree.js. Indeed, I have added the following debugging code:

    _wh_.log(start_Hk_,fin_Hl_,alpha_Hm_,pi_A9_<alpha_Hm_?1:0);

where _wh_ is window.console, _pi_A9_ = 3.1415...
(This is computer-generated code, and I made the change in the source code, so the variable names are not exactly the same.)
Then, I get incorrect outputs like the following one:

      -1.570796326794897 -1.2702070146247024 0.30058931217019413 1

Clearly, the last number should be 0.

I don't know how to reproduce the bug in a smaller program.  In particular, I seem to get correct outputs when I change slightly the line above, for instance by removing the first two arguments start_Hk_ and fin_Hl_, or by replacing _wh_ by window.console.
Comment 1 Boris Zbarsky [:bz] (still a bit busy) 2012-01-06 17:04:49 PST
Turning off TI makes the problem go away...

I also see the problem in nightlies.
Comment 2 Brian Hackett (:bhackett) 2012-01-12 19:51:19 PST
Created attachment 588291 [details] [diff] [review]
patch

Regalloc bug when doing a branch based on values known to be floating point numbers.  We didn't take care to ensure that sync code did not clobber the registers that were about to be compared, so the comparison could end up using incorrect values in the lhs/rhs.

I like the website, I've seen a fair number of those critters while diving here in california.
Comment 3 Brian Hackett (:bhackett) 2012-01-13 17:40:53 PST
https://hg.mozilla.org/integration/mozilla-inbound/rev/2b2ca37b0305
Comment 4 Marco Bonardo [::mak] 2012-01-14 01:49:26 PST
https://hg.mozilla.org/mozilla-central/rev/2b2ca37b0305
Comment 5 Alex Keybl [:akeybl] 2012-02-13 12:56:24 PST
This is a regression in FF9, and we're not seeing any dupes, so I'm untracking for 11/12/13. This can ride the trains.
Comment 6 Jáchym Toušek 2012-03-24 11:08:55 PDT
*** Bug 738941 has been marked as a duplicate of this bug. ***

Note You need to log in before you can comment on or make changes to this bug.