754554 - Various JIT test failures related to FloatArrays when compiled with gcc 4.7

Status: RESOLVED WORKSFORME

(Core :: JavaScript Engine, defect)

Description

[Mike Hommey [:glandium]]

This doesn't happen when building with gcc 4.6. This happens on both x86 and x64.

TEST-UNEXPECTED-FAIL | jit_test.py -a -m -n       | /home/mh/mozilla-central/js/src/jit-test/tests/basic/test586387.js: /home/m      h/mozilla-central/js/src/jit-test/tests/basic/test586387.js:14: Error: Assertion failed: got 0, expected 496
TEST-UNEXPECTED-FAIL | jit_test.py -a -m -d -n    | /home/mh/mozilla-central/js/src/jit-test/tests/basic/test586387.js: /home/m      h/mozilla-central/js/src/jit-test/tests/basic/test586387.js:14: Error: Assertion failed: got 0, expected 496
TEST-UNEXPECTED-FAIL | jit_test.py -m -n          | /home/mh/mozilla-central/js/src/jit-test/tests/jaeger/bug719918.js: /home/mh/mozilla-central/js/src/jit-test/tests/jaeger/bug719918.js:19: Error: Assertion failed: got 3e-323, expected 0
TEST-UNEXPECTED-FAIL | jit_test.py -a -m -n       | /home/mh/mozilla-central/js/src/jit-test/tests/jaeger/bug719918.js: /home/mh/mozilla-central/js/src/jit-test/tests/jaeger/bug719918.js:19: Error: Assertion failed: got 3e-323, expected 0
TEST-UNEXPECTED-FAIL | jit_test.py -a -m -d -n    | /home/mh/mozilla-central/js/src/jit-test/tests/jaeger/bug719918.js: /home/mh/mozilla-central/js/src/jit-test/tests/jaeger/bug719918.js:19: Error: Assertion failed: got 3e-323, expected 0
TEST-UNEXPECTED-FAIL | jit_test.py -m -d -n       | /home/mh/mozilla-central/js/src/jit-test/tests/jaeger/bug719918.js: /home/mh/mozilla-central/js/src/jit-test/tests/jaeger/bug719918.js:19: Error: Assertion failed: got 3e-323, expected 0
TEST-UNEXPECTED-FAIL | jit_test.py -a -m -n       | /home/mh/mozilla-central/js/src/jit-test/tests/jaeger/testSetTypedFloatArray.js: /home/mh/mozilla-central/js/src/jit-test/tests/jaeger/testSetTypedFloatArray.js:47: Error: Assertion failed: got 3e-323, expected 715525949998080000000
TEST-UNEXPECTED-FAIL | jit_test.py -a -m -d -n    | /home/mh/mozilla-central/js/src/jit-test/tests/jaeger/testSetTypedFloatArray.js: /home/mh/mozilla-central/js/src/jit-test/tests/jaeger/testSetTypedFloatArray.js:21: Error: Assertion failed: got 0, expected 715525927453369300000

Comment 1

[Mike Hommey [:glandium]]

Note that on x86, the errors are slightly different:
TEST-UNEXPECTED-FAIL | jit_test.py -a -m -n       | /home/mh/mozilla-central/js/src/jit-test/tests/basic/test586387.js: /home/mh/mozilla-central/js/src/jit-test/tests/basic/test586387.js:14: Error: Assertion failed: got Infinity, expected 496
TEST-UNEXPECTED-FAIL | jit_test.py -a -m -d -n    | /home/mh/mozilla-central/js/src/jit-test/tests/basic/test586387.js: /home/mh/mozilla-central/js/src/jit-test/tests/basic/test586387.js:14: Error: Assertion failed: got Infinity, expected 496
TEST-UNEXPECTED-FAIL | jit_test.py -m -n          | /home/mh/mozilla-central/js/src/jit-test/tests/jaeger/bug719918.js: /home/mh/mozilla-central/js/src/jit-test/tests/jaeger/bug719918.js:19: Error: Assertion failed: got 3.670829645192317e+106, expected 0
TEST-UNEXPECTED-FAIL | jit_test.py -a -m -n       | /home/mh/mozilla-central/js/src/jit-test/tests/jaeger/bug719918.js: /home/mh/mozilla-central/js/src/jit-test/tests/jaeger/bug719918.js:19: Error: Assertion failed: got 3.670829645192317e+106, expected 0
TEST-UNEXPECTED-FAIL | jit_test.py -a -m -d -n    | /home/mh/mozilla-central/js/src/jit-test/tests/jaeger/bug719918.js: /home/mh/mozilla-central/js/src/jit-test/tests/jaeger/bug719918.js:19: Error: Assertion failed: got 1.834804142193799e+106, expected 0
TEST-UNEXPECTED-FAIL | jit_test.py -m -d -n       | /home/mh/mozilla-central/js/src/jit-test/tests/jaeger/bug719918.js: /home/mh/mozilla-central/js/src/jit-test/tests/jaeger/bug719918.js:19: Error: Assertion failed: got 1.834804142193799e+106, expected 0
TEST-UNEXPECTED-FAIL | jit_test.py -a -m -n       | /home/mh/mozilla-central/js/src/jit-test/tests/jaeger/testSetTypedFloatArray.js: /home/mh/mozilla-central/js/src/jit-test/tests/jaeger/testSetTypedFloatArray.js:47: Error: Assertion failed: got 3.6715015686149704e+106, expected 715525949998080000000
TEST-UNEXPECTED-FAIL | jit_test.py -a -m -d -n    | /home/mh/mozilla-central/js/src/jit-test/tests/jaeger/testSetTypedFloatArray.js: /home/mh/mozilla-central/js/src/jit-test/tests/jaeger/testSetTypedFloatArray.js:21: Error: Assertion failed: got Infinity, expected 715525927453369300000

Comment 2

[Chris Coulson]

This is broken in js::mjit::Assembler::storeToTypedArray<JSC::AbstractMacroAssembler<JSC::X86Assembler>::Address>(int, js::mjit::ValueRemat, JSC::AbstractMacroAssembler<JSC::X86Assembler>::Address). On the tests that fail, this check evaluates incorrectly:

            if (vr.isConstant())
                storeToTypedFloatArray(atype, ImmDouble(vr.value().toDouble()), address);
            else
                storeToTypedFloatArray(atype, vr.fpReg(), address);

vr.isConstant() should be false, but it takes the wrong code path here. The 3e-323 is actually 0x6, which happens to be the number of the SSE register that it is meant to use.

The way this works on a working build is:

and    $0x1,%ecx
......
test   %cl,%cl

..where the lower 2-bits of %ecx are vr.isFPRegister_ (bit 1) and vr.isConstant_ (bit 0).

But on a broken build, the "and" is completely missing, and so the test always evaluates the same (where the lower 2 bits are either 10 or 01).

Comment 3

[Chris Coulson]

It seems that this is also the cause of my inability to play Angry Birds in Firefox built with gcc-4.7

Comment 5

[Shu-yu Guo [:shu]]

These bugs are fixed on the 4.7 SVN branch of GCC (and so will be fixed for 4.7.1). Perhaps due to fixes for the bitfield bugs like http://gcc.gnu.org/bugzilla/show_bug.cgi?id=53516

Comment 6

[Chris Coulson]

Excellent, good catch. Thanks!

Comment 7

[Steve Fink [:sfink] [:s:]]

Excellent debugging detective work, thanks!

Comment 8

[sjw]

This is obsolete due bug 1322792.