Various JIT test failures related to FloatArrays when compiled with gcc 4.7

NEW
Unassigned

Status

()

Core
JavaScript Engine
6 years ago
4 years ago

People

(Reporter: glandium, Unassigned)

Tracking

Trunk
All
Linux
Points:
---

Firefox Tracking Flags

(Not tracked)

Details

(Whiteboard: [js:p3])

(Reporter)

Description

6 years ago
This doesn't happen when building with gcc 4.6. This happens on both x86 and x64.

TEST-UNEXPECTED-FAIL | jit_test.py -a -m -n       | /home/mh/mozilla-central/js/src/jit-test/tests/basic/test586387.js: /home/m      h/mozilla-central/js/src/jit-test/tests/basic/test586387.js:14: Error: Assertion failed: got 0, expected 496
TEST-UNEXPECTED-FAIL | jit_test.py -a -m -d -n    | /home/mh/mozilla-central/js/src/jit-test/tests/basic/test586387.js: /home/m      h/mozilla-central/js/src/jit-test/tests/basic/test586387.js:14: Error: Assertion failed: got 0, expected 496
TEST-UNEXPECTED-FAIL | jit_test.py -m -n          | /home/mh/mozilla-central/js/src/jit-test/tests/jaeger/bug719918.js: /home/mh/mozilla-central/js/src/jit-test/tests/jaeger/bug719918.js:19: Error: Assertion failed: got 3e-323, expected 0
TEST-UNEXPECTED-FAIL | jit_test.py -a -m -n       | /home/mh/mozilla-central/js/src/jit-test/tests/jaeger/bug719918.js: /home/mh/mozilla-central/js/src/jit-test/tests/jaeger/bug719918.js:19: Error: Assertion failed: got 3e-323, expected 0
TEST-UNEXPECTED-FAIL | jit_test.py -a -m -d -n    | /home/mh/mozilla-central/js/src/jit-test/tests/jaeger/bug719918.js: /home/mh/mozilla-central/js/src/jit-test/tests/jaeger/bug719918.js:19: Error: Assertion failed: got 3e-323, expected 0
TEST-UNEXPECTED-FAIL | jit_test.py -m -d -n       | /home/mh/mozilla-central/js/src/jit-test/tests/jaeger/bug719918.js: /home/mh/mozilla-central/js/src/jit-test/tests/jaeger/bug719918.js:19: Error: Assertion failed: got 3e-323, expected 0
TEST-UNEXPECTED-FAIL | jit_test.py -a -m -n       | /home/mh/mozilla-central/js/src/jit-test/tests/jaeger/testSetTypedFloatArray.js: /home/mh/mozilla-central/js/src/jit-test/tests/jaeger/testSetTypedFloatArray.js:47: Error: Assertion failed: got 3e-323, expected 715525949998080000000
TEST-UNEXPECTED-FAIL | jit_test.py -a -m -d -n    | /home/mh/mozilla-central/js/src/jit-test/tests/jaeger/testSetTypedFloatArray.js: /home/mh/mozilla-central/js/src/jit-test/tests/jaeger/testSetTypedFloatArray.js:21: Error: Assertion failed: got 0, expected 715525927453369300000
(Reporter)

Comment 1

6 years ago
Note that on x86, the errors are slightly different:
TEST-UNEXPECTED-FAIL | jit_test.py -a -m -n       | /home/mh/mozilla-central/js/src/jit-test/tests/basic/test586387.js: /home/mh/mozilla-central/js/src/jit-test/tests/basic/test586387.js:14: Error: Assertion failed: got Infinity, expected 496
TEST-UNEXPECTED-FAIL | jit_test.py -a -m -d -n    | /home/mh/mozilla-central/js/src/jit-test/tests/basic/test586387.js: /home/mh/mozilla-central/js/src/jit-test/tests/basic/test586387.js:14: Error: Assertion failed: got Infinity, expected 496
TEST-UNEXPECTED-FAIL | jit_test.py -m -n          | /home/mh/mozilla-central/js/src/jit-test/tests/jaeger/bug719918.js: /home/mh/mozilla-central/js/src/jit-test/tests/jaeger/bug719918.js:19: Error: Assertion failed: got 3.670829645192317e+106, expected 0
TEST-UNEXPECTED-FAIL | jit_test.py -a -m -n       | /home/mh/mozilla-central/js/src/jit-test/tests/jaeger/bug719918.js: /home/mh/mozilla-central/js/src/jit-test/tests/jaeger/bug719918.js:19: Error: Assertion failed: got 3.670829645192317e+106, expected 0
TEST-UNEXPECTED-FAIL | jit_test.py -a -m -d -n    | /home/mh/mozilla-central/js/src/jit-test/tests/jaeger/bug719918.js: /home/mh/mozilla-central/js/src/jit-test/tests/jaeger/bug719918.js:19: Error: Assertion failed: got 1.834804142193799e+106, expected 0
TEST-UNEXPECTED-FAIL | jit_test.py -m -d -n       | /home/mh/mozilla-central/js/src/jit-test/tests/jaeger/bug719918.js: /home/mh/mozilla-central/js/src/jit-test/tests/jaeger/bug719918.js:19: Error: Assertion failed: got 1.834804142193799e+106, expected 0
TEST-UNEXPECTED-FAIL | jit_test.py -a -m -n       | /home/mh/mozilla-central/js/src/jit-test/tests/jaeger/testSetTypedFloatArray.js: /home/mh/mozilla-central/js/src/jit-test/tests/jaeger/testSetTypedFloatArray.js:47: Error: Assertion failed: got 3.6715015686149704e+106, expected 715525949998080000000
TEST-UNEXPECTED-FAIL | jit_test.py -a -m -d -n    | /home/mh/mozilla-central/js/src/jit-test/tests/jaeger/testSetTypedFloatArray.js: /home/mh/mozilla-central/js/src/jit-test/tests/jaeger/testSetTypedFloatArray.js:21: Error: Assertion failed: got Infinity, expected 715525927453369300000
Whiteboard: [js:p3]

Comment 2

6 years ago
This is broken in js::mjit::Assembler::storeToTypedArray<JSC::AbstractMacroAssembler<JSC::X86Assembler>::Address>(int, js::mjit::ValueRemat, JSC::AbstractMacroAssembler<JSC::X86Assembler>::Address). On the tests that fail, this check evaluates incorrectly:

            if (vr.isConstant())
                storeToTypedFloatArray(atype, ImmDouble(vr.value().toDouble()), address);
            else
                storeToTypedFloatArray(atype, vr.fpReg(), address);

vr.isConstant() should be false, but it takes the wrong code path here. The 3e-323 is actually 0x6, which happens to be the number of the SSE register that it is meant to use.

The way this works on a working build is:

and    $0x1,%ecx
......
test   %cl,%cl

..where the lower 2-bits of %ecx are vr.isFPRegister_ (bit 1) and vr.isConstant_ (bit 0).

But on a broken build, the "and" is completely missing, and so the test always evaluates the same (where the lower 2 bits are either 10 or 01).

Comment 3

6 years ago
It seems that this is also the cause of my inability to play Angry Birds in Firefox built with gcc-4.7

Updated

6 years ago
Duplicate of this bug: 759691

Comment 5

6 years ago
These bugs are fixed on the 4.7 SVN branch of GCC (and so will be fixed for 4.7.1). Perhaps due to fixes for the bitfield bugs like http://gcc.gnu.org/bugzilla/show_bug.cgi?id=53516

Comment 6

6 years ago
Excellent, good catch. Thanks!
Excellent debugging detective work, thanks!
(Assignee)

Updated

4 years ago
Assignee: general → nobody
You need to log in before you can comment on or make changes to this bug.