Closed Bug 760103 Opened 12 years ago Closed 12 years ago

IonMonkey: Math.floor/Math.round correctness bug

Categories

(Core :: JavaScript Engine, defect)

defect
Not set
normal

Tracking

()

RESOLVED FIXED

People

(Reporter: jandem, Assigned: jandem)

References

(Blocks 1 open bug)

Details

Attachments

(1 file)

With IonMonkey there's one new test262 failure compared to mozilla-inbound.

Here's a reduced testcase:

function f(x) {
    print(Math.round(x), Math.floor(x + 0.5));
}
f(0.2);
f(0.2);
f(0.2);

On OS X, 32-bit, revision efd4c7fc0697 I get the following output:

0 0
0 1
0 1

With --no-ion:

0 0
0 0
0 0
Assignee: general → jdemooij
Status: NEW → ASSIGNED
Forgot to mention in comment 0, the testcase requires --ion-eager...
Attached patch FixSplinter Review
The problem is that LRound overwrites its input register and the LFloor instruction used the modified value. The patch uses the temp register instead of the input register to hold the result of input + 0.5.

I temporarily disabled the AssemblerX86Shared::HasSSE41() check to test both branches (will file a follow-up bug to add a flag to disable SSE X support).
Attachment #628781 - Flags: review?(sstangl)
Attachment #628781 - Flags: review?(sstangl) → review+
https://hg.mozilla.org/projects/ionmonkey/rev/16141b0a3d12
Status: ASSIGNED → RESOLVED
Closed: 12 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.