760103 - IonMonkey: Math.floor/Math.round correctness bug

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Jan de Mooij [:jandem]]

With IonMonkey there's one new test262 failure compared to mozilla-inbound.

Here's a reduced testcase:

function f(x) {
    print(Math.round(x), Math.floor(x + 0.5));
}
f(0.2);
f(0.2);
f(0.2);

On OS X, 32-bit, revision efd4c7fc0697 I get the following output:

0 0
0 1
0 1

With --no-ion:

0 0
0 0
0 0

Comment 1

[Jan de Mooij [:jandem]]

Forgot to mention in comment 0, the testcase requires --ion-eager...

Comment 2

[Jan de Mooij [:jandem]]

Attachment: Fix

The problem is that LRound overwrites its input register and the LFloor instruction used the modified value. The patch uses the temp register instead of the input register to hold the result of input + 0.5.

I temporarily disabled the AssemblerX86Shared::HasSSE41() check to test both branches (will file a follow-up bug to add a flag to disable SSE X support).

Comment 3

[Jan de Mooij [:jandem]]

https://hg.mozilla.org/projects/ionmonkey/rev/16141b0a3d12