Last Comment Bug 760103 - IonMonkey: Math.floor/Math.round correctness bug
: IonMonkey: Math.floor/Math.round correctness bug
Product: Core
Classification: Components
Component: JavaScript Engine (show other bugs)
: unspecified
: All All
-- normal (vote)
: ---
Assigned To: Jan de Mooij [:jandem]
: Jason Orendorff [:jorendorff]
Depends on:
Blocks: IonMonkey
  Show dependency treegraph
Reported: 2012-05-31 07:24 PDT by Jan de Mooij [:jandem]
Modified: 2012-06-01 02:39 PDT (History)
5 users (show)
See Also:
Crash Signature:
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---

Fix (4.53 KB, patch)
2012-05-31 09:43 PDT, Jan de Mooij [:jandem]
sstangl: review+
Details | Diff | Splinter Review

Description User image Jan de Mooij [:jandem] 2012-05-31 07:24:13 PDT
With IonMonkey there's one new test262 failure compared to mozilla-inbound.

Here's a reduced testcase:

function f(x) {
    print(Math.round(x), Math.floor(x + 0.5));

On OS X, 32-bit, revision efd4c7fc0697 I get the following output:

0 0
0 1
0 1

With --no-ion:

0 0
0 0
0 0
Comment 1 User image Jan de Mooij [:jandem] 2012-05-31 07:54:50 PDT
Forgot to mention in comment 0, the testcase requires --ion-eager...
Comment 2 User image Jan de Mooij [:jandem] 2012-05-31 09:43:19 PDT
Created attachment 628781 [details] [diff] [review]

The problem is that LRound overwrites its input register and the LFloor instruction used the modified value. The patch uses the temp register instead of the input register to hold the result of input + 0.5.

I temporarily disabled the AssemblerX86Shared::HasSSE41() check to test both branches (will file a follow-up bug to add a flag to disable SSE X support).
Comment 3 User image Jan de Mooij [:jandem] 2012-06-01 02:39:50 PDT

Note You need to log in before you can comment on or make changes to this bug.