Last Comment Bug 774644 - IonMonkey: Differential Testing: Missing ReferenceError with ion.
: IonMonkey: Differential Testing: Missing ReferenceError with ion.
: regression, testcase
Product: Core
Classification: Components
Component: JavaScript Engine (show other bugs)
: Other Branch
: x86_64 Linux
: -- critical (vote)
: ---
Assigned To: David Anderson [:dvander]
: Jason Orendorff [:jorendorff]
: 772795 786123 (view as bug list)
Depends on:
Blocks: langfuzz IonFuzz 787301
  Show dependency treegraph
Reported: 2012-07-17 07:02 PDT by Christian Holler (:decoder)
Modified: 2012-09-01 11:08 PDT (History)
7 users (show)
See Also:
Crash Signature:
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---

fix (2.23 KB, patch)
2012-07-17 16:46 PDT, David Anderson [:dvander]
jdemooij: review+
Details | Diff | Splinter Review

Description Christian Holler (:decoder) 2012-07-17 07:02:06 PDT
The following testcase shows different behavior with options --ion -n -m --ion-eager vs. --no-ion on ionmonkey revision c4c50dc6317c:

function YearFromTime() {}
function addTestCase() {
  var start = -62126352000000;
  var stop = -62094729600000;
  for (var d = start; d < stop; d >>= 86400000)
    new TestCase();

$ debug64/js --ion -n -m --ion-eager test.js
<no output>

$ debug64/js --no-ion test.js
test.js:8: ReferenceError: TestCase is not defined
Comment 1 David Anderson [:dvander] 2012-07-17 16:46:27 PDT
Created attachment 643189 [details] [diff] [review]

The bug is that the very end of the loop has an INT32 type for |d|, but the loop header has |double|. But the OSR type deduction algorithm stops just short of the loop header, so we accidentally unbox the double as an integer.
Comment 2 David Anderson [:dvander] 2012-07-17 17:30:47 PDT
*** Bug 772795 has been marked as a duplicate of this bug. ***
Comment 3 Jan de Mooij [:jandem] 2012-07-18 01:50:40 PDT
Comment on attachment 643189 [details] [diff] [review]

Review of attachment 643189 [details] [diff] [review]:

Good catch.
Comment 4 David Anderson [:dvander] 2012-07-27 16:13:56 PDT
Comment 5 David Anderson [:dvander] 2012-07-27 17:18:29 PDT
Backed out due to orange:
Comment 6 Jan de Mooij [:jandem] 2012-08-17 02:17:23 PDT
Here's another testcase:

function f() {
    var x = x * 23;
    while (x)
        x = 2;
    return x;

Prints 0 with --ion-eager instead of NaN. We enter via OSR and assume x is int32, but it may also be a double.
Comment 7 David Anderson [:dvander] 2012-08-31 17:45:40 PDT
Attempting a relanding since I can't reproduce shell failures locally:
Comment 8 David Anderson [:dvander] 2012-09-01 11:08:50 PDT
*** Bug 786123 has been marked as a duplicate of this bug. ***

Note You need to log in before you can comment on or make changes to this bug.