Closed Bug 774644 Opened 12 years ago Closed 12 years ago

IonMonkey: Differential Testing: Missing ReferenceError with ion.

Categories

(Core :: JavaScript Engine, defect)

Other Branch
x86_64
Linux
defect
Not set
critical

Tracking

()

RESOLVED FIXED

People

(Reporter: decoder, Assigned: dvander)

References

Details

(Keywords: regression, testcase, Whiteboard: [ion:p1:fx18])

Attachments

(1 file)

The following testcase shows different behavior with options --ion -n -m --ion-eager vs. --no-ion on ionmonkey revision c4c50dc6317c:


function YearFromTime() {}
addTestCase();
function addTestCase() {
  var start = -62126352000000;
  YearFromTime();
  var stop = -62094729600000;
  for (var d = start; d < stop; d >>= 86400000)
    new TestCase();
}


$ debug64/js --ion -n -m --ion-eager test.js
<no output>

$ debug64/js --no-ion test.js
test.js:8: ReferenceError: TestCase is not defined
Attached patch fixSplinter Review
The bug is that the very end of the loop has an INT32 type for |d|, but the loop header has |double|. But the OSR type deduction algorithm stops just short of the loop header, so we accidentally unbox the double as an integer.
Assignee: general → dvander
Status: NEW → ASSIGNED
Attachment #643189 - Flags: review?
Attachment #643189 - Flags: review? → review?(jdemooij)
Comment on attachment 643189 [details] [diff] [review]
fix

Review of attachment 643189 [details] [diff] [review]:
-----------------------------------------------------------------

Good catch.
Attachment #643189 - Flags: review?(jdemooij) → review+
http://hg.mozilla.org/projects/ionmonkey/rev/a21e8bf3531f
Status: ASSIGNED → RESOLVED
Closed: 12 years ago
Resolution: --- → FIXED
Backed out due to orange: https://hg.mozilla.org/projects/ionmonkey/rev/db83474903a5
Status: RESOLVED → REOPENED
Resolution: FIXED → ---
Whiteboard: [ion:p1:fx18]
Here's another testcase:

function f() {
    var x = x * 23;
    while (x)
        x = 2;
    return x;
}
print(f());

Prints 0 with --ion-eager instead of NaN. We enter via OSR and assume x is int32, but it may also be a double.
Attempting a relanding since I can't reproduce shell failures locally:

https://hg.mozilla.org/projects/ionmonkey/rev/547ffa1e37eb
Status: REOPENED → RESOLVED
Closed: 12 years ago12 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.