IonMonkey: Differential Testing: Missing ReferenceError with ion.

RESOLVED FIXED

Status

()

Core
JavaScript Engine
--
critical
RESOLVED FIXED
5 years ago
5 years ago

People

(Reporter: decoder, Assigned: dvander)

Tracking

(Blocks: 2 bugs, {regression, testcase})

Other Branch
x86_64
Linux
regression, testcase
Points:
---
Dependency tree / graph

Firefox Tracking Flags

(Not tracked)

Details

(Whiteboard: [ion:p1:fx18])

Attachments

(1 attachment)

(Reporter)

Description

5 years ago
The following testcase shows different behavior with options --ion -n -m --ion-eager vs. --no-ion on ionmonkey revision c4c50dc6317c:


function YearFromTime() {}
addTestCase();
function addTestCase() {
  var start = -62126352000000;
  YearFromTime();
  var stop = -62094729600000;
  for (var d = start; d < stop; d >>= 86400000)
    new TestCase();
}


$ debug64/js --ion -n -m --ion-eager test.js
<no output>

$ debug64/js --no-ion test.js
test.js:8: ReferenceError: TestCase is not defined
(Assignee)

Comment 1

5 years ago
Created attachment 643189 [details] [diff] [review]
fix

The bug is that the very end of the loop has an INT32 type for |d|, but the loop header has |double|. But the OSR type deduction algorithm stops just short of the loop header, so we accidentally unbox the double as an integer.
Assignee: general → dvander
Status: NEW → ASSIGNED
Attachment #643189 - Flags: review?
(Assignee)

Updated

5 years ago
Attachment #643189 - Flags: review? → review?(jdemooij)
(Assignee)

Updated

5 years ago
Duplicate of this bug: 772795
Comment on attachment 643189 [details] [diff] [review]
fix

Review of attachment 643189 [details] [diff] [review]:
-----------------------------------------------------------------

Good catch.
Attachment #643189 - Flags: review?(jdemooij) → review+
(Assignee)

Comment 4

5 years ago
http://hg.mozilla.org/projects/ionmonkey/rev/a21e8bf3531f
Status: ASSIGNED → RESOLVED
Last Resolved: 5 years ago
Resolution: --- → FIXED
(Assignee)

Comment 5

5 years ago
Backed out due to orange: https://hg.mozilla.org/projects/ionmonkey/rev/db83474903a5
Status: RESOLVED → REOPENED
Resolution: FIXED → ---
(Assignee)

Updated

5 years ago
Whiteboard: [ion:p1:fx18]
Here's another testcase:

function f() {
    var x = x * 23;
    while (x)
        x = 2;
    return x;
}
print(f());

Prints 0 with --ion-eager instead of NaN. We enter via OSR and assume x is int32, but it may also be a double.
(Assignee)

Updated

5 years ago
Blocks: 787301
(Assignee)

Comment 7

5 years ago
Attempting a relanding since I can't reproduce shell failures locally:

https://hg.mozilla.org/projects/ionmonkey/rev/547ffa1e37eb
Status: REOPENED → RESOLVED
Last Resolved: 5 years ago5 years ago
Resolution: --- → FIXED
(Assignee)

Updated

5 years ago
Duplicate of this bug: 786123
You need to log in before you can comment on or make changes to this bug.