888568 - IonMonkey: Incorrect range analysis for Math.abs

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Jesse Ruderman]

function f() {
    return (42.0 + Math.abs(1.0e60)) | 0;
}
assertEq(f(), 0);
assertEq(f(), 0);

With --ion-eager: got 42, expected 0

Like bug 886246, this started when bug 859257 landed, but isn't that bug's fault.

Comment 1

[Luke Wagner [:luke]]

Should this really block odinfuzz?

Comment 2

[Jesse Ruderman]

I initially found it in OdinMonkey, and it blocks further asm module differential testing.

Comment 3

[Jan de Mooij [:jandem]]

Nicolas, can you take a look at this? Thanks.

Comment 4

[Nicolas B. Pierron [:nbp | PTO until 11/11]]

Attachment: Range analysis correctly non Int32 inputs of MAbs.

The bugs comes from the fact that we assume that the result of MAbs can be interpreted as an Int as we do not keep the infinity flag.  Thus the double addition is converted to an Int addition by the truncate phase.

I bet the same problem might exists with MMod operands, do we have a bug filed on that?

Comment 5

[Marty Rosenberg [:mjrosenb]]

Comment on attachment 769847 [details] [diff] [review]
Range analysis correctly non Int32 inputs of MAbs.

Review of attachment 769847 [details] [diff] [review]:
-----------------------------------------------------------------

looks like it'll work.

Comment 6

[Nicolas B. Pierron [:nbp | PTO until 11/11]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/7af58b3b21ef

Comment 7

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/7af58b3b21ef