Closed Bug 888568 Opened 7 years ago Closed 7 years ago

IonMonkey: Incorrect range analysis for Math.abs

Categories

(Core :: JavaScript Engine, defect)

x86_64
macOS
defect
Not set
normal

Tracking

()

RESOLVED FIXED
mozilla25

People

(Reporter: jruderman, Assigned: nbp)

References

Details

(Keywords: testcase)

Attachments

(1 file)

function f() {
    return (42.0 + Math.abs(1.0e60)) | 0;
}
assertEq(f(), 0);
assertEq(f(), 0);

With --ion-eager: got 42, expected 0

Like bug 886246, this started when bug 859257 landed, but isn't that bug's fault.
Should this really block odinfuzz?
I initially found it in OdinMonkey, and it blocks further asm module differential testing.
Nicolas, can you take a look at this? Thanks.
Assignee: general → nicolas.b.pierron
Status: NEW → ASSIGNED
Flags: needinfo?(nicolas.b.pierron)
The bugs comes from the fact that we assume that the result of MAbs can be interpreted as an Int as we do not keep the infinity flag.  Thus the double addition is converted to an Int addition by the truncate phase.

I bet the same problem might exists with MMod operands, do we have a bug filed on that?
Attachment #769847 - Flags: review?(mrosenberg)
Flags: needinfo?(nicolas.b.pierron)
Comment on attachment 769847 [details] [diff] [review]
Range analysis correctly non Int32 inputs of MAbs.

Review of attachment 769847 [details] [diff] [review]:
-----------------------------------------------------------------

looks like it'll work.
Attachment #769847 - Flags: review?(mrosenberg) → review+
https://hg.mozilla.org/mozilla-central/rev/7af58b3b21ef
Status: ASSIGNED → RESOLVED
Closed: 7 years ago
Flags: in-testsuite+
Resolution: --- → FIXED
Target Milestone: --- → mozilla25
You need to log in before you can comment on or make changes to this bug.