IonMonkey: Incorrect range analysis for Math.abs

RESOLVED FIXED in mozilla25

Status

()

defect
RESOLVED FIXED
6 years ago
6 years ago

People

(Reporter: jruderman, Assigned: nbp)

Tracking

(Blocks 2 bugs, {testcase})

Trunk
mozilla25
x86_64
macOS
Points:
---
Dependency tree / graph
Bug Flags:
in-testsuite +

Firefox Tracking Flags

(Not tracked)

Details

Attachments

(1 attachment)

function f() {
    return (42.0 + Math.abs(1.0e60)) | 0;
}
assertEq(f(), 0);
assertEq(f(), 0);

With --ion-eager: got 42, expected 0

Like bug 886246, this started when bug 859257 landed, but isn't that bug's fault.
Should this really block odinfuzz?
I initially found it in OdinMonkey, and it blocks further asm module differential testing.
Nicolas, can you take a look at this? Thanks.
Assignee: general → nicolas.b.pierron
Status: NEW → ASSIGNED
Flags: needinfo?(nicolas.b.pierron)
The bugs comes from the fact that we assume that the result of MAbs can be interpreted as an Int as we do not keep the infinity flag.  Thus the double addition is converted to an Int addition by the truncate phase.

I bet the same problem might exists with MMod operands, do we have a bug filed on that?
Attachment #769847 - Flags: review?(mrosenberg)
Flags: needinfo?(nicolas.b.pierron)
Comment on attachment 769847 [details] [diff] [review]
Range analysis correctly non Int32 inputs of MAbs.

Review of attachment 769847 [details] [diff] [review]:
-----------------------------------------------------------------

looks like it'll work.
Attachment #769847 - Flags: review?(mrosenberg) → review+
https://hg.mozilla.org/mozilla-central/rev/7af58b3b21ef
Status: ASSIGNED → RESOLVED
Closed: 6 years ago
Flags: in-testsuite+
Resolution: --- → FIXED
Target Milestone: --- → mozilla25
You need to log in before you can comment on or make changes to this bug.