ARM: integer multiplication by a constant negative power of two is incorrectly optimized to a shift operation.

RESOLVED FIXED in Firefox 25

Status

()

Core
JavaScript Engine
RESOLVED FIXED
4 years ago
4 years ago

People

(Reporter: dougc, Assigned: dougc)

Tracking

unspecified
mozilla27
Points:
---

Firefox Tracking Flags

(firefox25 fixed, firefox26 fixed, firefox27 fixed)

Details

(Whiteboard: [qa-])

Attachments

(1 attachment)

(Assignee)

Description

4 years ago
CodeGeneratorARM::visitMulI optimizes integer multiplication by a
power of two to a shift operation, however this would seem to be
only valid for multiplication by a positive constant.
(Assignee)

Comment 1

4 years ago
Created attachment 805003 [details] [diff] [review]
Guard against using optimizing to a shift operation for a negative constant

There is already a jit-test failure caused by this.
Attachment #805003 - Flags: review?(mrosenberg)
Attachment #805003 - Flags: review?(mrosenberg) → review+
(Assignee)

Updated

4 years ago
Keywords: checkin-needed
https://hg.mozilla.org/integration/mozilla-inbound/rev/f0cc00e701d7
Keywords: checkin-needed
https://hg.mozilla.org/mozilla-central/rev/f0cc00e701d7
Status: NEW → RESOLVED
Last Resolved: 4 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla27
(Assignee)

Comment 4

4 years ago
Comment on attachment 805003 [details] [diff] [review]
Guard against using optimizing to a shift operation for a negative constant

[Approval Request Comment]
Bug caused by (feature/regressing bug #): caught by a jit-test failure
User impact if declined: numerical errors in ARM compiled code
Testing completed (on m-c, etc.): fixed the failing jit-test
Risk to taking this patch (and alternatives if risky): low
String or IDL/UUID changes made by this patch:
Attachment #805003 - Flags: approval-mozilla-aurora?
(Assignee)

Comment 5

4 years ago
Comment on attachment 805003 [details] [diff] [review]
Guard against using optimizing to a shift operation for a negative constant

[Approval Request Comment]
Bug caused by (feature/regressing bug #): caught by a jit-test failure on m-c
User impact if declined: numerical errors in Ion ARM compiled code
Testing completed (on m-c, etc.): fixed the failing jit-test
Risk to taking this patch (and alternatives if risky): low
String or IDL/UUID changes made by this patch:
Attachment #805003 - Flags: approval-mozilla-beta?
Attachment #805003 - Flags: approval-mozilla-beta?
Attachment #805003 - Flags: approval-mozilla-beta+
Attachment #805003 - Flags: approval-mozilla-aurora?
Attachment #805003 - Flags: approval-mozilla-aurora+
https://hg.mozilla.org/releases/mozilla-aurora/rev/6743d9993e67
https://hg.mozilla.org/releases/mozilla-beta/rev/e0df613915c7
status-firefox25: --- → fixed
status-firefox26: --- → fixed
status-firefox27: --- → fixed

Updated

4 years ago
Whiteboard: [qa-]
You need to log in before you can comment on or make changes to this bug.