Closed Bug 969705 Opened 6 years ago Closed 6 years ago

Differential Testing: Different output message involving right-shift zero

Categories

(Core :: JavaScript Engine: JIT, defect, major)

All
Linux
defect
Not set
major

Tracking

()

RESOLVED FIXED
mozilla30
Tracking Status
firefox30 --- fixed

People

(Reporter: gkw, Assigned: sunfish)

References

(Blocks 2 open bugs)

Details

(Keywords: regression, testcase)

Attachments

(1 file, 1 obsolete file)

+++ This bug was initially created as a clone of Bug #969203 +++

function f(x) {
    return -(~x) < (x >>> 0)
}
print(f([]))
print(f(undefined - undefined))
print(f(-0x80000001))

$ ./js-opt-32-dm-ts-er-linux-262e73a6b7cd --fuzzing-safe --ion-parallel-compile=off --ion-eager testcase.js
false
false
true

$ ./js-opt-32-dm-ts-er-linux-262e73a6b7cd --fuzzing-safe --ion-parallel-compile=off testcase.js
false
false
false

Tested on js 32-bit opt threadsafe shell on m-c changeset 262e73a6b7cd on Linux, as well as 64-bit debug threadsafe shell.

My configure flags are:

CC="gcc -m32" AR=ar PKG_CONFIG_LIBDIR=/usr/lib/pkgconfig CXX="g++ -m32" sh ./configure --target=i686-pc-linux --enable-optimize --disable-debug --enable-profiling --enable-gczeal --enable-debug-symbols --enable-methodjit --enable-type-inference --disable-tests --enable-more-deterministic --enable-exact-rooting --with-ccache --enable-threadsafe <other NSPR options>

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   http://hg.mozilla.org/mozilla-central/rev/9658dbcf4cd7
user:        Dan Gohman
date:        Mon Dec 09 07:11:12 2013 -0800
summary:     Bug 943303 - IonMonkey: Convert floating-point comparisons to integer using range analysis. r=nbp

Dan, is bug 943303 a likely regressor?
Flags: needinfo?(dgohman)
Attached patch truncated-compare.patch (obsolete) — Splinter Review
> Dan, is bug 943303 a likely regressor?

Yes.

When range analysis converts a comparison to int32, truncation of the operands doesn't change the result, but it turns out comparisons can also be converted to int32 by speculative type inference, in which case it isn't necessarily safe to truncate the operands. The attached patch adds a flag to MCompare to track whether the operands should be truncated.
Assignee: nobody → dgohman
Attachment #8373525 - Flags: review?(nicolas.b.pierron)
Flags: needinfo?(dgohman)
Comment on attachment 8373525 [details] [diff] [review]
truncated-compare.patch

Review of attachment 8373525 [details] [diff] [review]:
-----------------------------------------------------------------

::: js/src/jit/MIR.h
@@ +2256,5 @@
>  
> +    // When a floating-point comparison is converted to an integer comparison
> +    // (when range analysis proves it safe), we need to convert the operands
> +    // to integer comparisons as well.
> +    bool truncateOperands_;

nit: … we need to convert the operands to integer as well.
Attachment #8373525 - Flags: review?(nicolas.b.pierron) → review+
Updated patch with bug number and reviewer.
Attachment #8373525 - Attachment is obsolete: true
Keywords: checkin-needed
https://hg.mozilla.org/mozilla-central/rev/c0027289538c
Status: NEW → RESOLVED
Closed: 6 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla30
You need to log in before you can comment on or make changes to this bug.