969705 - Differential Testing: Different output message involving right-shift zero

Status: RESOLVED FIXED

(Core :: JavaScript Engine: JIT, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

+++ This bug was initially created as a clone of Bug #969203 +++

function f(x) {
    return -(~x) < (x >>> 0)
}
print(f([]))
print(f(undefined - undefined))
print(f(-0x80000001))

$ ./js-opt-32-dm-ts-er-linux-262e73a6b7cd --fuzzing-safe --ion-parallel-compile=off --ion-eager testcase.js
false
false
true

$ ./js-opt-32-dm-ts-er-linux-262e73a6b7cd --fuzzing-safe --ion-parallel-compile=off testcase.js
false
false
false

Tested on js 32-bit opt threadsafe shell on m-c changeset 262e73a6b7cd on Linux, as well as 64-bit debug threadsafe shell.

My configure flags are:

CC="gcc -m32" AR=ar PKG_CONFIG_LIBDIR=/usr/lib/pkgconfig CXX="g++ -m32" sh ./configure --target=i686-pc-linux --enable-optimize --disable-debug --enable-profiling --enable-gczeal --enable-debug-symbols --enable-methodjit --enable-type-inference --disable-tests --enable-more-deterministic --enable-exact-rooting --with-ccache --enable-threadsafe <other NSPR options>

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   http://hg.mozilla.org/mozilla-central/rev/9658dbcf4cd7
user:        Dan Gohman
date:        Mon Dec 09 07:11:12 2013 -0800
summary:     Bug 943303 - IonMonkey: Convert floating-point comparisons to integer using range analysis. r=nbp

Dan, is bug 943303 a likely regressor?

Comment 1

[Dan Gohman [:sunfish]]

Attachment: truncated-compare.patch

> Dan, is bug 943303 a likely regressor?

Yes.

When range analysis converts a comparison to int32, truncation of the operands doesn't change the result, but it turns out comparisons can also be converted to int32 by speculative type inference, in which case it isn't necessarily safe to truncate the operands. The attached patch adds a flag to MCompare to track whether the operands should be truncated.

Comment 2

[Nicolas B. Pierron [:nbp]]

Comment on attachment 8373525 [details] [diff] [review]
truncated-compare.patch

Review of attachment 8373525 [details] [diff] [review]:
-----------------------------------------------------------------

::: js/src/jit/MIR.h
@@ +2256,5 @@
>  
> +    // When a floating-point comparison is converted to an integer comparison
> +    // (when range analysis proves it safe), we need to convert the operands
> +    // to integer comparisons as well.
> +    bool truncateOperands_;

nit: … we need to convert the operands to integer as well.

Comment 3

[Dan Gohman [:sunfish]]

Attachment: truncated-compare.patch

Updated patch with bug number and reviewer.

Comment 4

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/c0027289538c

Comment 5

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/c0027289538c