975636 - Differential Testing: Different output message involving buildPar

Status: RESOLVED FIXED

(Core :: JavaScript Engine: JIT, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

x = []
for (m = 0; m < 99; ++m) {
    Array.prototype.push.call(x, 2)
}
Object.defineProperty(this, "y", {
    get: function() {
        return x.concat().filterPar(function() {
            return 7
        })
    }
})
print(y)

on a 32-bit opt deterministic threadsafe shell on Linux on m-c rev b89a9d7b4ca0:

$ ./js-opt-32-dm-ts-er-linux-b89a9d7b4ca0 --fuzzing-safe --no-baseline --no-ti --no-ion testcase.js
2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2

$ ./js-opt-32-dm-ts-er-linux-b89a9d7b4ca0 --fuzzing-safe --no-baseline --thread-count=3 --no-ti --no-ion testcase.js
2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2


My configure flags are:

CC="gcc -m32" AR=ar PKG_CONFIG_LIBDIR=/usr/lib/pkgconfig CXX="g++ -m32" sh ./configure --target=i686-pc-linux --enable-optimize --disable-debug --enable-profiling --enable-gczeal --enable-debug-symbols --enable-methodjit --enable-type-inference --disable-tests --enable-more-deterministic --enable-exact-rooting --with-ccache --enable-threadsafe <other NSPR options>


autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   http://hg.mozilla.org/mozilla-central/rev/ad7777f1c0f5
user:        Shu-yu Guo
date:        Fri Feb 07 14:40:29 2014 -0800
summary:     Bug 958370 - Unify chunks and slices; self-host the scheduler's slice processing loop. (r=nmatsakis)

Shu-yu, is bug 958370 a likely regressor?

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

a = Array.buildPar(9, function() {
    return [] << 0
})
print(a)

might also be related. It seems to have the same regressing changeset.

$ ./js-opt-32-dm-ts-linux-22650589a724 --fuzzing-safe --ion-parallel-compile=off --no-baseline w7468-cj-in.js
0,0,0,0,0,0,0,0,0

$ ./js-opt-32-dm-ts-linux-22650589a724 --fuzzing-safe --ion-parallel-compile=off w7468-cj-in.js
0,0,4,4,6,6,8,8,1579431049

Tested on Linux 32-bit shell on rev 22650589a724

CC="gcc -m32" AR=ar PKG_CONFIG_LIBDIR=/usr/lib/pkgconfig CXX="g++ -m32" sh ./configure --target=i686-pc-linux --enable-optimize --disable-debug --enable-profiling --enable-gczeal --enable-debug-symbols --enable-methodjit --enable-type-inference --disable-tests --enable-more-deterministic --with-ccache --enable-threadsafe <other NSPR flags>

Comment 2

[Shu-yu Guo [:shu]]

(In reply to Gary Kwong [:gkw] [:nth10sd] from comment #1)
> a = Array.buildPar(9, function() {
>     return [] << 0
> })
> print(a)
> 
> might also be related. It seems to have the same regressing changeset.
> 
> $ ./js-opt-32-dm-ts-linux-22650589a724 --fuzzing-safe
> --ion-parallel-compile=off --no-baseline w7468-cj-in.js
> 0,0,0,0,0,0,0,0,0
> 
> $ ./js-opt-32-dm-ts-linux-22650589a724 --fuzzing-safe
> --ion-parallel-compile=off w7468-cj-in.js
> 0,0,4,4,6,6,8,8,1579431049
> 
> Tested on Linux 32-bit shell on rev 22650589a724
> 
> CC="gcc -m32" AR=ar PKG_CONFIG_LIBDIR=/usr/lib/pkgconfig CXX="g++ -m32" sh
> ./configure --target=i686-pc-linux --enable-optimize --disable-debug
> --enable-profiling --enable-gczeal --enable-debug-symbols --enable-methodjit
> --enable-type-inference --disable-tests --enable-more-deterministic
> --with-ccache --enable-threadsafe <other NSPR flags>

That's a different bug. The filterPar bug is dup of bug 974201. I'm changing this bug to fix the buildPar issue (which is in parallel bitops).

Comment 3

[Shu-yu Guo [:shu]]

Attachment: Fix parallel bitop VM functions.

Missed this when doing the return type conversion patch a while back.

Comment 4

[Niko Matsakis [:nmatsakis]]

Comment on attachment 8401667 [details] [diff] [review]
Fix parallel bitop VM functions.

Review of attachment 8401667 [details] [diff] [review]:
-----------------------------------------------------------------

::: js/src/jit/ParallelFunctions.cpp
@@ +527,5 @@
>  
>  bool
>  jit::BitLshPar(ForkJoinContext *cx, HandleValue lhs, HandleValue rhs, int32_t *out)
>  {
> +    BIT_OP(uint32_t(left) << (right & 31));

I don't object to this cast exactly, but does it make any practical difference? I would think it might be more relevant in `>>` below, since technically `>>` on a signed integer is undefined.

Comment 5

[Shu-yu Guo [:shu]]

The cast was just cribbed from http://dxr.mozilla.org/mozilla-central/source/js/src/vm/Interpreter-inl.h?from=BitLsh&case=true#597

Comment 6

[Shu-yu Guo [:shu]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/9a92e6a4d02b

Comment 7

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/9a92e6a4d02b