1293542 - Differential Testing: Different output message involving Math.pow

Status: RESOLVED FIXED

(Core :: JavaScript Engine: JIT, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

function f(x, y) {
    return (Math.pow(y, x != 0) ** -0.5);
};
m = [-Infinity];
for (var j = 0; j < 3; ++j) {
    for (var k = 0; k < 2; ++k) {
        print(f(m[j], m[k]));
    }
}


$ ./js-dbg-64-dm-clang-darwin-720b5d2c84d5 --fuzzing-safe --no-threads --baseline-eager --no-ion testcase.js
0
NaN
0
NaN
0
NaN

$ ./js-dbg-64-dm-clang-darwin-720b5d2c84d5 --fuzzing-safe --no-threads --ion-eager testcase.js
0
NaN
0
NaN
1
NaN

Tested this on m-c rev 720b5d2c84d5.

My configure flags are:

CC="clang -Qunused-arguments" CXX="clang++ -Qunused-arguments" AR=ar AUTOCONF=/usr/local/Cellar/autoconf213/2.13/bin/autoconf213 sh /Users/skywalker/trees/mozilla-central/js/src/configure --target=x86_64-apple-darwin14.5.0 --disable-jemalloc --enable-debug --enable-more-deterministic --with-ccache --enable-gczeal --enable-debug-symbols --disable-tests

python -u ~/funfuzz/js/compileShell.py -b "--enable-debug --enable-more-deterministic" -r 720b5d2c84d5

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:    https://hg.mozilla.org/mozilla-central/rev/33ceb53fd609
user:         Hannes Verschore
date:         Wed Apr 20 06:40:15 2016 -0400
summary:      Bug 1263609: SharedStubs - Port JSOP_POW to shared stubs, r=efaust

Hannes, is bug 1263609 a likely regressor?

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Another testcase that involves ** but not Math.pow, bisects to the same changeset:

function f(x) {
    return (x ** (1 / ~4294967297) && x);
};
for (var i = 0; i < 2; ++i) {
    print(f(-Infinity));
}


$ ./js-dbg-64-dm-clang-darwin-720b5d2c84d5 --fuzzing-safe --no-threads --baseline-eager --no-ion testcase.js
0
0

$ ./js-dbg-64-dm-clang-darwin-720b5d2c84d5 --fuzzing-safe --no-threads --ion-eager testcase.js
0
Infinity

Comment 2

[Hannes Verschore [:h4writer]]

(In reply to Gary Kwong [:gkw] [:nth10sd] from comment #1)
> Another testcase that involves ** but not Math.pow, bisects to the same
> changeset:
> 
> function f(x) {
>     return (x ** (1 / ~4294967297) && x);
> };
> for (var i = 0; i < 2; ++i) {
>     print(f(-Infinity));
> }
> 
> 
> $ ./js-dbg-64-dm-clang-darwin-720b5d2c84d5 --fuzzing-safe --no-threads
> --baseline-eager --no-ion testcase.js
> 0
> 0
> 
> $ ./js-dbg-64-dm-clang-darwin-720b5d2c84d5 --fuzzing-safe --no-threads
> --ion-eager testcase.js
> 0
> Infinity

When testing this changeset it also failed before 33ceb53fd609

Comment 3

[Hannes Verschore [:h4writer]]

I tested both tests and they both also fail before 33ceb53fd609. Can you confirm this?

Also the result of the first testcase is here:
0
NaN
0
NaN
Infinitiy
NaN

Can you doublecheck the results, to make sure I'm not fixing another bug?

Comment 4

[Hannes Verschore [:h4writer]]

I've tracked this to bug 1111241, which introduced some bugs.

Comment 5

[Hannes Verschore [:h4writer]]

Attachment: Patch

In bug 1111241 the lowering of visitPowHalfD was adjusted to not redefine input. But to use different input/output registers, but the edge-cases weren't adjusted to account for that.

Comment 6

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Seems like you've figured things out, thanks!

Comment 7

[Dan Gohman [:sunfish]]

Comment on attachment 8779746 [details] [diff] [review]
Patch

Review of attachment 8779746 [details] [diff] [review]:
-----------------------------------------------------------------

Thanks for tracking this down!

Comment 8

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Hannes, is this ready for landing?

Comment 9

[Hannes Verschore [:h4writer]]

(In reply to Gary Kwong [:gkw] [:nth10sd] from comment #8)
> Hannes, is this ready for landing?

Uh yes! Somehow this got lost in my system. Seems adjusting my system wasn't a good idea. I'll land tomorrow morning. Thanks for the notification!

Comment 10

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/mozilla-inbound/rev/f5f31ce9156b
IonMonkey: Fix the logic of pow, r=sunfish

Comment 11

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

https://hg.mozilla.org/mozilla-central/rev/f5f31ce9156b