[Webkit-unassigned] [Bug 137827] Math.abs() returns negative

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=137827

Diego Pino <dpino at igalia.com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |dpino at igalia.com

--- Comment #5 from Diego Pino <dpino at igalia.com> ---
It seems this issue is happening when Matb.abs gets jitted, apparently when the DFG kicks in.

function test(times) {
    for (var i = 0; i < times; i++) {
       result = Math.abs(-0.75);
    }
    print(times + " times: " + result);
}

test(1);
test(10);
test(100);
test(1000);
test(10000);
test(100000);
test(1000000);

Prints out:

1 times: 0.75
10 times: 0.75
100 times: 0.75
1000 times: 0.75
10000 times: -0.75
100000 times: -0.75
1000000 times: -0.75

If disabling DFG compilation, the issue doesn't happen.

Source/JavaScriptCore/runtime/Options.h
v(bool, useDFGJIT, false) \

I also noticed this issue is only happening with floats, it works OK for integers (regardless DFGJIT is on or off).

So everything points to be an issue in dfg/DFGSpeculativeJIT64.cpp, when emitting the jitted code for ArithAbs.

My environment is Ubuntu 14.04 x86_64, WebKitGTK+.

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-unassigned/attachments/20141209/f8f9a711/attachment-0002.html>