[Webkit-unassigned] [Bug 203406] New: Chakracore test max.js broken in armv7 builds of JSC

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=203406

            Bug ID: 203406
           Summary: Chakracore test max.js broken in armv7 builds of JSC
           Product: WebKit
           Version: WebKit Nightly Build
          Hardware: Other
                OS: Unspecified
            Status: NEW
          Severity: Major
          Priority: P2
         Component: JavaScriptCore
          Assignee: webkit-unassigned at lists.webkit.org
          Reporter: pmatos at igalia.com

A recent patch has broken armv7 - chakracore test max.js is giving incorrect results:
Bad behaviour:

$ jsc --useDFGJIT=true --forceEagerCompilation=true --repatchBufferingCountdown=6 JSTests/ChakraCore/test/jsc-lib.js JSTests/ChakraCore/test/Math/max.js
Infinity
-Infinity
opD = 0 , onD = 0 op = 0 , on = 0 , infp = Infinity , infn = -Infinity , infpD = Infinity , infnD = -Infinity
Math.max(+0.0, -0.0) 0
Check (1 / Math.max(+0.0, -0.0) < 0)  - false 
done
Infinity
Infinity
-Infinity
-Infinity
undefined
undefined
NaN
1

Changing repatchBufferingCountdown to 7 gives the correct result:
$ jsc --useDFGJIT=true --forceEagerCompilation=true --repatchBufferingCountdown=7 JSTests/ChakraCore/test/jsc-lib.js JSTests/ChakraCore/test/Math/max.js
Infinity
-Infinity
opD = 0 , onD = 0 op = 0 , on = 0 , infp = Infinity , infn = -Infinity , infpD = Infinity , infnD = -Infinity
Math.max(+0.0, -0.0) 0
Check (1 / Math.max(+0.0, -0.0) < 0)  - false 
done
Infinity
Infinity
Infinity
-Infinity
undefined
undefined
NaN
1


Notice the change from -Infinity to Infinity. Disabling DFGJit altogether also returns a good result.
$ jsc --useDFGJIT=false JSTests/ChakraCore/test/jsc-lib.js JSTests/ChakraCore/test/Math/max.js
Infinity
-Infinity
opD = 0 , onD = 0 op = 0 , on = 0 , infp = Infinity , infn = -Infinity , infpD = Infinity , infnD = -Infinity
Math.max(+0.0, -0.0) 0
Check (1 / Math.max(+0.0, -0.0) < 0)  - false 
done
Infinity
Infinity
Infinity
-Infinity
undefined
undefined
NaN
1

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-unassigned/attachments/20191025/a300a29b/attachment-0001.htm>