137827 2014-10-17 12:15:35 -0700 Math.abs() returns negative 2015-05-01 15:36:58 -0700 1 1 1 Unclassified WebKit JavaScriptCore 528+ (Nightly build) Mac (Intel) OS X 10.9 RESOLVED FIXED InRadar P2 Normal --- 1 mail webkit-unassigned ap benjamin commit-queue darin dpino fpizlo ggaren webkit-bug-importer oldest_to_newest 1042422 0 mail 2014-10-17 12:15:35 -0700 Calls to Math.abs() can return a negative in certain scenarios. Can be triggered pretty easily by calling it within requestAnimationFrame. Demo: http://jsbin.com/netev/edit?js,output 1042561 1 ap 2014-10-17 21:48:58 -0700 function test() { var abs = Math.abs(-0.75); if (abs < 0) { alert('Math.abs(-0.75) is negative?'); return; } requestAnimationFrame(test); } test(); 1044714 2 webkit-bug-importer 2014-10-28 23:51:49 -0700 <rdar://problem/18807804> 1044715 3 webkit-bug-importer 2014-10-28 23:51:50 -0700 <rdar://problem/18807806> 1052173 4 darin 2014-12-03 09:22:59 -0800 <rdar://problem/18694698> 1053797 5 dpino 2014-12-09 08:34:12 -0800 It seems this issue is happening when Matb.abs gets jitted, apparently when the DFG kicks in. function test(times) { for (var i = 0; i < times; i++) { result = Math.abs(-0.75); } print(times + " times: " + result); } test(1); test(10); test(100); test(1000); test(10000); test(100000); test(1000000); Prints out: 1 times: 0.75 10 times: 0.75 100 times: 0.75 1000 times: 0.75 10000 times: -0.75 100000 times: -0.75 1000000 times: -0.75 If disabling DFG compilation, the issue doesn't happen. Source/JavaScriptCore/runtime/Options.h v(bool, useDFGJIT, false) \ I also noticed this issue is only happening with floats, it works OK for integers (regardless DFGJIT is on or off). So everything points to be an issue in dfg/DFGSpeculativeJIT64.cpp, when emitting the jitted code for ArithAbs. My environment is Ubuntu 14.04 x86_64, WebKitGTK+. 1090871 6 252169 basile_clement 2015-05-01 13:38:20 -0700 Created attachment 252169 Patch 1090872 7 252169 fpizlo 2015-05-01 13:45:24 -0700 Comment on attachment 252169 Patch Ooops. Can you add a test? 1090873 8 252169 msaboff 2015-05-01 13:55:36 -0700 Comment on attachment 252169 Patch r=me 1090883 9 252171 basile_clement 2015-05-01 14:34:19 -0700 Created attachment 252171 Patch for landing 1090918 10 252171 commit-queue 2015-05-01 15:36:53 -0700 Comment on attachment 252171 Patch for landing Clearing flags on attachment: 252171 Committed r183692: <http://trac.webkit.org/changeset/183692> 1090919 11 commit-queue 2015-05-01 15:36:58 -0700 All reviewed patches have been landed. Closing bug. 252169 2015-05-01 13:38:20 -0700 2015-05-01 14:34:14 -0700 Patch bug-137827-20150501133708.patch text/plain 1666 basile_clement U3VidmVyc2lvbiBSZXZpc2lvbjogMTgzNjg3CmRpZmYgLS1naXQgYS9Tb3VyY2UvSmF2YVNjcmlw dENvcmUvQ2hhbmdlTG9nIGIvU291cmNlL0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwppbmRleCA3 MDhiNzJhNWI5ZTFhZGQ4NjU2ODQ0NjYyNjdmNDUzYzA4ZDdlNzc3Li5lOWRkNmYzZWY5OTUyMjY2 NmY5NTU3MWYzM2U2YmU5YmU2NjQxN2Y4IDEwMDY0NAotLS0gYS9Tb3VyY2UvSmF2YVNjcmlwdENv cmUvQ2hhbmdlTG9nCisrKyBiL1NvdXJjZS9KYXZhU2NyaXB0Q29yZS9DaGFuZ2VMb2cKQEAgLTEs MyArMSwxNiBAQAorMjAxNS0wNS0wMSAgQmFzaWxlIENsZW1lbnQgIDxiYXNpbGVfY2xlbWVudEBh cHBsZS5jb20+CisKKyAgICAgICAgTWF0aC5hYnMoKSByZXR1cm5zIG5lZ2F0aXZlCisgICAgICAg IGh0dHBzOi8vYnVncy53ZWJraXQub3JnL3Nob3dfYnVnLmNnaT9pZD0xMzc4MjcKKworICAgICAg ICBSZXZpZXdlZCBieSBOT0JPRFkgKE9PUFMhKS4KKworICAgICAgICBNYXRoLmFicygpIG9uIGRv dWJsZXMgd2FzIG1pc3Rha2VubHkgYXNzdW1lZCBieSB0aGUgREZHIEFJIHRvIGJlIHRoZQorICAg ICAgICBpZGVudGl0eSBmdW5jdGlvbi4KKworICAgICAgICAqIGRmZy9ERkdBYnN0cmFjdEludGVy cHJldGVySW5saW5lcy5oOgorICAgICAgICAoSlNDOjpERkc6OkFic3RyYWN0SW50ZXJwcmV0ZXI8 QWJzdHJhY3RTdGF0ZVR5cGU+OjpleGVjdXRlRWZmZWN0cyk6CisKIDIwMTUtMDQtMzAgIEpvbiBE YXZpcyAgPGpvbmRAYXBwbGUuY29tPgogCiAgICAgICAgIFdlYiBJbnNwZWN0b3I6IGNvbnNvbGUg c2hvdWxkIHNob3cgYW4gaWNvbiBmb3IgY29uc29sZS5pbmZvKCkgbWVzc2FnZXMKZGlmZiAtLWdp dCBhL1NvdXJjZS9KYXZhU2NyaXB0Q29yZS9kZmcvREZHQWJzdHJhY3RJbnRlcnByZXRlcklubGlu ZXMuaCBiL1NvdXJjZS9KYXZhU2NyaXB0Q29yZS9kZmcvREZHQWJzdHJhY3RJbnRlcnByZXRlcklu bGluZXMuaAppbmRleCA2OTBiMjhmY2U5MWVhYWI3ZjIyMzQ0YzIzYTJiNTk5YTk2ZDQ4MzIwLi45 MzQyMDkzNWIzOGJlZjQ0NzhlZGEwYzk1ZjlkODU1MjYzYmZkNzAyIDEwMDY0NAotLS0gYS9Tb3Vy Y2UvSmF2YVNjcmlwdENvcmUvZGZnL0RGR0Fic3RyYWN0SW50ZXJwcmV0ZXJJbmxpbmVzLmgKKysr IGIvU291cmNlL0phdmFTY3JpcHRDb3JlL2RmZy9ERkdBYnN0cmFjdEludGVycHJldGVySW5saW5l cy5oCkBAIC03MzIsNyArNzMyLDcgQEAgYm9vbCBBYnN0cmFjdEludGVycHJldGVyPEFic3RyYWN0 U3RhdGVUeXBlPjo6ZXhlY3V0ZUVmZmVjdHModW5zaWduZWQgY2xvYmJlckxpbWkKICAgICAgICAg ICAgIGJyZWFrOwogICAgICAgICBjYXNlIERvdWJsZVJlcFVzZToKICAgICAgICAgICAgIGlmIChj aGlsZCAmJiBjaGlsZC5pc051bWJlcigpKSB7Ci0gICAgICAgICAgICAgICAgc2V0Q29uc3RhbnQo bm9kZSwganNEb3VibGVOdW1iZXIoY2hpbGQuYXNOdW1iZXIoKSkpOworICAgICAgICAgICAgICAg IHNldENvbnN0YW50KG5vZGUsIGpzRG91YmxlTnVtYmVyKGZhYnMoY2hpbGQuYXNOdW1iZXIoKSkp KTsKICAgICAgICAgICAgICAgICBicmVhazsKICAgICAgICAgICAgIH0KICAgICAgICAgICAgIGZv ck5vZGUobm9kZSkuc2V0VHlwZSh0eXBlT2ZEb3VibGVBYnMoZm9yTm9kZShub2RlLT5jaGlsZDEo KSkubV90eXBlKSk7Cg== 252171 2015-05-01 14:34:19 -0700 2015-05-01 15:36:53 -0700 Patch for landing bug-137827-20150501143308.patch text/plain 2338 basile_clement U3VidmVyc2lvbiBSZXZpc2lvbjogMTgzNjg4CmRpZmYgLS1naXQgYS9Tb3VyY2UvSmF2YVNjcmlw dENvcmUvQ2hhbmdlTG9nIGIvU291cmNlL0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwppbmRleCA3 MDhiNzJhNWI5ZTFhZGQ4NjU2ODQ0NjYyNjdmNDUzYzA4ZDdlNzc3Li5hMjVmZDIzZDNjYzljMTBk N2M4M2YyOGRkNTA3MDgyZDg0YTA4OTA1IDEwMDY0NAotLS0gYS9Tb3VyY2UvSmF2YVNjcmlwdENv cmUvQ2hhbmdlTG9nCisrKyBiL1NvdXJjZS9KYXZhU2NyaXB0Q29yZS9DaGFuZ2VMb2cKQEAgLTEs MyArMSwxOCBAQAorMjAxNS0wNS0wMSAgQmFzaWxlIENsZW1lbnQgIDxiYXNpbGVfY2xlbWVudEBh cHBsZS5jb20+CisKKyAgICAgICAgTWF0aC5hYnMoKSByZXR1cm5zIG5lZ2F0aXZlCisgICAgICAg IGh0dHBzOi8vYnVncy53ZWJraXQub3JnL3Nob3dfYnVnLmNnaT9pZD0xMzc4MjcKKworICAgICAg ICBSZXZpZXdlZCBieSBNaWNoYWVsIFNhYm9mZi4KKworICAgICAgICBNYXRoLmFicygpIG9uIGRv dWJsZXMgd2FzIG1pc3Rha2VubHkgYXNzdW1lZCBieSB0aGUgREZHIEFJIHRvIGJlIHRoZQorICAg ICAgICBpZGVudGl0eSBmdW5jdGlvbi4KKworICAgICAgICAqIGRmZy9ERkdBYnN0cmFjdEludGVy cHJldGVySW5saW5lcy5oOgorICAgICAgICAoSlNDOjpERkc6OkFic3RyYWN0SW50ZXJwcmV0ZXI8 QWJzdHJhY3RTdGF0ZVR5cGU+OjpleGVjdXRlRWZmZWN0cyk6CisgICAgICAgICogdGVzdHMvc3Ry ZXNzL21hdGgtYWJzLXBvc2l0aXZlLmpzOiBBZGRlZCwgd2FzIHByZXZpb3VzbHkgZmFpbGluZy4K KyAgICAgICAgKGZvbyk6CisKIDIwMTUtMDQtMzAgIEpvbiBEYXZpcyAgPGpvbmRAYXBwbGUuY29t PgogCiAgICAgICAgIFdlYiBJbnNwZWN0b3I6IGNvbnNvbGUgc2hvdWxkIHNob3cgYW4gaWNvbiBm b3IgY29uc29sZS5pbmZvKCkgbWVzc2FnZXMKZGlmZiAtLWdpdCBhL1NvdXJjZS9KYXZhU2NyaXB0 Q29yZS9kZmcvREZHQWJzdHJhY3RJbnRlcnByZXRlcklubGluZXMuaCBiL1NvdXJjZS9KYXZhU2Ny aXB0Q29yZS9kZmcvREZHQWJzdHJhY3RJbnRlcnByZXRlcklubGluZXMuaAppbmRleCA2OTBiMjhm Y2U5MWVhYWI3ZjIyMzQ0YzIzYTJiNTk5YTk2ZDQ4MzIwLi45MzQyMDkzNWIzOGJlZjQ0NzhlZGEw Yzk1ZjlkODU1MjYzYmZkNzAyIDEwMDY0NAotLS0gYS9Tb3VyY2UvSmF2YVNjcmlwdENvcmUvZGZn L0RGR0Fic3RyYWN0SW50ZXJwcmV0ZXJJbmxpbmVzLmgKKysrIGIvU291cmNlL0phdmFTY3JpcHRD b3JlL2RmZy9ERkdBYnN0cmFjdEludGVycHJldGVySW5saW5lcy5oCkBAIC03MzIsNyArNzMyLDcg QEAgYm9vbCBBYnN0cmFjdEludGVycHJldGVyPEFic3RyYWN0U3RhdGVUeXBlPjo6ZXhlY3V0ZUVm ZmVjdHModW5zaWduZWQgY2xvYmJlckxpbWkKICAgICAgICAgICAgIGJyZWFrOwogICAgICAgICBj YXNlIERvdWJsZVJlcFVzZToKICAgICAgICAgICAgIGlmIChjaGlsZCAmJiBjaGlsZC5pc051bWJl cigpKSB7Ci0gICAgICAgICAgICAgICAgc2V0Q29uc3RhbnQobm9kZSwganNEb3VibGVOdW1iZXIo Y2hpbGQuYXNOdW1iZXIoKSkpOworICAgICAgICAgICAgICAgIHNldENvbnN0YW50KG5vZGUsIGpz RG91YmxlTnVtYmVyKGZhYnMoY2hpbGQuYXNOdW1iZXIoKSkpKTsKICAgICAgICAgICAgICAgICBi cmVhazsKICAgICAgICAgICAgIH0KICAgICAgICAgICAgIGZvck5vZGUobm9kZSkuc2V0VHlwZSh0 eXBlT2ZEb3VibGVBYnMoZm9yTm9kZShub2RlLT5jaGlsZDEoKSkubV90eXBlKSk7CmRpZmYgLS1n aXQgYS9Tb3VyY2UvSmF2YVNjcmlwdENvcmUvdGVzdHMvc3RyZXNzL21hdGgtYWJzLXBvc2l0aXZl LmpzIGIvU291cmNlL0phdmFTY3JpcHRDb3JlL3Rlc3RzL3N0cmVzcy9tYXRoLWFicy1wb3NpdGl2 ZS5qcwpuZXcgZmlsZSBtb2RlIDEwMDY0NAppbmRleCAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAw MDAwMDAwMDAwMDAwMDAwLi5mYzRlMTY0NjA1NmIxMzUyZDM1NjhiNjE4MjJlM2FmYjQ3NWNlYjVi Ci0tLSAvZGV2L251bGwKKysrIGIvU291cmNlL0phdmFTY3JpcHRDb3JlL3Rlc3RzL3N0cmVzcy9t YXRoLWFicy1wb3NpdGl2ZS5qcwpAQCAtMCwwICsxLDExIEBACit2YXIgbWludXNfdGhyZWVfcXVh cnRlcnMgPSAtMC43NTsKKworZnVuY3Rpb24gZm9vKCkgeworICAgIHJldHVybiBNYXRoLmFicyht aW51c190aHJlZV9xdWFydGVycyk7Cit9CisKK2ZvciAodmFyIGkgPSAwOyBpIDwgMTAwMDA7IGkr KykgeworICAgIHZhciByZXN1bHQgPSBmb28oKTsKKyAgICBpZiAocmVzdWx0IDwgMCkKKyAgICAg ICAgdGhyb3cgIkVycm9yOiBNYXRoLmFicyByZXR1cm5lZCBhIG5lZ2F0aXZlIHZhbHVlLiI7Cit9 Cg==