Math.abs() returns negative

• Component: JavaScriptCore
• Status: RESOLVED FIXED

Calls to Math.abs() can return a negative in certain scenarios. Can be triggered pretty easily by calling it within requestAnimationFrame. Demo: http://jsbin.com/netev/edit?js,output

[Alexey Proskuryakov]

function test() {
  var abs = Math.abs(-0.75);

  if (abs < 0) {
    alert('Math.abs(-0.75) is negative?');
    return;
  }

  requestAnimationFrame(test);
}

test();

[Radar WebKit Bug Importer]

<rdar://problem/18807804>

[Radar WebKit Bug Importer]

<rdar://problem/18807806>

[Darin Adler]

<rdar://problem/18694698>

[Diego Pino]

It seems this issue is happening when Matb.abs gets jitted, apparently when the DFG kicks in.

function test(times) {
    for (var i = 0; i < times; i++) {
       result = Math.abs(-0.75);
    }
    print(times + " times: " + result);
}

test(1);
test(10);
test(100);
test(1000);
test(10000);
test(100000);
test(1000000);

Prints out:

1 times: 0.75
10 times: 0.75
100 times: 0.75
1000 times: 0.75
10000 times: -0.75
100000 times: -0.75
1000000 times: -0.75

If disabling DFG compilation, the issue doesn't happen.

Source/JavaScriptCore/runtime/Options.h
v(bool, useDFGJIT, false) \

I also noticed this issue is only happening with floats, it works OK for integers (regardless DFGJIT is on or off).

So everything points to be an issue in dfg/DFGSpeculativeJIT64.cpp, when emitting the jitted code for ArithAbs.

My environment is Ubuntu 14.04 x86_64, WebKitGTK+.

[Basile Clement]

Created attachment 252169 [details]
Patch

[Filip Pizlo]

Comment on attachment 252169 [details]
Patch

Ooops.  Can you add a test?

[Michael Saboff]

Comment on attachment 252169 [details]
Patch

r=me

[Basile Clement]

Created attachment 252171 [details]
Patch for landing

[WebKit Commit Bot]

Comment on attachment 252171 [details]
Patch for landing

Clearing flags on attachment: 252171

Committed r183692: <http://trac.webkit.org/changeset/183692>

[WebKit Commit Bot]

All reviewed patches have been landed.  Closing bug.