Bug 137827 - Math.abs() returns negative
Summary: Math.abs() returns negative
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: JavaScriptCore (show other bugs)
Version: 528+ (Nightly build)
Hardware: Mac (Intel) OS X 10.9
: P2 Normal
Assignee: Nobody
URL:
Keywords: InRadar
Depends on:
Blocks:
 
Reported: 2014-10-17 12:15 PDT by mail
Modified: 2015-05-01 15:36 PDT (History)
8 users (show)

See Also:


Attachments
Patch (1.63 KB, patch)
2015-05-01 13:38 PDT, Basile Clement
no flags Details | Formatted Diff | Diff
Patch for landing (2.28 KB, patch)
2015-05-01 14:34 PDT, Basile Clement
no flags Details | Formatted Diff | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description mail 2014-10-17 12:15:35 PDT
Calls to Math.abs() can return a negative in certain scenarios. Can be triggered pretty easily by calling it within requestAnimationFrame. Demo: http://jsbin.com/netev/edit?js,output
Comment 1 Alexey Proskuryakov 2014-10-17 21:48:58 PDT
function test() {
  var abs = Math.abs(-0.75);

  if (abs < 0) {
    alert('Math.abs(-0.75) is negative?');
    return;
  }

  requestAnimationFrame(test);
}

test();
Comment 2 Radar WebKit Bug Importer 2014-10-28 23:51:49 PDT
<rdar://problem/18807804>
Comment 3 Radar WebKit Bug Importer 2014-10-28 23:51:50 PDT
<rdar://problem/18807806>
Comment 4 Darin Adler 2014-12-03 09:22:59 PST
<rdar://problem/18694698>
Comment 5 Diego Pino 2014-12-09 08:34:12 PST
It seems this issue is happening when Matb.abs gets jitted, apparently when the DFG kicks in.

function test(times) {
    for (var i = 0; i < times; i++) {
       result = Math.abs(-0.75);
    }
    print(times + " times: " + result);
}

test(1);
test(10);
test(100);
test(1000);
test(10000);
test(100000);
test(1000000);

Prints out:

1 times: 0.75
10 times: 0.75
100 times: 0.75
1000 times: 0.75
10000 times: -0.75
100000 times: -0.75
1000000 times: -0.75

If disabling DFG compilation, the issue doesn't happen.

Source/JavaScriptCore/runtime/Options.h
v(bool, useDFGJIT, false) \

I also noticed this issue is only happening with floats, it works OK for integers (regardless DFGJIT is on or off).

So everything points to be an issue in dfg/DFGSpeculativeJIT64.cpp, when emitting the jitted code for ArithAbs.

My environment is Ubuntu 14.04 x86_64, WebKitGTK+.
Comment 6 Basile Clement 2015-05-01 13:38:20 PDT
Created attachment 252169 [details]
Patch
Comment 7 Filip Pizlo 2015-05-01 13:45:24 PDT
Comment on attachment 252169 [details]
Patch

Ooops.  Can you add a test?
Comment 8 Michael Saboff 2015-05-01 13:55:36 PDT
Comment on attachment 252169 [details]
Patch

r=me
Comment 9 Basile Clement 2015-05-01 14:34:19 PDT
Created attachment 252171 [details]
Patch for landing
Comment 10 WebKit Commit Bot 2015-05-01 15:36:53 PDT
Comment on attachment 252171 [details]
Patch for landing

Clearing flags on attachment: 252171

Committed r183692: <http://trac.webkit.org/changeset/183692>
Comment 11 WebKit Commit Bot 2015-05-01 15:36:58 PDT
All reviewed patches have been landed.  Closing bug.