Bug 165651 – REGRESSION(r208791): Assertion in testb3

• Status: RESOLVED
• Resolution: FIXED
• Component: JavaScriptCore

[Csaba Osztrogonác]

ASSERTION FAILED: compileAndRun<uint32_t>(proc, a, b) == a / b (compileAndRun<uint32_t>(proc, a, b) == 1, a / b == 0)
../../Source/JavaScriptCore/b3/testb3.cpp(1775) : void {anonymous}::testUDivArgsInt32(uint32_t, uint32_t)

I don't know if it is a regression or not, I haven't run testb3 in the last months. I don't 
know if it is Linux specific or not, I don't have any chance to test on non Linux environment.

[Csaba Osztrogonác]

ASSERTION FAILED: compileAndRun<uint64_t>(proc, a, b) == a / b (compileAndRun<uint64_t>(proc, a, b) == 1, a / b == 0)
../../Source/JavaScriptCore/b3/testb3.cpp(1791) : void {anonymous}::testUDivArgsInt64(uint64_t, uint64_t)

[Csaba Osztrogonác]

Just a note, this test was added by https://trac.webkit.org/changeset/208781

[Csaba Osztrogonác]

(In reply to comment #2)
> Just a note, this test was added by https://trac.webkit.org/changeset/208781

It must be a regression, because it passed when it was added.

[Csaba Osztrogonác]

I bisected, it is definitely a regression caused by https://trac.webkit.org/changeset/208791 .

[Keith Miller]

Hmm, interesting. I definitely ran testb3 before landing maybe I messed up while rebasing or something.

[Yusuke Suzuki]

OK, I've found the issue.

[Yusuke Suzuki]

Created attachment 296789 [details]
Patch

[Saam Barati]

Comment on attachment 296789 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=296789&action=review

> Source/JavaScriptCore/ChangeLog:9
> +        Accidentally we always use edx/rdx for the result of UDiv/UMod.
> +        But it is incorrect. We should use eax/rax for the result of UDiv.

Is there documentation on this?

[Yusuke Suzuki]

Comment on attachment 296789 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=296789&action=review

>> Source/JavaScriptCore/ChangeLog:9
>> +        But it is incorrect. We should use eax/rax for the result of UDiv.
> 
> Is there documentation on this?

It's x86's div convension. It should be handled in B3/Air, so that the caller side should not consider about it.

[Yusuke Suzuki]

Committed r209658: <http://trac.webkit.org/changeset/209658>