Closed Bug 1076283 Opened 10 years ago Closed 10 years ago

Differential Testing: Different output message involving this

Categories

(Core :: JavaScript Engine: JIT, defect)

x86_64
macOS
defect
Not set
major

Tracking

()

RESOLVED FIXED
mozilla35

People

(Reporter: gkw, Assigned: jandem)

References

Details

(Keywords: regression, testcase)

Attachments

(1 file)

function f() {
    this.print("FOO")
}
x = new Array
this.f()
Object.defineProperty(x, 3, {
    get: function() {
        for (var j = 0; j < 1; ++j) {
            f()
        }
    }
})
try {
    x()
} catch (e) {}

$ ./js-dbg-opt-64-dm-nsprBuild-darwin-835ef55e175e --fuzzing-safe --no-threads --ion-eager testcase.js
FOO

$ ./js-dbg-opt-64-dm-nsprBuild-darwin-835ef55e175e --fuzzing-safe --no-threads --baseline-eager testcase.js
FOO
FOO

Tested this on m-c rev 835ef55e175e.

My configure flags are:

CC="clang -Qunused-arguments" CXX="clang++ -Qunused-arguments" AR=ar sh /Users/skywalker/trees/mozilla-central/js/src/configure --target=x86_64-apple-darwin12.5.0 --enable-debug --enable-optimize --enable-nspr-build --enable-more-deterministic --with-ccache --enable-gczeal --enable-debug-symbols --disable-tests

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   https://hg.mozilla.org/mozilla-central/rev/1369bf46b89f
user:        Guptha Rajagopal
date:        Fri Aug 15 15:55:00 2014 -0400
summary:     Bug 924672 - Implement ES6 method definitions. r=jorendorff

Guptha, is bug 924672 likely related?
Flags: needinfo?(gupta.rajagopal)
Hmmm, this particular bug does not introduce changes to the jits themselves. So, I'm not sure how this would lead to differences in output between baseline and ion. It is possible this bug changes something that exposes an existing issue.

I'd investigate further, but I'm slammed with work right now. Let me leave the needinfo on - I will look into this when possible.

Thanks!
(In reply to guptha from comment #1)
> Hmmm, this particular bug does not introduce changes to the jits themselves.
> So, I'm not sure how this would lead to differences in output between
> baseline and ion. It is possible this bug changes something that exposes an
> existing issue.
> 
> I'd investigate further, but I'm slammed with work right now.
/snip

Or maybe one of our JIT gurus can help you out. :)
Flags: needinfo?(jdemooij)
Gary, can you try to run autoBisect with the testcase below? Same arguments as in comment 0?

I think I know what's happening but I'd like some confirmation that it's an older bug.

function f() {
    print(this);
}
this.f();
function gg() {
    for (var j = 0; j < 3; ++j) {
        f();
    }
};
gg();
Flags: needinfo?(gary)
Okay, will get to this bisection soon.
Summary: Differential Testing: Different output message involving this and defineProperty → Differential Testing: Different output message involving this
autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   http://hg.mozilla.org/mozilla-central/rev/39bfcadd6492
user:        Hannes Verschore
date:        Tue Nov 26 23:21:18 2013 +0100
summary:     Bug 942105 - IonMonkey: Remove the inlineUseCountRatio option, r=jandem

Hannes, is bug 942105 a likely regressor?
Blocks: 942105
No longer blocks: 924672
Flags: needinfo?(gary) → needinfo?(hv1989)
Back to jandem per IRC. The bug didn't introduce this issue. But I wasn't able yet to transform the testcase to fail before this revision, due to the interaction between different parts.
Flags: needinfo?(hv1989)
Flags: needinfo?(gupta.rajagopal)
Attached patch PatchSplinter Review
Assignee: nobody → jdemooij
Status: NEW → ASSIGNED
Attachment #8501687 - Flags: review?(hv1989)
Flags: needinfo?(jdemooij)
Comment on attachment 8501687 [details] [diff] [review]
Patch

Review of attachment 8501687 [details] [diff] [review]:
-----------------------------------------------------------------

Oh this is a better fix than what I had in my mind!
Attachment #8501687 - Flags: review?(hv1989) → review+
https://hg.mozilla.org/mozilla-central/rev/d1780ae568a0
Status: ASSIGNED → RESOLVED
Closed: 10 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla35
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Created:
Updated:
Size: