1024444 - Differential Testing: Different output message involving arguments

Status: RESOLVED FIXED

(Core :: JavaScript Engine: JIT, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

function f(x) {
    x = eval("a = arguments.callee.arguments");
}
f(1)
print(uneval(a))

$ ./js-dbg-64-dm-ts-darwin-4876594bacaa --fuzzing-safe --ion-parallel-compile=off testcase.js
({0:{}})

$ ./js-dbg-64-dm-ts-darwin-4876594bacaa --fuzzing-safe --ion-parallel-compile=off --ion-eager testcase.js
({0:1})

(Tested this on 64-bit Mac js dbg threadsafe deterministic shell off m-c rev 4876594bacaa)

My configure flags are:

CC="clang -Qunused-arguments" CXX="clang++ -Qunused-arguments" AR=ar sh /Users/skywalker/trees/mozilla-central/js/src/configure --target=x86_64-apple-darwin12.5.0 --enable-optimize --enable-debug --enable-profiling --enable-gczeal --enable-debug-symbols --disable-tests --enable-more-deterministic --with-ccache --enable-threadsafe <other NSPR options>

I think this might go way back to Jan 2013, approximately rev 4b84e5d7523d, but I'm not sure.

Jan, what do you think could be going on here?

Comment 1

[Jan de Mooij [:jandem]]

Attachment: Patch

Great find, Gary!

The problem is that maybeForwardToCallObject called ArgumentsObject::MaybeForwardToCallObject only for interpreter frames, but we should also do this for Baseline frames.

I think comment 0 is right and this goes back to the Baseline landing.

Comment 2

[Jan de Mooij [:jandem]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/e0ecf7fd2876

Comment 3

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/e0ecf7fd2876