Differential Testing: Different output message involving arguments

RESOLVED FIXED in mozilla33

Status

()

Core
JavaScript Engine: JIT
--
major
RESOLVED FIXED
4 years ago
4 years ago

People

(Reporter: gkw, Assigned: jandem)

Tracking

(Blocks: 2 bugs, {regression, testcase})

Trunk
mozilla33
x86
All
regression, testcase
Points:
---
Dependency tree / graph
Bug Flags:
in-testsuite +

Firefox Tracking Flags

(Not tracked)

Details

Attachments

(1 attachment)

(Reporter)

Description

4 years ago
function f(x) {
    x = eval("a = arguments.callee.arguments");
}
f(1)
print(uneval(a))

$ ./js-dbg-64-dm-ts-darwin-4876594bacaa --fuzzing-safe --ion-parallel-compile=off testcase.js
({0:{}})

$ ./js-dbg-64-dm-ts-darwin-4876594bacaa --fuzzing-safe --ion-parallel-compile=off --ion-eager testcase.js
({0:1})

(Tested this on 64-bit Mac js dbg threadsafe deterministic shell off m-c rev 4876594bacaa)

My configure flags are:

CC="clang -Qunused-arguments" CXX="clang++ -Qunused-arguments" AR=ar sh /Users/skywalker/trees/mozilla-central/js/src/configure --target=x86_64-apple-darwin12.5.0 --enable-optimize --enable-debug --enable-profiling --enable-gczeal --enable-debug-symbols --disable-tests --enable-more-deterministic --with-ccache --enable-threadsafe <other NSPR options>

I think this might go way back to Jan 2013, approximately rev 4b84e5d7523d, but I'm not sure.

Jan, what do you think could be going on here?
Flags: needinfo?(jdemooij)
(Assignee)

Comment 1

4 years ago
Created attachment 8440614 [details] [diff] [review]
Patch

Great find, Gary!

The problem is that maybeForwardToCallObject called ArgumentsObject::MaybeForwardToCallObject only for interpreter frames, but we should also do this for Baseline frames.

I think comment 0 is right and this goes back to the Baseline landing.
Assignee: nobody → jdemooij
Status: NEW → ASSIGNED
Attachment #8440614 - Flags: review?(luke)
Flags: needinfo?(jdemooij)

Updated

4 years ago
Attachment #8440614 - Flags: review?(luke) → review+
https://hg.mozilla.org/mozilla-central/rev/e0ecf7fd2876
Status: ASSIGNED → RESOLVED
Last Resolved: 4 years ago
Flags: in-testsuite+
Resolution: --- → FIXED
Target Milestone: --- → mozilla33
You need to log in before you can comment on or make changes to this bug.