1033873 - Differential Testing: Different output message involving __proto__

Status: RESOLVED FIXED

(Core :: JavaScript Engine: JIT, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

function f() {
    return __proto__
}
f()
f()
print(f())


$ ./js-dbgDisabled-opt-64-prof-dm-ts-darwin-5d9af625f42e --fuzzing-safe --ion-offthread-compile=off testcase.js
[object Object]

$ ./js-dbgDisabled-opt-64-prof-dm-ts-darwin-5d9af625f42e --fuzzing-safe --ion-offthread-compile=off --ion-eager testcase.js
null

(Tested this on 64-bit Mac js opt threadsafe deterministic shell off m-c rev 5d9af625f42e)

My configure flags are:

CC="clang -Qunused-arguments" CXX="clang++ -Qunused-arguments" AR=ar sh /Users/skywalker/trees/mozilla-central/js/src/configure --target=x86_64-apple-darwin12.5.0 --disable-debug --enable-optimize --enable-profiling --enable-gczeal --enable-debug-symbols --disable-tests --enable-more-deterministic --with-ccache --enable-threadsafe <other NSPR options>

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   https://hg.mozilla.org/mozilla-central/rev/157947d5fe31
user:        Eric Faust
date:        Wed Jun 18 13:00:17 2014 -0700
summary:     Bug 1022736 - Allow cacheing of GlobalObject getters on non-global scopechains. (r=jandem)

Brian, is bug 1022736 a likely regressor?

Comment 1

[Eric Faust [:efaust]]

Oh yeah. This one's definitely on me. Taking.

Comment 2

[Eric Faust [:efaust]]

Attachment: Fix

Clean up some scratch register aliasing issues.

Comment 3

[Jan de Mooij [:jandem]]

Comment on attachment 8449962 [details] [diff] [review]
Fix

Review of attachment 8449962 [details] [diff] [review]:
-----------------------------------------------------------------

Please also add a testcase that fails without this patch. r=me with that.

::: js/src/jit/IonCaches.cpp
@@ +1004,5 @@
>                     ImmGCPtr(holder->lastProperty()),
>                     failures);
>  
> +    if (restoreObjReg)
> +        masm.pop(object);

NameIC::attachCallGetter has:

Register scratchReg = outputReg().valueReg().scratchReg();

And passes that as the object register. So we were always passing the "holder" instead of "object" to EmitGetterCall right? Good catch, fuzzing FTW.

Comment 4

[Eric Faust [:efaust]]

Attachment: Allow GenerateCallGetter to accept objects in the scratch register. (r=jandem)

Nits addressed. Carrying r+.

Comment 5

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/73b13f03a16b

Comment 6

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/73b13f03a16b

Comment 7

[Ryan VanderMeulen [:RyanVM]]

This was backported to Fx33 to fix bug 1067153.
https://hg.mozilla.org/releases/mozilla-beta/rev/2dbe6d8a5c30