1054541 - Differential Testing: Different output message involving buildPar

Status: RESOLVED FIXED

(Core :: JavaScript Engine: JIT, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

(function() {
    var x = new Int32Array(ArrayBuffer());
    a = Array.buildPar(6, function() {
        return new function() {
            Object.defineProperty(this, "", ({
                enumerable: (x[7] % 6 != 0)
            }));
        }()
    })
})()
print(uneval(a))


$ ./js-dbg-opt-32-dm-nsprBuild-darwin-174e75a23eaf --fuzzing-safe --ion-offthread-compile=off 87375.js
[{'':(void 0)}, {'':(void 0)}, {'':(void 0)}, {'':(void 0)}, {'':(void 0)}, {'':(void 0)}]

$ ./js-dbg-opt-32-dm-nsprBuild-darwin-174e75a23eaf --fuzzing-safe --ion-offthread-compile=off --ion-eager 87375.js
[{'':(void 0)}, {}, {'':(void 0)}, {'':(void 0)}, {'':(void 0)}, {'':(void 0)}]

Tested this on m-c rev 174e75a23eaf.

My configure flags are:

LD=ld CROSS_COMPILE=1 CC="clang -Qunused-arguments -msse2 -mfpmath=sse -arch i386" RANLIB=ranlib CXX="clang++ -Qunused-arguments -msse2 -mfpmath=sse -arch i386" AS=$CC AR=ar STRIP="strip -x -S" HOST_CC="clang -Qunused-arguments -msse2 -mfpmath=sse" HOST_CXX="clang++ -Qunused-arguments -msse2 -mfpmath=sse" sh /Users/skywalker/trees/mozilla-central/js/src/configure --target=i386-apple-darwin9.2.0 --enable-macos-target=10.5 --enable-debug --enable-optimize --enable-gczeal --enable-debug-symbols --disable-tests --enable-more-deterministic --with-ccache --enable-nspr-build

Shu-yu, any idea what's going on here?

Comment 1

[Shu-yu Guo [:shu]]

No idea. I can't reproduce:

shu@pikashu ~/moz/central-hg/js/src/DebugOpt
% dist/bin/js --ion-offthread-compile=off ~/moz/central/js/src/Debug/fuzz.js     
[{'':(void 0)}, {'':(void 0)}, {'':(void 0)}, {'':(void 0)}, {'':(void 0)}, {'':(void 0)}]
shu@pikashu ~/moz/central-hg/js/src/DebugOpt
% dist/bin/js --ion-offthread-compile=off --ion-eager ~/moz/central/js/src/Debug/fuzz.js
[{'':(void 0)}, {'':(void 0)}, {'':(void 0)}, {'':(void 0)}, {'':(void 0)}, {'':(void 0)}]
shu@pikashu ~/moz/central-hg/js/src/DebugOpt
% hg tip
changeset:   199861:174e75a23eaf

Comment 2

[Shu-yu Guo [:shu]]

Re-needinfo if you have a bisection.

Comment 3

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   https://hg.mozilla.org/mozilla-central/rev/b66e279688a1
user:        Dan Gohman
date:        Thu May 08 18:34:49 2014 -0700
summary:     Bug 998580 - IonMonkey: Generalize RangeAnalysis truncation to handle other kinds of paths to integer types. r=nbp

Dan, any idea if bug 998580 is related?

Comment 4

[Dan Gohman [:sunfish]]

Attachment: truncate-typedarray-load-after-bailouts.patch

A supposedly infallible LoadTypedArrayElementStatic still does bounds checking, but it returns 0 on an out-of-bounds access rather than undefined. A truncate kind of truncate-after-bailouts is insufficient to mark a LoadTypedArrayElementStatic as infallible.

This bug was 32-bit x86 only because only 32-bit x86 uses LoadTypedArrayElementStatic (see bug 864214).

Comment 5

[Dan Gohman [:sunfish]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/0380ce352a89

Comment 6

[Ed Morley [:emorley]]

https://hg.mozilla.org/mozilla-central/rev/0380ce352a89