Closed Bug 1076091 Opened 10 years ago Closed 10 years ago

Differential Testing: Different output message involving typedarrays and defineProperty

Categories

(Core :: JavaScript Engine: JIT, defect)

x86_64
macOS
defect
Not set
major

Tracking

()

RESOLVED FIXED
mozilla35

People

(Reporter: gkw, Assigned: bhackett1024)

References

Details

(Keywords: regression, testcase)

Attachments

(1 file)

Object.defineProperty(this, "x", {
    get: function() {
        return this.y
    }
})
x
x
y = Int16Array
var y
print(x)

$ ./js-dbg-opt-64-dm-nsprBuild-darwin-14665b1de5ee --fuzzing-safe --no-threads --ion-eager testcase.js
undefined

$ ./js-dbg-opt-64-dm-nsprBuild-darwin-14665b1de5ee --fuzzing-safe --no-threads --baseline-eager testcase.js
function Int16Array() {
    [native code]
}

Tested this on m-c rev 835ef55e175e.

My configure flags are:

CC="clang -Qunused-arguments" CXX="clang++ -Qunused-arguments" AR=ar sh /Users/skywalker/trees/mozilla-central/js/src/configure --target=x86_64-apple-darwin12.5.0 --enable-debug --enable-optimize --enable-nspr-build --enable-more-deterministic --with-ccache --enable-gczeal --enable-debug-symbols --disable-tests

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   https://hg.mozilla.org/mozilla-central/rev/686300375fd6
user:        Brian Hackett
date:        Wed Sep 03 09:54:41 2014 -0600
summary:     Bug 894596 - Bake the values of constant global variables into Ion code, r=jandem.

Brian, is bug 894596 likely related?
Flags: needinfo?(bhackett1024)
Attached patch patchSplinter Review
We were able to bake in undefined properties on globals into Ion code, which are supposed to require a barrier due to the exceptional way in which these properties are handled by TI (due to how top level global vars are defined first and initialized later).  While the first patch in bug 894596 is on aurora, the one which caused this regression is still only on trunk.
Assignee: nobody → bhackett1024
Attachment #8501078 - Flags: review?(jdemooij)
Flags: needinfo?(bhackett1024)
Attachment #8501078 - Flags: review?(jdemooij) → review+
https://hg.mozilla.org/mozilla-central/rev/bed3f6586a11
Status: NEW → RESOLVED
Closed: 10 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla35
You need to log in before you can comment on or make changes to this bug.