Differential Testing: Different output message involving typedarrays and defineProperty

RESOLVED FIXED in mozilla35

Status

()

defect
--
major
RESOLVED FIXED
5 years ago
5 years ago

People

(Reporter: gkw, Assigned: bhackett)

Tracking

(Blocks 2 bugs, {regression, testcase})

Trunk
mozilla35
x86_64
macOS
Points:
---
Dependency tree / graph

Firefox Tracking Flags

(Not tracked)

Details

Attachments

(1 attachment)

(Reporter)

Description

5 years ago
Object.defineProperty(this, "x", {
    get: function() {
        return this.y
    }
})
x
x
y = Int16Array
var y
print(x)

$ ./js-dbg-opt-64-dm-nsprBuild-darwin-14665b1de5ee --fuzzing-safe --no-threads --ion-eager testcase.js
undefined

$ ./js-dbg-opt-64-dm-nsprBuild-darwin-14665b1de5ee --fuzzing-safe --no-threads --baseline-eager testcase.js
function Int16Array() {
    [native code]
}

Tested this on m-c rev 835ef55e175e.

My configure flags are:

CC="clang -Qunused-arguments" CXX="clang++ -Qunused-arguments" AR=ar sh /Users/skywalker/trees/mozilla-central/js/src/configure --target=x86_64-apple-darwin12.5.0 --enable-debug --enable-optimize --enable-nspr-build --enable-more-deterministic --with-ccache --enable-gczeal --enable-debug-symbols --disable-tests

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   https://hg.mozilla.org/mozilla-central/rev/686300375fd6
user:        Brian Hackett
date:        Wed Sep 03 09:54:41 2014 -0600
summary:     Bug 894596 - Bake the values of constant global variables into Ion code, r=jandem.

Brian, is bug 894596 likely related?
Flags: needinfo?(bhackett1024)
(Assignee)

Comment 1

5 years ago
Posted patch patchSplinter Review
We were able to bake in undefined properties on globals into Ion code, which are supposed to require a barrier due to the exceptional way in which these properties are handled by TI (due to how top level global vars are defined first and initialized later).  While the first patch in bug 894596 is on aurora, the one which caused this regression is still only on trunk.
Assignee: nobody → bhackett1024
Attachment #8501078 - Flags: review?(jdemooij)
Flags: needinfo?(bhackett1024)
Attachment #8501078 - Flags: review?(jdemooij) → review+
https://hg.mozilla.org/mozilla-central/rev/bed3f6586a11
Status: NEW → RESOLVED
Last Resolved: 5 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla35
You need to log in before you can comment on or make changes to this bug.