1147662 - Differential Testing: Different output message involving recursion

Status: RESOLVED FIXED

(Core :: JavaScript Engine: JIT, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

try {
    (function() {
        let x = (function f(y) {
            if (y == 0) {
                x
                return
            }
            return f(y - 1)
        })(3)
        print("FOO")
    })()
} catch (e) {}

$ ./js-32-dm-nsprBuild-linux-97076df948c2 --fuzzing-safe --no-threads --ion-eager testcase.js
FOO

$ ./js-32-dm-nsprBuild-linux-97076df948c2 --fuzzing-safe --no-threads --baseline-eager testcase.js

Tested this on m-c rev 97076df948c2.

My configure flags are:

CXX="g++ -m32 -msse2 -mfpmath=sse" CC="gcc -m32 -msse2 -mfpmath=sse" AR=ar PKG_CONFIG_LIBDIR=/usr/lib/pkgconfig sh /home/gkwong/trees/mozilla-central/js/src/configure --target=i686-pc-linux --enable-nspr-build --enable-more-deterministic --with-ccache --enable-gczeal --enable-debug-symbols --disable-tests

python -u ~/fuzzing/js/compileShell.py -b "--32 --enable-nspr-build --enable-more-deterministic" -r 97076df948c2

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   https://hg.mozilla.org/mozilla-central/rev/fbe012eea2e6
user:        Benjamin Bouvier
date:        Fri Mar 20 16:28:58 2015 +0100
summary:     Bug 1143758: Make LexicalCheck movable and bailout when a lexical isn't initialized; r=shu

Benjamin, is bug 1143758 a likely regressor?

Comment 1

[Benjamin Bouvier [:bbouvier] (inactive)]

Attachment: lc.patch

Yes it is.

Sorry about that: i forgot an instruction can be movable *and* a guard at the same time, which is needed here (otherwise we discard the lexical check, as its results is unused).

Comment 2

[Shu-yu Guo [:shu]]

Comment on attachment 8583772 [details] [diff] [review]
lc.patch

Review of attachment 8583772 [details] [diff] [review]:
-----------------------------------------------------------------

Should've caught that in review. :(

Comment 3

[Benjamin Bouvier [:bbouvier] (inactive)]

https://hg.mozilla.org/integration/mozilla-inbound/rev/46e3f17440a7

Comment 4

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/46e3f17440a7