If you think a bug might affect users in the 57 release, please set the correct tracking and status flags for Release Management.

Differential Testing: Different output message involving recursion

RESOLVED FIXED in Firefox 39

Status

()

Core
JavaScript Engine: JIT
--
major
RESOLVED FIXED
3 years ago
3 years ago

People

(Reporter: gkw, Assigned: bbouvier)

Tracking

(Blocks: 2 bugs, {regression, testcase})

Trunk
mozilla39
x86_64
Mac OS X
regression, testcase
Points:
---
Dependency tree / graph
Bug Flags:
in-testsuite +

Firefox Tracking Flags

(firefox39 fixed)

Details

Attachments

(1 attachment)

(Reporter)

Description

3 years ago
try {
    (function() {
        let x = (function f(y) {
            if (y == 0) {
                x
                return
            }
            return f(y - 1)
        })(3)
        print("FOO")
    })()
} catch (e) {}

$ ./js-32-dm-nsprBuild-linux-97076df948c2 --fuzzing-safe --no-threads --ion-eager testcase.js
FOO

$ ./js-32-dm-nsprBuild-linux-97076df948c2 --fuzzing-safe --no-threads --baseline-eager testcase.js

Tested this on m-c rev 97076df948c2.

My configure flags are:

CXX="g++ -m32 -msse2 -mfpmath=sse" CC="gcc -m32 -msse2 -mfpmath=sse" AR=ar PKG_CONFIG_LIBDIR=/usr/lib/pkgconfig sh /home/gkwong/trees/mozilla-central/js/src/configure --target=i686-pc-linux --enable-nspr-build --enable-more-deterministic --with-ccache --enable-gczeal --enable-debug-symbols --disable-tests

python -u ~/fuzzing/js/compileShell.py -b "--32 --enable-nspr-build --enable-more-deterministic" -r 97076df948c2

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   https://hg.mozilla.org/mozilla-central/rev/fbe012eea2e6
user:        Benjamin Bouvier
date:        Fri Mar 20 16:28:58 2015 +0100
summary:     Bug 1143758: Make LexicalCheck movable and bailout when a lexical isn't initialized; r=shu

Benjamin, is bug 1143758 a likely regressor?
Flags: needinfo?(benj)
(Assignee)

Comment 1

3 years ago
Created attachment 8583772 [details] [diff] [review]
lc.patch

Yes it is.

Sorry about that: i forgot an instruction can be movable *and* a guard at the same time, which is needed here (otherwise we discard the lexical check, as its results is unused).
Assignee: nobody → benj
Status: NEW → ASSIGNED
Flags: needinfo?(benj)
Attachment #8583772 - Flags: review?(shu)

Comment 2

3 years ago
Comment on attachment 8583772 [details] [diff] [review]
lc.patch

Review of attachment 8583772 [details] [diff] [review]:
-----------------------------------------------------------------

Should've caught that in review. :(
Attachment #8583772 - Flags: review?(shu) → review+
(Assignee)

Comment 3

3 years ago
https://hg.mozilla.org/integration/mozilla-inbound/rev/46e3f17440a7
https://hg.mozilla.org/mozilla-central/rev/46e3f17440a7
Status: ASSIGNED → RESOLVED
Last Resolved: 3 years ago
status-firefox39: affected → fixed
Flags: in-testsuite+
Resolution: --- → FIXED
Target Milestone: --- → mozilla39
You need to log in before you can comment on or make changes to this bug.