Closed Bug 1153153 Opened 5 years ago Closed 5 years ago

Differential Testing: Different output message involving "use strict"

Categories

(Core :: JavaScript Engine: JIT, defect, major)

x86_64
macOS
defect
Not set
major

Tracking

()

RESOLVED FIXED
mozilla40
Tracking Status
firefox40 --- fixed

People

(Reporter: gkw, Assigned: h4writer)

References

(Blocks 2 open bugs)

Details

(Keywords: regression, testcase)

Attachments

(1 file)

function f() {};
try {
    (function() {
        "use strict";
        function f(x) {
            (x ? (N = x) : 1) ? x : x
        }
        print(f(0));
        print(f(1));
    })()
} catch (e) {}

$ ./js-dbg-64-dm-nsprBuild-darwin-dd32e3ff3717 --fuzzing-safe --no-threads --ion-eager testcase.js
undefined
undefined

$ ./js-dbg-64-dm-nsprBuild-darwin-dd32e3ff3717 --fuzzing-safe --no-threads --baseline-eager testcase.js
undefined

Tested this on m-c rev dd32e3ff3717.

My configure flags are:

CC="clang -Qunused-arguments" CXX="clang++ -Qunused-arguments" AR=ar AUTOCONF=/usr/local/Cellar/autoconf213/2.13/bin/autoconf213 sh /Users/skywalker/trees/mozilla-central/js/src/configure --target=x86_64-apple-darwin12.5.0 --enable-debug --enable-nspr-build --enable-more-deterministic --with-ccache --enable-gczeal --enable-debug-symbols --disable-tests

python -u ~/fuzzing/js/compileShell.py -b "--enable-debug --enable-more-deterministic --enable-nspr-build" -r dd32e3ff3717

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   https://hg.mozilla.org/mozilla-central/rev/e0d7904d5d21
user:        Hannes Verschore
date:        Thu Apr 09 09:45:09 2015 +0200
summary:     Bug 1138881: IonMonkey - Part 4: Fold redudant OR compare away, r=bhackett

Hannes, is bug 1138881 a likely regressor?
Flags: needinfo?(hv1989)
Yes it is
Assignee: nobody → hv1989
Flags: needinfo?(hv1989)
Attached patch PatchSplinter Review
The previous change was faulty. It removed the original true/false branch even if it had some information in it. So instead of removing the block, I'm now re-pointing the block to the right target. This fixes it.
Attachment #8590826 - Flags: review?(bhackett1024)
Comment on attachment 8590826 [details] [diff] [review]
Patch

Review of attachment 8590826 [details] [diff] [review]:
-----------------------------------------------------------------

::: js/src/jit/IonAnalysis.cpp
@@ +205,5 @@
> +// Change block so that it ends in a goto to the specific target block.
> +// existingPred is an existing predecessor of the block.
> +static void
> +UpdateGotoSuccessor(TempAllocator& alloc, MBasicBlock* block, MBasicBlock* target,
> +                     MBasicBlock* existingPred)

nit: alignment is off by one char
Attachment #8590826 - Flags: review?(bhackett1024) → review+
https://hg.mozilla.org/mozilla-central/rev/18ead7a1e24d
Status: NEW → RESOLVED
Closed: 5 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla40
AWFY detected a regression/improvement on:
- slave: Mac OS X 10.10 32-bit (Mac Pro, shell)
- mode: Ion

Regression(s)/Improvement(s):
- ss: tagcloud: 2.98% (regression)
- kraken: gaussian-blur: 6.2% (regression)
- misc: bugs-608733-interpreter: 38.14% (regression)
- misc: bugs-1131099-lodash1: -2.12% (improvement)
- misc: bugs-1131099-lodash2: -1.91% (improvement)
- octane: Richards: -1.58% (regression)
- shumway: crypto: 5.8% (improvement)

Recorded range:
- http://hg.mozilla.org/integration/mozilla-inbound/pushloghtml?fromchange=e7611fa81b82&tochange=78f3288d0344

More details: http://arewefastyet.com/regressions/#/regression/364183
(In reply to Hannes Verschore [:h4writer] from comment #6)
> Regression(s)/Improvement(s):
> - ss: tagcloud: 2.98% (regression)
> - misc: bugs-608733-interpreter: 38.14% (regression)

So these are the only real regressions. (The others bring back performance to what it was before the fault part 4 in bug 1138881
You need to log in before you can comment on or make changes to this bug.