Closed
Bug 1153153
Opened 9 years ago
Closed 9 years ago
Differential Testing: Different output message involving "use strict"
Categories
(Core :: JavaScript Engine: JIT, defect)
Tracking
()
RESOLVED
FIXED
mozilla40
Tracking | Status | |
---|---|---|
firefox40 | --- | fixed |
People
(Reporter: gkw, Assigned: h4writer)
References
Details
(Keywords: regression, testcase)
Attachments
(1 file)
3.22 KB,
patch
|
bhackett1024
:
review+
|
Details | Diff | Splinter Review |
function f() {}; try { (function() { "use strict"; function f(x) { (x ? (N = x) : 1) ? x : x } print(f(0)); print(f(1)); })() } catch (e) {} $ ./js-dbg-64-dm-nsprBuild-darwin-dd32e3ff3717 --fuzzing-safe --no-threads --ion-eager testcase.js undefined undefined $ ./js-dbg-64-dm-nsprBuild-darwin-dd32e3ff3717 --fuzzing-safe --no-threads --baseline-eager testcase.js undefined Tested this on m-c rev dd32e3ff3717. My configure flags are: CC="clang -Qunused-arguments" CXX="clang++ -Qunused-arguments" AR=ar AUTOCONF=/usr/local/Cellar/autoconf213/2.13/bin/autoconf213 sh /Users/skywalker/trees/mozilla-central/js/src/configure --target=x86_64-apple-darwin12.5.0 --enable-debug --enable-nspr-build --enable-more-deterministic --with-ccache --enable-gczeal --enable-debug-symbols --disable-tests python -u ~/fuzzing/js/compileShell.py -b "--enable-debug --enable-more-deterministic --enable-nspr-build" -r dd32e3ff3717 autoBisect shows this is probably related to the following changeset: The first bad revision is: changeset: https://hg.mozilla.org/mozilla-central/rev/e0d7904d5d21 user: Hannes Verschore date: Thu Apr 09 09:45:09 2015 +0200 summary: Bug 1138881: IonMonkey - Part 4: Fold redudant OR compare away, r=bhackett Hannes, is bug 1138881 a likely regressor?
Flags: needinfo?(hv1989)
Assignee | ||
Comment 2•9 years ago
|
||
The previous change was faulty. It removed the original true/false branch even if it had some information in it. So instead of removing the block, I'm now re-pointing the block to the right target. This fixes it.
Attachment #8590826 -
Flags: review?(bhackett1024)
Comment 3•9 years ago
|
||
Comment on attachment 8590826 [details] [diff] [review] Patch Review of attachment 8590826 [details] [diff] [review]: ----------------------------------------------------------------- ::: js/src/jit/IonAnalysis.cpp @@ +205,5 @@ > +// Change block so that it ends in a goto to the specific target block. > +// existingPred is an existing predecessor of the block. > +static void > +UpdateGotoSuccessor(TempAllocator& alloc, MBasicBlock* block, MBasicBlock* target, > + MBasicBlock* existingPred) nit: alignment is off by one char
Attachment #8590826 -
Flags: review?(bhackett1024) → review+
Assignee | ||
Comment 4•9 years ago
|
||
https://hg.mozilla.org/integration/mozilla-inbound/rev/18ead7a1e24d
https://hg.mozilla.org/mozilla-central/rev/18ead7a1e24d
Status: NEW → RESOLVED
Closed: 9 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla40
Assignee | ||
Comment 6•9 years ago
|
||
AWFY detected a regression/improvement on: - slave: Mac OS X 10.10 32-bit (Mac Pro, shell) - mode: Ion Regression(s)/Improvement(s): - ss: tagcloud: 2.98% (regression) - kraken: gaussian-blur: 6.2% (regression) - misc: bugs-608733-interpreter: 38.14% (regression) - misc: bugs-1131099-lodash1: -2.12% (improvement) - misc: bugs-1131099-lodash2: -1.91% (improvement) - octane: Richards: -1.58% (regression) - shumway: crypto: 5.8% (improvement) Recorded range: - http://hg.mozilla.org/integration/mozilla-inbound/pushloghtml?fromchange=e7611fa81b82&tochange=78f3288d0344 More details: http://arewefastyet.com/regressions/#/regression/364183
Assignee | ||
Comment 7•9 years ago
|
||
(In reply to Hannes Verschore [:h4writer] from comment #6) > Regression(s)/Improvement(s): > - ss: tagcloud: 2.98% (regression) > - misc: bugs-608733-interpreter: 38.14% (regression) So these are the only real regressions. (The others bring back performance to what it was before the fault part 4 in bug 1138881
You need to log in
before you can comment on or make changes to this bug.
Description
•