Differential Testing: Different output message involving "==="

RESOLVED FIXED in Firefox 43

Status

()

defect
--
major
RESOLVED FIXED
4 years ago
4 years ago

People

(Reporter: gkw, Assigned: h4writer)

Tracking

(Blocks 2 bugs, {regression, testcase})

Trunk
mozilla43
Points:
---
Dependency tree / graph

Firefox Tracking Flags

(firefox43 fixed)

Details

(Whiteboard: [fuzzblocker])

Attachments

(1 attachment)

function f(m, x) {
    for (var i = 0; i < 2; ++i) {
        print(m(x[0]));
    }
}
function g() {
    return false;
}
function h(y) {
    return (y === 0);
}
f(g, [objectEmulatingUndefined()]);
f(h, [false]);

$ ./js-dbg-64-dm-nsprBuild-darwin-9ed17db42e3e --fuzzing-safe --no-threads --ion-eager testcase.js
false
false
false
true

$ ./js-dbg-64-dm-nsprBuild-darwin-9ed17db42e3e --fuzzing-safe --no-threads --baseline-eager testcase.js
false
false
false
false

Tested this on m-c rev 9ed17db42e3e.

My configure flags are:

CC="clang -Qunused-arguments" CXX="clang++ -Qunused-arguments" AR=ar AUTOCONF=/usr/local/Cellar/autoconf213/2.13/bin/autoconf213 sh /Users/skywalker/trees/mozilla-central/js/src/configure --target=x86_64-apple-darwin12.5.0 --enable-debug --enable-nspr-build --enable-more-deterministic --with-ccache --enable-gczeal --enable-debug-symbols --disable-tests

python -u ~/funfuzz/js/compileShell.py -b "--enable-debug --enable-more-deterministic --enable-nspr-build" -r 9ed17db42e3e

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   https://hg.mozilla.org/mozilla-central/rev/9eb98b244b6d
user:        Hannes Verschore
date:        Thu Sep 10 14:47:20 2015 +0200
summary:     Bug 1176288 - SharedStubs: Part 2: Fix compare shared stub to work in ionmonkey, r=jandem

Hannes, is bug 1176288 a likely regressor?
Flags: needinfo?(hv1989)
function f(x, y) {
    return Math.tan((Math.hypot(y, x) || x == 1) === y >> 0, y | 0);
}
for (var j = 0; j < 2; ++j) {
    print(f());
}

$ ./js-dbg-64-dm-nsprBuild-darwin-9ed17db42e3e --fuzzing-safe --no-threads --ion-eager testcase.js
0
1.557407724654902

$ ./js-dbg-64-dm-nsprBuild-darwin-9ed17db42e3e --fuzzing-safe --no-threads --baseline-eager testcase.js
0
0

Here's another testcase that does not involve objectEmulatingUndefined, thus I suspect it involves "===".

Setting [fuzzblocker] because this issue is being hit constantly.
Summary: Differential Testing: Different output message involving objectEmulatingUndefined → Differential Testing: Different output message involving "==="
Whiteboard: [fuzzblocker]
Flags: needinfo?(hv1989)
Posted patch PatchSplinter Review
During refactoring forgot to port this check.
Assignee: nobody → hv1989
Attachment #8661121 - Flags: review?(jdemooij)
Attachment #8661121 - Flags: review?(jdemooij) → review+
https://hg.mozilla.org/mozilla-central/rev/ef74a17b0963
https://hg.mozilla.org/mozilla-central/rev/ff69597b1ee4
Status: NEW → RESOLVED
Closed: 4 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla43
You need to log in before you can comment on or make changes to this bug.