1204675 - Differential Testing: Different output message involving "==="

Status: RESOLVED FIXED

(Core :: JavaScript Engine: JIT, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

function f(m, x) {
    for (var i = 0; i < 2; ++i) {
        print(m(x[0]));
    }
}
function g() {
    return false;
}
function h(y) {
    return (y === 0);
}
f(g, [objectEmulatingUndefined()]);
f(h, [false]);

$ ./js-dbg-64-dm-nsprBuild-darwin-9ed17db42e3e --fuzzing-safe --no-threads --ion-eager testcase.js
false
false
false
true

$ ./js-dbg-64-dm-nsprBuild-darwin-9ed17db42e3e --fuzzing-safe --no-threads --baseline-eager testcase.js
false
false
false
false

Tested this on m-c rev 9ed17db42e3e.

My configure flags are:

CC="clang -Qunused-arguments" CXX="clang++ -Qunused-arguments" AR=ar AUTOCONF=/usr/local/Cellar/autoconf213/2.13/bin/autoconf213 sh /Users/skywalker/trees/mozilla-central/js/src/configure --target=x86_64-apple-darwin12.5.0 --enable-debug --enable-nspr-build --enable-more-deterministic --with-ccache --enable-gczeal --enable-debug-symbols --disable-tests

python -u ~/funfuzz/js/compileShell.py -b "--enable-debug --enable-more-deterministic --enable-nspr-build" -r 9ed17db42e3e

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   https://hg.mozilla.org/mozilla-central/rev/9eb98b244b6d
user:        Hannes Verschore
date:        Thu Sep 10 14:47:20 2015 +0200
summary:     Bug 1176288 - SharedStubs: Part 2: Fix compare shared stub to work in ionmonkey, r=jandem

Hannes, is bug 1176288 a likely regressor?

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

function f(x, y) {
    return Math.tan((Math.hypot(y, x) || x == 1) === y >> 0, y | 0);
}
for (var j = 0; j < 2; ++j) {
    print(f());
}

$ ./js-dbg-64-dm-nsprBuild-darwin-9ed17db42e3e --fuzzing-safe --no-threads --ion-eager testcase.js
0
1.557407724654902

$ ./js-dbg-64-dm-nsprBuild-darwin-9ed17db42e3e --fuzzing-safe --no-threads --baseline-eager testcase.js
0
0

Here's another testcase that does not involve objectEmulatingUndefined, thus I suspect it involves "===".

Setting [fuzzblocker] because this issue is being hit constantly.

Comment 2

[Hannes Verschore [:h4writer]]

Attachment: Patch

During refactoring forgot to port this check.

Comment 3

[Pulsebot]

https://hg.mozilla.org/integration/mozilla-inbound/rev/ef74a17b0963
https://hg.mozilla.org/integration/mozilla-inbound/rev/ff69597b1ee4

Comment 4

[Phil Ringnalda (:philor)]

https://hg.mozilla.org/mozilla-central/rev/ef74a17b0963
https://hg.mozilla.org/mozilla-central/rev/ff69597b1ee4