1206265 - Differential Testing: Different output message involving --unboxed-arrays

Status: RESOLVED FIXED

(Core :: JavaScript Engine: JIT, defect)

Description

[Gary Kwong [:gkw] [:nth10sd]]

x = [
    objectEmulatingUndefined(),
    function() {}
];
x.forEach(function() {});
x.sort(function() {});
print(uneval(this.x));

$ ./js-dbg-64-dm-nsprBuild-darwin-de0e763b5210 --fuzzing-safe --no-threads --ion-eager testcase.js
[{}, (function () {})]

$ ./js-dbg-64-dm-nsprBuild-darwin-de0e763b5210 --fuzzing-safe --no-threads --ion-eager --unboxed-arrays testcase.js
[(function () {}), (function () {})]

Tested this on m-c rev de0e763b5210.

My configure flags are:

CC="clang -Qunused-arguments" CXX="clang++ -Qunused-arguments" AR=ar AUTOCONF=/usr/local/Cellar/autoconf213/2.13/bin/autoconf213 sh /Users/skywalker/trees/mozilla-central/js/src/configure --target=x86_64-apple-darwin12.5.0 --enable-debug --enable-nspr-build --enable-more-deterministic --with-ccache --enable-gczeal --enable-debug-symbols --disable-tests

python -u ~/funfuzz/js/compileShell.py -b "--enable-debug --enable-more-deterministic --enable-nspr-build" -r de0e763b5210

autoBisect is running, but since --unboxed-arrays seem to be involved here, setting needinfo? from Brian.

Comment 1

[Gary Kwong [:gkw] [:nth10sd]]

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   https://hg.mozilla.org/mozilla-central/rev/1410ca139039
user:        Brian Hackett
date:        Tue May 19 07:57:41 2015 -0600
summary:     Bug 1163091 - Handle unboxed arrays in jsarray.cpp fast paths, r=jandem.

Brian, is bug 1163091 a likely regressor?

Comment 2

[Brian Hackett [Laid off!]]

Attachment: patch

Comment 3

[Pulsebot]

https://hg.mozilla.org/integration/mozilla-inbound/rev/71e34d39c5c5

Comment 4

[Phil Ringnalda (:philor)]

https://hg.mozilla.org/mozilla-central/rev/71e34d39c5c5