Closed Bug 1210596 Opened 5 years ago Closed 5 years ago

Differential Testing: Different output message involving concat

Categories

(Core :: JavaScript Engine: JIT, defect)

defect
Not set
major

Tracking

()

RESOLVED FIXED
mozilla44
Tracking Status
firefox43 --- fixed
firefox44 --- fixed

People

(Reporter: gkw, Assigned: bhackett1024)

References

Details

(Keywords: regression, testcase)

Attachments

(1 file)

Array.prototype.concat.call([], [, []], []).forEach(function() {
    print("foo");
});

$ ./js-dbg-64-dm-darwin-9169f652fe5e --fuzzing-safe --no-threads --ion-eager testcase.js
foo
foo

$ ./js-dbg-64-dm-darwin-9169f652fe5e --fuzzing-safe --no-threads --baseline-eager testcase.js
foo

Tested this on m-c rev 9169f652fe5e.

My configure flags are:

CC="clang -Qunused-arguments" CXX="clang++ -Qunused-arguments" AR=ar AUTOCONF=/usr/local/Cellar/autoconf213/2.13/bin/autoconf213 sh /Users/skywalker/trees/mozilla-central/js/src/configure --target=x86_64-apple-darwin12.5.0 --enable-debug --disable-threadsafe --enable-more-deterministic --with-ccache --enable-gczeal --enable-debug-symbols --disable-tests

python -u ~/funfuzz/js/compileShell.py -b "--enable-debug --enable-more-deterministic" -r 9169f652fe5e

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   https://hg.mozilla.org/mozilla-central/rev/e671afb66591
user:        Brian Hackett
date:        Fri Aug 21 11:49:50 2015 -0600
summary:     Bug 1176451 - Optimize Array.concat when used on different types of boxed vs. unboxed arrays, r=jandem.

Brian, is bug 1176451 a likely regressor?
Flags: needinfo?(bhackett1024)
Attached patch patchSplinter Review
The result array is not getting marked as packed here.
Assignee: nobody → bhackett1024
Flags: needinfo?(bhackett1024)
Attachment #8669081 - Flags: review?(jdemooij)
Comment on attachment 8669081 [details] [diff] [review]
patch

Approval Request Comment
[Feature/regressing bug #]: bug 1176451
[User impact if declined]: potential incorrect behavior
[Describe test coverage new/current, TreeHerder]: testcase
[Risks and why]: low
Attachment #8669081 - Flags: approval-mozilla-aurora?
Attachment #8669081 - Flags: review?(jdemooij) → review+
https://hg.mozilla.org/mozilla-central/rev/1146081cebce
Status: NEW → RESOLVED
Closed: 5 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla44
Comment on attachment 8669081 [details] [diff] [review]
patch

Adds a test, fix for recent regression. Let's uplift this but if it breaks anything else, please think about backing out the regressing patch
Attachment #8669081 - Flags: approval-mozilla-aurora? → approval-mozilla-aurora+
Meanwhile I will be the one giggling in the corner a bit as I imagine the potential incorrect behavior that users may experience. Maybe like, Firefox using the wrong salad fork at a fancy dinner party.
You need to log in before you can comment on or make changes to this bug.