Closed Bug 1247862 Opened 4 years ago Closed 4 years ago

Differential Testing: Different output message involving TypedObject

Categories

(Core :: JavaScript Engine: JIT, defect, major)

x86_64
All
defect
Not set
major

Tracking

()

RESOLVED FIXED
mozilla47
Tracking Status
firefox47 --- fixed

People

(Reporter: gkw, Assigned: bhackett)

References

(Blocks 2 open bugs)

Details

(Keywords: regression, testcase)

Attachments

(1 file)

print(eval("\
    var T = TypedObject;\
    ValueStruct = new T.StructType({\
        f: T.Any\
    });\
    var v = new ValueStruct;\
    for (var i = 0; i < 2; i++) {\
        v.f = {};\
    }\
"));


$ ./js-dbg-64-dm-clang-darwin-576a6dcde5b6 --fuzzing-safe --no-threads --ion-eager testcase.js
[object InlineOpaqueTypedObject]

$ ./js-dbg-64-dm-clang-darwin-576a6dcde5b6 --fuzzing-safe --no-threads --no-baseline --no-ion testcase.js
[object Object]


Tested this on m-c rev 576a6dcde5b6.

My configure flags are:

CC="clang -Qunused-arguments" CXX="clang++ -Qunused-arguments" AR=ar AUTOCONF=/usr/local/Cellar/autoconf213/2.13/bin/autoconf213 sh /Users/skywalker/trees/mozilla-central/js/src/configure --target=x86_64-apple-darwin14.5.0 --disable-jemalloc --enable-debug --enable-more-deterministic --with-ccache --enable-gczeal --enable-debug-symbols --disable-tests

python -u ~/funfuzz/js/compileShell.py -b "--enable-debug --enable-more-deterministic" -r 576a6dcde5b6

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   https://hg.mozilla.org/mozilla-central/rev/9439c9dbd36e
user:        Brian Hackett
date:        Wed Nov 26 22:45:11 2014 -0700
summary:     Bug 1100173, bug 1102510 - Add baseline caches for typed object scalar element accesses and scalar/reference property accesses, r=jandem.

Jan, is bug 1100173 or bug 1102510 a likely regressor?
Flags: needinfo?(jdemooij)
Flags: needinfo?(jdemooij) → needinfo?(bhackett1024)
Attached patch patchSplinter Review
Baseline SETPROP stubs need to put the rhs into R0 before returning.
Assignee: nobody → bhackett1024
Flags: needinfo?(bhackett1024)
Attachment #8724887 - Flags: review?(jdemooij)
Attachment #8724887 - Flags: review?(jdemooij) → review+
https://hg.mozilla.org/mozilla-central/rev/afcd5f76e452
Status: NEW → RESOLVED
Closed: 4 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla47
Brian, do you mind nominating this for approval‑mozilla‑esr45 as well? It would aid fuzzing on that branch.
Flags: needinfo?(bhackett1024)
(In reply to Gary Kwong [:gkw] [:nth10sd] from comment #6)
> Brian, do you mind nominating this for approval‑mozilla‑esr45 as well? It
> would aid fuzzing on that branch.

Are typed objects enabled on esr45?  I thought they were nightly only.
Flags: needinfo?(bhackett1024)
(In reply to Brian Hackett (:bhackett) from comment #7)
> Are typed objects enabled on esr45?  I thought they were nightly only.

Oh, you're right. Oops.
You need to log in before you can comment on or make changes to this bug.