1247862 - Differential Testing: Different output message involving TypedObject

Status: RESOLVED FIXED

(Core :: JavaScript Engine: JIT, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

print(eval("\
    var T = TypedObject;\
    ValueStruct = new T.StructType({\
        f: T.Any\
    });\
    var v = new ValueStruct;\
    for (var i = 0; i < 2; i++) {\
        v.f = {};\
    }\
"));


$ ./js-dbg-64-dm-clang-darwin-576a6dcde5b6 --fuzzing-safe --no-threads --ion-eager testcase.js
[object InlineOpaqueTypedObject]

$ ./js-dbg-64-dm-clang-darwin-576a6dcde5b6 --fuzzing-safe --no-threads --no-baseline --no-ion testcase.js
[object Object]


Tested this on m-c rev 576a6dcde5b6.

My configure flags are:

CC="clang -Qunused-arguments" CXX="clang++ -Qunused-arguments" AR=ar AUTOCONF=/usr/local/Cellar/autoconf213/2.13/bin/autoconf213 sh /Users/skywalker/trees/mozilla-central/js/src/configure --target=x86_64-apple-darwin14.5.0 --disable-jemalloc --enable-debug --enable-more-deterministic --with-ccache --enable-gczeal --enable-debug-symbols --disable-tests

python -u ~/funfuzz/js/compileShell.py -b "--enable-debug --enable-more-deterministic" -r 576a6dcde5b6

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   https://hg.mozilla.org/mozilla-central/rev/9439c9dbd36e
user:        Brian Hackett
date:        Wed Nov 26 22:45:11 2014 -0700
summary:     Bug 1100173, bug 1102510 - Add baseline caches for typed object scalar element accesses and scalar/reference property accesses, r=jandem.

Jan, is bug 1100173 or bug 1102510 a likely regressor?

Comment 1

[Brian Hackett [Laid off!]]

Attachment: patch

Baseline SETPROP stubs need to put the rhs into R0 before returning.

Comment 2

[Pulsebot]

https://hg.mozilla.org/integration/mozilla-inbound/rev/afcd5f76e452

Comment 3

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/afcd5f76e452

Comment 4

[Pulsebot]

https://hg.mozilla.org/integration/mozilla-inbound/rev/b1af09a2c2d1

Comment 5

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/b1af09a2c2d1

Comment 6

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Brian, do you mind nominating this for approval‑mozilla‑esr45 as well? It would aid fuzzing on that branch.

Comment 7

[Brian Hackett [Laid off!]]

(In reply to Gary Kwong [:gkw] [:nth10sd] from comment #6)
> Brian, do you mind nominating this for approval‑mozilla‑esr45 as well? It
> would aid fuzzing on that branch.

Are typed objects enabled on esr45?  I thought they were nightly only.

Comment 8

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

(In reply to Brian Hackett (:bhackett) from comment #7)
> Are typed objects enabled on esr45?  I thought they were nightly only.

Oh, you're right. Oops.