1247863 - Differential Testing: Different output message involving ".takeCensus"

Status: RESOLVED INVALID

(Core :: JavaScript Engine: JIT, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

// Adapted from randomly chosen test: js/src/jit-test/tests/debug/bug-1240090.js
x = eval("\
    g = newGlobal();\
    dbg = Debugger(g);\
    dbg.onNewScript = function() {\
        schedulegc(1);\
    };\
    g.eval(\"function f() {}\");\
    dbg.memory.takeCensus();\
")
print(uneval(x));


$ ./js-dbg-64-dm-clang-darwin-576a6dcde5b6 --fuzzing-safe --no-threads --ion-eager testcase.js
({objects:{Block:{bytes:144, count:3}, Debugger:{bytes:416, count:1}, Environment:{bytes:112, count:1}, FakeDOMObject:{bytes:112, count:1}, Frame:{bytes:96, count:1}, Function:{bytes:40448, count:446}, GlobalDebuggee:{bytes:48, count:1}, Memory:{bytes:112, count:1}, Object:{bytes:1680, count:14}, PerfMeasurement:{bytes:112, count:1}, Script:{bytes:176, count:1}, ScriptSource:{bytes:128, count:2}, Source:{bytes:64, count:1}, StaticEval:{bytes:48, count:1}, StaticFunctionScope:{bytes:96, count:2}, global:{bytes:4256, count:1}, other:{bytes:0, count:0}}, other:{'js::BaseShape':{bytes:1040, count:26}, 'js::ObjectGroup':{bytes:1056, count:22}, 'js::Shape':{bytes:25440, count:504}}, scripts:{bytes:6608, count:8}, strings:{bytes:49976, count:767}})

$ ./js-dbg-64-dm-clang-darwin-576a6dcde5b6 --fuzzing-safe --no-threads --no-baseline --no-ion testcase.js
({objects:{Block:{bytes:144, count:3}, Debugger:{bytes:416, count:1}, Environment:{bytes:112, count:1}, FakeDOMObject:{bytes:112, count:1}, Frame:{bytes:96, count:1}, Function:{bytes:40448, count:446}, GlobalDebuggee:{bytes:48, count:1}, Memory:{bytes:112, count:1}, Object:{bytes:1680, count:14}, PerfMeasurement:{bytes:112, count:1}, Script:{bytes:176, count:1}, ScriptSource:{bytes:128, count:2}, Source:{bytes:64, count:1}, StaticEval:{bytes:48, count:1}, StaticFunctionScope:{bytes:96, count:2}, global:{bytes:4256, count:1}, other:{bytes:0, count:0}}, other:{'js::BaseShape':{bytes:1040, count:26}, 'js::ObjectGroup':{bytes:1056, count:22}, 'js::Shape':{bytes:25152, count:504}}, scripts:{bytes:560, count:3}, strings:{bytes:49976, count:767}})


Tested this on m-c rev 576a6dcde5b6.

My configure flags are:

CC="clang -Qunused-arguments" CXX="clang++ -Qunused-arguments" AR=ar AUTOCONF=/usr/local/Cellar/autoconf213/2.13/bin/autoconf213 sh /Users/skywalker/trees/mozilla-central/js/src/configure --target=x86_64-apple-darwin14.5.0 --disable-jemalloc --enable-debug --enable-more-deterministic --with-ccache --enable-gczeal --enable-debug-symbols --disable-tests

python -u ~/funfuzz/js/compileShell.py -b "--enable-debug --enable-more-deterministic" -r 576a6dcde5b6


Note that the values for 'js::Shape' seem to differ: {bytes:25440, count:504} vs {bytes:25152, count:504}}, as well as 'x.scripts' if we change the line "print(uneval(x));" to "print(uneval(x.scripts));"

Jim, Nick, not sure if there is a real bug here. If this is not an issue with SM, can we ignore this via --fuzzing-safe, --enable-more-deterministic #ifdefs or just ignore this within the fuzzer itself (we will need keywords to be ignored, e.g. ".onNewScript")?

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Or can we just ignore ".takeCensus"?

Comment 2

[Nick Fitzgerald [:fitzgen] [⏰PST; UTC-8]]

(In reply to Gary Kwong [:gkw] [:nth10sd] from comment #1)
> Or can we just ignore ".takeCensus"?

Yes, I think we should.

Comment 3

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Ignored in:

https://github.com/MozillaSecurity/funfuzz/commit/b4f65e80755b33273faaf4631754e0c940d8106c

Hence this bug is resolved INVALID as it is not an issue in SM.