1247871 - Differential Testing: Different output message involving "in "

Status: RESOLVED FIXED

(Core :: JavaScript Engine: JIT, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

try {
    var x = 7;
    var y = x = 4 | y;
    evalcx("'' in x", this);
    print("foo");
} catch (e) {}


$ ./js-dbg-64-dm-clang-darwin-576a6dcde5b6 --fuzzing-safe --no-threads --baseline-eager testcase.js
$ ./js-dbg-64-dm-clang-darwin-576a6dcde5b6 --fuzzing-safe --no-threads --ion-eager testcase.js
foo

Tested this on m-c rev 576a6dcde5b6.

My configure flags are:

CC="clang -Qunused-arguments" CXX="clang++ -Qunused-arguments" AR=ar AUTOCONF=/usr/local/Cellar/autoconf213/2.13/bin/autoconf213 sh /Users/skywalker/trees/mozilla-central/js/src/configure --target=x86_64-apple-darwin14.5.0 --disable-jemalloc --enable-debug --enable-more-deterministic --with-ccache --enable-gczeal --enable-debug-symbols --disable-tests

python -u ~/funfuzz/js/compileShell.py -b "--enable-debug --enable-more-deterministic" -r 576a6dcde5b6

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   https://hg.mozilla.org/mozilla-central/rev/df34cd3d3f88
user:        Jan de Mooij
date:        Mon Feb 08 15:41:42 2016 +0100
summary:     Bug 1244098 - Attempt to fold JSOP_IN to false in IonBuilder based on TI. r=bhackett

Jan, is bug 1244098 a likely regressor?

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

I guess this is more likely to involve "in ".

Comment 2

[Jan de Mooij [:jandem]]

Attachment: Patch

Oops, good catch. I added an optimization to fold |"x" in v|, but we should only do that if |v| is definitely an object.

Comment 3

[Pulsebot]

https://hg.mozilla.org/integration/mozilla-inbound/rev/c932db79d252

Comment 4

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/c932db79d252

Comment 5

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Jan, do you mind nominating this for approval‑mozilla‑esr45 as well? It would aid fuzzing on that branch.

Comment 6

[Jan de Mooij [:jandem]]

(In reply to Gary Kwong [:gkw] [:nth10sd] from comment #5)
> Jan, do you mind nominating this for approval‑mozilla‑esr45 as well? It
> would aid fuzzing on that branch.

The regressing change was in 47.