Closed Bug 1247871 Opened 5 years ago Closed 5 years ago

Differential Testing: Different output message involving "in "

Categories

(Core :: JavaScript Engine: JIT, defect)

x86_64
All
defect
Not set
major

Tracking

()

RESOLVED FIXED
mozilla47
Tracking Status
firefox45 --- unaffected
firefox46 --- unaffected
firefox47 --- fixed
firefox-esr45 --- unaffected

People

(Reporter: gkw, Assigned: jandem)

References

Details

(Keywords: regression, testcase)

Attachments

(1 file)

try {
    var x = 7;
    var y = x = 4 | y;
    evalcx("'' in x", this);
    print("foo");
} catch (e) {}


$ ./js-dbg-64-dm-clang-darwin-576a6dcde5b6 --fuzzing-safe --no-threads --baseline-eager testcase.js
$ ./js-dbg-64-dm-clang-darwin-576a6dcde5b6 --fuzzing-safe --no-threads --ion-eager testcase.js
foo

Tested this on m-c rev 576a6dcde5b6.

My configure flags are:

CC="clang -Qunused-arguments" CXX="clang++ -Qunused-arguments" AR=ar AUTOCONF=/usr/local/Cellar/autoconf213/2.13/bin/autoconf213 sh /Users/skywalker/trees/mozilla-central/js/src/configure --target=x86_64-apple-darwin14.5.0 --disable-jemalloc --enable-debug --enable-more-deterministic --with-ccache --enable-gczeal --enable-debug-symbols --disable-tests

python -u ~/funfuzz/js/compileShell.py -b "--enable-debug --enable-more-deterministic" -r 576a6dcde5b6

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   https://hg.mozilla.org/mozilla-central/rev/df34cd3d3f88
user:        Jan de Mooij
date:        Mon Feb 08 15:41:42 2016 +0100
summary:     Bug 1244098 - Attempt to fold JSOP_IN to false in IonBuilder based on TI. r=bhackett

Jan, is bug 1244098 a likely regressor?
Flags: needinfo?(jdemooij)
I guess this is more likely to involve "in ".
Summary: Differential Testing: Different output message involving " | " → Differential Testing: Different output message involving "in "
Attached patch PatchSplinter Review
Oops, good catch. I added an optimization to fold |"x" in v|, but we should only do that if |v| is definitely an object.
Assignee: nobody → jdemooij
Status: NEW → ASSIGNED
Flags: needinfo?(jdemooij)
Attachment #8719457 - Flags: review?(hv1989)
Attachment #8719457 - Flags: review?(hv1989) → review+
https://hg.mozilla.org/mozilla-central/rev/c932db79d252
Status: ASSIGNED → RESOLVED
Closed: 5 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla47
Jan, do you mind nominating this for approval‑mozilla‑esr45 as well? It would aid fuzzing on that branch.
Flags: needinfo?(jdemooij)
(In reply to Gary Kwong [:gkw] [:nth10sd] from comment #5)
> Jan, do you mind nominating this for approval‑mozilla‑esr45 as well? It
> would aid fuzzing on that branch.

The regressing change was in 47.
Flags: needinfo?(jdemooij)
You need to log in before you can comment on or make changes to this bug.