1247877 - Differential Testing: Different output message involving defineSetter

Status: RESOLVED DUPLICATE of bug 1246552

(Core :: JavaScript Engine: JIT, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

__defineSetter__("x", String.prototype.fixed)
toString = function() {
    print("foo")
}
function f(y) {
    x = 0
}
f([])
f(0)
f(0)


$ ./js-dbg-64-dm-clang-darwin-576a6dcde5b6 --fuzzing-safe --no-threads --baseline-eager testcase.js
foo
foo
foo

$ ./js-dbg-64-dm-clang-darwin-576a6dcde5b6 --fuzzing-safe --no-threads --ion-eager testcase.js
foo
foo

Tested this on m-c rev 576a6dcde5b6.

My configure flags are:

CC="clang -Qunused-arguments" CXX="clang++ -Qunused-arguments" AR=ar AUTOCONF=/usr/local/Cellar/autoconf213/2.13/bin/autoconf213 sh /Users/skywalker/trees/mozilla-central/js/src/configure --target=x86_64-apple-darwin14.5.0 --disable-jemalloc --enable-debug --enable-more-deterministic --with-ccache --enable-gczeal --enable-debug-symbols --disable-tests

python -u ~/funfuzz/js/compileShell.py -b "--enable-debug --enable-more-deterministic" -r 576a6dcde5b6

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   https://hg.mozilla.org/mozilla-central/rev/723039c4f514
user:        Jan de Mooij
date:        Fri May 08 21:41:50 2015 +0200
summary:     Bug 1157231 - Optimize calls to own property setters. r=efaust

Jan, is bug 1157231 a likely regressor?

Comment 1

[Jan de Mooij [:jandem]]

Below is a simpler test case, without any getters/setters. This is the same issue as bug 1246552.

var o = {toString: function() {
    print("foo");
}};
function f() {
    String.prototype.fixed.call(o, 0);
}
f();
f();
f();