Differential Testing: Different output message involving enableShellAllocationMetadataBuilder

RESOLVED INVALID

Status

()

Core
JavaScript Engine: JIT
P3
major
RESOLVED INVALID
2 years ago
2 years ago

People

(Reporter: gkw, Unassigned)

Tracking

(Blocks: 2 bugs, {testcase})

Trunk
x86_64
All
testcase
Points:
---
Dependency tree / graph

Firefox Tracking Flags

(firefox49 affected, firefox-esr45 unaffected, firefox50 affected, firefox51 affected)

Details

(Reporter)

Description

2 years ago
enableShellAllocationMetadataBuilder();
for (var i of [0, 0]) {
    print(getAllocationMetadata([]).index);
}

$ ./js-dbg-64-dm-clang-darwin-97a52326b06a --fuzzing-safe --no-threads --no-baseline --no-ion testcase.js
22
24

$ ./js-dbg-64-dm-clang-darwin-97a52326b06a --fuzzing-safe --no-threads --baseline-eager --no-ion testcase.js
22
25

$ ./js-dbg-64-dm-clang-darwin-97a52326b06a --fuzzing-safe --no-threads --ion-eager testcase.js
22
26

Tested this on m-c rev 97a52326b06a.

My configure flags are:

CC="clang -Qunused-arguments" CXX="clang++ -Qunused-arguments" AR=ar AUTOCONF=/usr/local/Cellar/autoconf213/2.13/bin/autoconf213 sh /Users/skywalker/trees/mozilla-central/js/src/configure --target=x86_64-apple-darwin14.5.0 --disable-jemalloc --enable-debug --enable-more-deterministic --with-ccache --enable-gczeal --enable-debug-symbols --disable-tests

python -u ~/funfuzz/js/compileShell.py -b "--enable-debug --enable-more-deterministic" -r 97a52326b06a

Due to skipped revisions, the first bad revision could be any of:

changeset:   https://hg.mozilla.org/mozilla-central/rev/ad5ff46b72e7
user:        Jim Blandy
date:        Tue Sep 01 15:26:46 2015 -0700
summary:     Bug 1251529: In object metadata world, rename "object metadata" to "allocation metadata" and "callback" to "builder". r=fitzgen

changeset:   https://hg.mozilla.org/mozilla-central/rev/fc76f66bf11f
user:        Jim Blandy
date:        Wed Aug 12 15:17:16 2015 -0700
summary:     Bug 1251529: Replace allocation metadata callback with a builder class. r=fitzgen

Jim, is bug 1251529 a likely regressor?
Flags: needinfo?(jimb)
(Reporter)

Updated

2 years ago
status-firefox49: --- → affected
status-firefox50: --- → affected
(Reporter)

Updated

2 years ago
status-firefox-esr45: --- → unaffected

Comment 1

2 years ago
I don't think this should be considered a regression. That value is sensitive to the total number of JS objects allocated by anything at all, including the JITs. The JITs allocate various objects for internal purposes that are not under our control.
Flags: needinfo?(jimb)
(Reporter)

Comment 2

2 years ago
So which function should we ignore for differential testing - enableShellAllocationMetadataBuilder or getAllocationMetadata?
Flags: needinfo?(jimb)

Comment 3

2 years ago
getAllocationMetadata is probably the right thing to ignore.
Flags: needinfo?(jimb)
Gary, can we close this bug now?
Flags: needinfo?(gary)
Priority: -- → P3
(Reporter)

Comment 5

2 years ago
> Gary, can we close this bug now?

Yup! I had landed the perma-ignore some time ago:

https://github.com/MozillaSecurity/funfuzz/commit/7e325db5e4319316858710f985a308afa3a1f6d4

-> INVALID (not a bug in the js engine)
Status: NEW → RESOLVED
Last Resolved: 2 years ago
Flags: needinfo?(gary)
Resolution: --- → INVALID
You need to log in before you can comment on or make changes to this bug.