Closed Bug 1296243 Opened 4 years ago Closed 3 years ago

Differential Testing: Different output message involving enableShellAllocationMetadataBuilder

Categories

(Core :: JavaScript Engine: JIT, defect, P3, major)

x86_64
All
defect

Tracking

()

RESOLVED INVALID
Tracking Status
firefox49 --- affected
firefox-esr45 --- unaffected
firefox50 --- affected
firefox51 --- affected

People

(Reporter: gkw, Unassigned)

References

(Blocks 2 open bugs)

Details

(Keywords: testcase)

enableShellAllocationMetadataBuilder();
for (var i of [0, 0]) {
    print(getAllocationMetadata([]).index);
}

$ ./js-dbg-64-dm-clang-darwin-97a52326b06a --fuzzing-safe --no-threads --no-baseline --no-ion testcase.js
22
24

$ ./js-dbg-64-dm-clang-darwin-97a52326b06a --fuzzing-safe --no-threads --baseline-eager --no-ion testcase.js
22
25

$ ./js-dbg-64-dm-clang-darwin-97a52326b06a --fuzzing-safe --no-threads --ion-eager testcase.js
22
26

Tested this on m-c rev 97a52326b06a.

My configure flags are:

CC="clang -Qunused-arguments" CXX="clang++ -Qunused-arguments" AR=ar AUTOCONF=/usr/local/Cellar/autoconf213/2.13/bin/autoconf213 sh /Users/skywalker/trees/mozilla-central/js/src/configure --target=x86_64-apple-darwin14.5.0 --disable-jemalloc --enable-debug --enable-more-deterministic --with-ccache --enable-gczeal --enable-debug-symbols --disable-tests

python -u ~/funfuzz/js/compileShell.py -b "--enable-debug --enable-more-deterministic" -r 97a52326b06a

Due to skipped revisions, the first bad revision could be any of:

changeset:   https://hg.mozilla.org/mozilla-central/rev/ad5ff46b72e7
user:        Jim Blandy
date:        Tue Sep 01 15:26:46 2015 -0700
summary:     Bug 1251529: In object metadata world, rename "object metadata" to "allocation metadata" and "callback" to "builder". r=fitzgen

changeset:   https://hg.mozilla.org/mozilla-central/rev/fc76f66bf11f
user:        Jim Blandy
date:        Wed Aug 12 15:17:16 2015 -0700
summary:     Bug 1251529: Replace allocation metadata callback with a builder class. r=fitzgen

Jim, is bug 1251529 a likely regressor?
Flags: needinfo?(jimb)
I don't think this should be considered a regression. That value is sensitive to the total number of JS objects allocated by anything at all, including the JITs. The JITs allocate various objects for internal purposes that are not under our control.
Flags: needinfo?(jimb)
So which function should we ignore for differential testing - enableShellAllocationMetadataBuilder or getAllocationMetadata?
Flags: needinfo?(jimb)
getAllocationMetadata is probably the right thing to ignore.
Flags: needinfo?(jimb)
Gary, can we close this bug now?
Flags: needinfo?(gary)
Priority: -- → P3
> Gary, can we close this bug now?

Yup! I had landed the perma-ignore some time ago:

https://github.com/MozillaSecurity/funfuzz/commit/7e325db5e4319316858710f985a308afa3a1f6d4

-> INVALID (not a bug in the js engine)
Status: NEW → RESOLVED
Closed: 3 years ago
Flags: needinfo?(gary)
Resolution: --- → INVALID
You need to log in before you can comment on or make changes to this bug.