1296243 - Differential Testing: Different output message involving enableShellAllocationMetadataBuilder

Status: RESOLVED INVALID

(Core :: JavaScript Engine: JIT, defect, P3)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

enableShellAllocationMetadataBuilder();
for (var i of [0, 0]) {
    print(getAllocationMetadata([]).index);
}

$ ./js-dbg-64-dm-clang-darwin-97a52326b06a --fuzzing-safe --no-threads --no-baseline --no-ion testcase.js
22
24

$ ./js-dbg-64-dm-clang-darwin-97a52326b06a --fuzzing-safe --no-threads --baseline-eager --no-ion testcase.js
22
25

$ ./js-dbg-64-dm-clang-darwin-97a52326b06a --fuzzing-safe --no-threads --ion-eager testcase.js
22
26

Tested this on m-c rev 97a52326b06a.

My configure flags are:

CC="clang -Qunused-arguments" CXX="clang++ -Qunused-arguments" AR=ar AUTOCONF=/usr/local/Cellar/autoconf213/2.13/bin/autoconf213 sh /Users/skywalker/trees/mozilla-central/js/src/configure --target=x86_64-apple-darwin14.5.0 --disable-jemalloc --enable-debug --enable-more-deterministic --with-ccache --enable-gczeal --enable-debug-symbols --disable-tests

python -u ~/funfuzz/js/compileShell.py -b "--enable-debug --enable-more-deterministic" -r 97a52326b06a

Due to skipped revisions, the first bad revision could be any of:

changeset:   https://hg.mozilla.org/mozilla-central/rev/ad5ff46b72e7
user:        Jim Blandy
date:        Tue Sep 01 15:26:46 2015 -0700
summary:     Bug 1251529: In object metadata world, rename "object metadata" to "allocation metadata" and "callback" to "builder". r=fitzgen

changeset:   https://hg.mozilla.org/mozilla-central/rev/fc76f66bf11f
user:        Jim Blandy
date:        Wed Aug 12 15:17:16 2015 -0700
summary:     Bug 1251529: Replace allocation metadata callback with a builder class. r=fitzgen

Jim, is bug 1251529 a likely regressor?

Comment 1

[Jim Blandy :jimb]

I don't think this should be considered a regression. That value is sensitive to the total number of JS objects allocated by anything at all, including the JITs. The JITs allocate various objects for internal purposes that are not under our control.

Comment 2

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

So which function should we ignore for differential testing - enableShellAllocationMetadataBuilder or getAllocationMetadata?

Comment 3

[Jim Blandy :jimb]

getAllocationMetadata is probably the right thing to ignore.

Comment 4

[Jon Coppeard (:jonco)]

Gary, can we close this bug now?

Comment 5

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

> Gary, can we close this bug now?

Yup! I had landed the perma-ignore some time ago:

https://github.com/MozillaSecurity/funfuzz/commit/7e325db5e4319316858710f985a308afa3a1f6d4

-> INVALID (not a bug in the js engine)