1304640 - Differential Testing: Different output message involving RegExp

Status: RESOLVED FIXED

(Core :: JavaScript Engine: JIT, defect, P1)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

function f() {
    return /x/;
}
function g() {
    return (f() == f());
}
for (var i = 0; i < 2; ++i) {
    print(g());
}

$ ./js-dbg-64-dm-clang-darwin-560b2c805bf7 --fuzzing-safe --no-threads --no-baseline --no-ion testcase.js
false
false

$ ./js-dbg-64-dm-clang-darwin-560b2c805bf7 --fuzzing-safe --no-threads --ion-eager testcase.js
false
true

Tested this on m-c rev 560b2c805bf7.

My configure flags are:

CC="clang -Qunused-arguments" CXX="clang++ -Qunused-arguments" AR=ar AUTOCONF=/usr/local/Cellar/autoconf213/2.13/bin/autoconf213 sh /Users/skywalker/trees/mozilla-central/js/src/configure --target=x86_64-apple-darwin14.5.0 --disable-jemalloc --enable-debug --enable-more-deterministic --with-ccache --enable-gczeal --enable-debug-symbols --disable-tests

python -u ~/funfuzz/js/compileShell.py -b "--enable-debug --enable-more-deterministic" -r 560b2c805bf7

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   https://hg.mozilla.org/mozilla-central/rev/539bcdf33f32
user:        Hannes Verschore
date:        Thu Jun 02 12:21:33 2016 +0200
summary:     Bug 1275038 - IonMonkey: Remove regexp clone analysis in favor of hoist analysis, r=jandem

Hannes, is bug 1275038 a likely regressor?

Comment 1

[Hannes Verschore [:h4writer]]

Attachment: Patch

Comparing "/test/ == /test/" should be false, since we initiate two different objects. Currently we allow them to not clone themself, which makes them the same object, creating a wrong result.

The patch disables cloning when we are comparing objects.

Comment 2

[Tooru Fujisawa [:arai]]

Comment on attachment 8802132 [details] [diff] [review]
Patch

Review of attachment 8802132 [details] [diff] [review]:
-----------------------------------------------------------------

So, now the CanCompareRegExp returns true only for the following case, right?
  * regexp === non_object
  * non_object === regexp
  * regexp !== non_object
  * non_object !== regexp
  * regexp == null
  * null == regexp
  * regexp != null
  * null != regexp
  * regexp == undefined
  * undefined == regexp
  * regexp != undefined
  * undefined != regexp

btw, can you add a testcase that covers comment #0's case?

Comment 3

[Hannes Verschore [:h4writer]]

(In reply to Tooru Fujisawa [:arai] from comment #2)
> Comment on attachment 8802132 [details] [diff] [review]
> Patch
> 
> Review of attachment 8802132 [details] [diff] [review]:
> -----------------------------------------------------------------
> 
> So, now the CanCompareRegExp returns true only for the following case, right?
>   * regexp === non_object
>   * non_object === regexp
>   * regexp !== non_object
>   * non_object !== regexp
>   * regexp == null
>   * null == regexp
>   * regexp != null
>   * null != regexp
>   * regexp == undefined
>   * undefined == regexp
>   * regexp != undefined
>   * undefined != regexp

Yes, that is correct.

Comment 4

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/mozilla-inbound/rev/494b04936295
IonMonkey - Comparing two regexp makes not being cloned observable, r=arai

Comment 5

[Phil Ringnalda (:philor)]

https://hg.mozilla.org/mozilla-central/rev/494b04936295