Closed Bug 1304641 Opened 3 years ago Closed 3 years ago

Differential Testing: Different output message involving startTraceLogger

Categories

(Core :: JavaScript Engine: JIT, defect, P1, major)

x86_64
All
defect

Tracking

()

RESOLVED FIXED
mozilla52
Tracking Status
firefox52 --- fixed

People

(Reporter: gkw, Assigned: h4writer)

References

(Blocks 2 open bugs)

Details

(Keywords: testcase)

Attachments

(1 file)

try {
    newGlobal().startTraceLogger();
    print("z");
} catch (e) {}

$ ./js-dbg-64-dm-clang-darwin-560b2c805bf7 --fuzzing-safe --no-threads --no-baseline --no-ion testcase.js

$ ./js-dbg-64-dm-clang-darwin-560b2c805bf7 --fuzzing-safe --no-threads --ion-eager testcase.js
z

Tested this on m-c rev 560b2c805bf7.

My configure flags are:

CC="clang -Qunused-arguments" CXX="clang++ -Qunused-arguments" AR=ar AUTOCONF=/usr/local/Cellar/autoconf213/2.13/bin/autoconf213 sh /Users/skywalker/trees/mozilla-central/js/src/configure --target=x86_64-apple-darwin14.5.0 --disable-jemalloc --enable-debug --enable-more-deterministic --with-ccache --enable-gczeal --enable-debug-symbols --disable-tests

python -u ~/funfuzz/js/compileShell.py -b "--enable-debug --enable-more-deterministic" -r 560b2c805bf7

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   https://hg.mozilla.org/mozilla-central/rev/73c94ff300b2
user:        Shu-yu Guo
date:        Wed Dec 09 07:52:58 2015 -0800
summary:     Bug 1071646 - Make functions block-scoped in JS and implement Annex B semantics for compatibility. (r=jorendorff)

Shu-yu, is bug 1071646 a likely regressor?
Flags: needinfo?(shu)
I don't know why my patch would cause this. In TraceLoggerThread::enable, there's a compartment check for interpreter activations but no check for JIT activations. I don't know why that is. Redirecting NI.
Flags: needinfo?(shu) → needinfo?(hv1989)
Flags: needinfo?(hv1989)
Priority: -- → P1
Attached patch PatchSplinter Review
Always check if there is a mismatch in compartment. Not only for the interpreter.
Assignee: nobody → hv1989
Attachment #8802110 - Flags: review?(bbouvier)
Comment on attachment 8802110 [details] [diff] [review]
Patch

Review of attachment 8802110 [details] [diff] [review]:
-----------------------------------------------------------------

Thanks! Can you add the test case please?
Attachment #8802110 - Flags: review?(bbouvier) → review+
Pushed by hv1989@gmail.com:
https://hg.mozilla.org/integration/mozilla-inbound/rev/671e1920ff99
TraceLogger: Also throw compartment mismatch error when running in the jits, r=bbouvier
https://hg.mozilla.org/mozilla-central/rev/671e1920ff99
Status: NEW → RESOLVED
Closed: 3 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla52
You need to log in before you can comment on or make changes to this bug.