1308743 - Differential Testing: Different output message involving shortestPaths

Status: RESOLVED INVALID

(Core :: JavaScript Engine: JIT, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

// jsfunfuzz-generated
for (var i = 0; i < 8; i++) {
    "".replace(/x/);
}
// Adapted from randomly chosen test: js/src/jit-test/tests/heap-analysis/bug-1252912.js
print(shortestPaths(this, ["$1"], 2));

$ ./js-dbg-64-dm-clang-darwin-313a2d049350 --fuzzing-safe --no-threads --baseline-eager --no-ion testcase.js
[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

$ ./js-dbg-64-dm-clang-darwin-313a2d049350 --fuzzing-safe --no-threads --no-baseline --no-ion testcase.js
[object Object],[object Object],[object Object],[object Object],[object Object]


Tested this on m-c rev 313a2d049350.

My configure flags are:

CC="clang -Qunused-arguments" CXX="clang++ -Qunused-arguments" AR=ar AUTOCONF=/usr/local/Cellar/autoconf213/2.13/bin/autoconf213 sh /Users/skywalker/trees/mozilla-central/js/src/configure --target=x86_64-apple-darwin14.5.0 --disable-jemalloc --enable-debug --enable-more-deterministic --with-ccache --enable-gczeal --enable-debug-symbols --disable-tests

python -u ~/funfuzz/js/compileShell.py -b "--enable-debug --enable-more-deterministic" -r 313a2d049350

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   https://hg.mozilla.org/mozilla-central/rev/c5e0ea1a1ed2
user:        Tooru Fujisawa
date:        Sat Sep 05 22:01:41 2015 +0900
summary:     Bug 887016 - Part 11: Implement RegExp.prototype[@@replace] and call it from String.prototype.replace. r=h4writer,till

Arai-san, is bug 887016 a likely regressor?

Comment 1

[Tooru Fujisawa [:arai]]

I have no idea what the shortestPaths function is doing, and what the return value means, especially while comparing two different function calls (native vs self-hosted, and also different semantics)

fitzgen, can you have a look?

Comment 2

[Nick Fitzgerald [:fitzgen] [⏰PST; UTC-8]]

The shortestPaths function is listing the shortest GC retaining paths for objects you give it. I expect that this could change drastically depending on what tier we might be in.

I think we should ignore shortestPaths in differential testing.

Comment 3

[Tooru Fujisawa [:arai]]

Thanks :)

gkw, is it okay to make ShortestPaths return undefined or something when --fuzzing-safe ?
or maybe it also breaks differential testing?

Comment 4

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

I have set the ignore in:

https://github.com/MozillaSecurity/funfuzz/commit/33ee96385400ccac636f6ff8e1dd1bb2ce972260

Thus this bug is resolved INVALID. Thanks!