Closed Bug 1317943 Opened 3 years ago Closed 3 years ago

Differential Testing: Different output message involving Object.freeze

Categories

(Core :: JavaScript Engine: JIT, defect, P1, major)

x86_64
All
defect

Tracking

()

RESOLVED FIXED
mozilla53
Tracking Status
firefox-esr45 --- unaffected
firefox50 --- unaffected
firefox51 --- fixed
firefox52 --- fixed
firefox53 --- fixed

People

(Reporter: gkw, Assigned: jandem)

References

(Blocks 2 open bugs)

Details

(Keywords: testcase)

Attachments

(1 file)

x = new String;
x.__proto__ = new Int32Array;
function f(x) {
    "use strict";
    this[1] = new String;
    Object.freeze(this);
    this[1] = [];
}
for (var a in [1, '', 'y']) try {
    new f(a);
} catch (e) {
    print(e);
}


$ ./js-dbg-64-dm-linux-79feeed42933 --fuzzing-safe --no-threads --baseline-eager --no-ion testcase.js
TypeError: 1 is read-only
TypeError: 1 is read-only
TypeError: 1 is read-only

$ ./js-dbg-64-dm-linux-79feeed42933 --fuzzing-safe --no-threads --ion-eager testcase.js
TypeError: 1 is read-only
TypeError: 1 is read-only
TypeError: ({1:(new String(""))}) is read-only

Tested this on m-c rev 79feeed42933.

My configure flags are:

AR=ar sh ./configure --enable-debug --enable-more-deterministic --with-ccache --enable-gczeal --enable-debug-symbols --disable-tests

python -u ~/funfuzz/js/compileShell.py -b "--enable-debug --enable-more-deterministic" -r 79feeed42933

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   https://hg.mozilla.org/mozilla-central/rev/26e6632de510
user:        Leo Gaspard
date:        Thu Aug 25 16:28:31 2016 -0700
summary:     Bug 1283334 - Part 3: Do not sparsify dense arrays when freezing - Ion. r=nbp

Jan, you last fixed bug 1314545 (which might be related), is bug 1283334 a likely regressor?
Flags: needinfo?(jdemooij)
Attached patch PatchSplinter Review
ThrowReadOnlyError needs to pass the index instead of the object.
Assignee: nobody → jdemooij
Status: NEW → ASSIGNED
Flags: needinfo?(jdemooij)
Attachment #8811635 - Flags: review?(nicolas.b.pierron)
Priority: -- → P1
Attachment #8811635 - Flags: review?(nicolas.b.pierron) → review+
Pushed by jandemooij@gmail.com:
https://hg.mozilla.org/integration/mozilla-inbound/rev/948acab03903
Fix ThrowReadOnlyError to pass the index instead of the object to the error reporter. r=nbp
Comment on attachment 8811635 [details] [diff] [review]
Patch

Approval Request Comment
[Feature/regressing bug #]: Bug 1283334.
[User impact if declined]: Confusing error messages.
[Describe test coverage new/current, TreeHerder]: Adds a test that fails without the patch.
[Risks and why]: Low risk, fix is straight-forward.
[String/UUID change made/needed]: None.
Attachment #8811635 - Flags: approval-mozilla-beta?
Attachment #8811635 - Flags: approval-mozilla-aurora?
https://hg.mozilla.org/mozilla-central/rev/948acab03903
Status: ASSIGNED → RESOLVED
Closed: 3 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla53
Comment on attachment 8811635 [details] [diff] [review]
Patch

Fix a javascript issue. Beta51+ and Aurora52+. Should be 51 beta 3.
Attachment #8811635 - Flags: approval-mozilla-beta?
Attachment #8811635 - Flags: approval-mozilla-beta+
Attachment #8811635 - Flags: approval-mozilla-aurora?
Attachment #8811635 - Flags: approval-mozilla-aurora+
You need to log in before you can comment on or make changes to this bug.