1330234 - Differential Testing: Different output message involving ternary operator

Status: RESOLVED FIXED

(Core :: JavaScript Engine: JIT, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

function f(x, y) {
    return (y ? y : x + x);
}
m = ['x'];
for (var j = 0; j < 2; ++j) {
    for (var k = 0; k < 2; ++k) {
        print(f(m[j], m[k]));
    }
}

$ ./js-dbg-64-dm-clang-darwin-2963cf6be7f8 --fuzzing-safe --no-threads --ion-eager testcase.js
x
xx
x
undefinedundefined

$ ./js-dbg-64-dm-clang-darwin-2963cf6be7f8 --fuzzing-safe --no-threads --baseline-eager --no-ion testcase.js
x
xx
x
NaN

Tested this on m-c rev 2963cf6be7f8.

My configure flags are:

CC="clang -Qunused-arguments" CXX="clang++ -Qunused-arguments" AR=ar AUTOCONF=/usr/local/Cellar/autoconf213/2.13/bin/autoconf213 sh ./configure --target=x86_64-apple-darwin14.5.0 --disable-jemalloc --enable-debug --enable-more-deterministic --with-ccache --enable-gczeal --enable-debug-symbols --disable-tests

python -u ~/funfuzz/js/compileShell.py -b "--enable-debug --enable-more-deterministic" -r 2963cf6be7f8

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   https://hg.mozilla.org/mozilla-central/rev/28ca0dfe8d72
user:        Hannes Verschore
date:        Mon Jan 09 16:12:35 2017 +0100
summary:     Bug 1328826 - IonMonkey: Speculate concatenation on baseline caches, r=jandem

Setting [fuzzblocker] because it is hard to ignore this compareJIT bug due to it seemingly only involving the ternary operator.

Hannes, is bug 1328826 a likely regressor?

Comment 1

[Hannes Verschore [:h4writer]]

I think this should be solved now with the backout of 28ca0dfe8d72. Somehow I couldn't reproduce with the testcase. Not sure why since it seems simple enough.

Comment 2

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Likely fixed by the backout.