Closed Bug 1377141 Opened 7 years ago Closed 7 years ago

Differential Testing: Different output message involving schedulegc

Categories

(Core :: JavaScript Engine: JIT, defect)

x86_64
All
defect
Not set
major

Tracking

()

RESOLVED FIXED
mozilla56
Tracking Status
firefox56 --- fixed

People

(Reporter: gkw, Assigned: jonco)

References

Details

(Keywords: testcase)

Attachments

(1 file)

try {
    this.__defineGetter__("x", function () {
            return (0, 0, +(0 > 0))
    });
    g2 = x;
    print(typeof(x));
    schedulegc(x);
} catch (e) {
    print(e);
}

$ ./js-dbg-64-dm-linux-cc903e3f6189 --fuzzing-safe --no-threads --ion-eager testcase.js
number
Error: Bad argument - expecting integer, object or string. Usage: schedulegc([num | obj | string])

$ ./js-dbg-64-dm-linux-cc903e3f6189 --fuzzing-safe --no-threads --no-baseline --no-ion testcase.js
number


Tested this on m-c rev cc903e3f6189.

My configure flags are:

AR=ar sh /home/ubuntu/trees/mozilla-central/js/src/configure --enable-debug --enable-more-deterministic --with-ccache --enable-gczeal --enable-debug-symbols --disable-tests

python -u ~/funfuzz/js/compileShell.py -b "--enable-debug --enable-more-deterministic" -r cc903e3f6189

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   https://hg.mozilla.org/mozilla-central/rev/006e9ea4166e
user:        Jon Coppeard
date:        Tue Jan 10 10:08:16 2017 +0000
summary:     Bug 1311060 - Check for inaccessible zone in shell schedulegc function r=bbouvier

Jon, is bug 1311060 a likely regressor?
Flags: needinfo?(jcoppeard)
schedulegc is complaining because it gets a floating point rather than an integer argument.  The patch makes it accept any number and ignore the fractional part if present.
Assignee: nobody → jcoppeard
Flags: needinfo?(jcoppeard)
Attachment #8883948 - Flags: review?(bbouvier)
Comment on attachment 8883948 [details] [diff] [review]
bug1377141-schedulegc-param

Review of attachment 8883948 [details] [diff] [review]:
-----------------------------------------------------------------

LGTM (maybe needs a min() call). Thanks for the patch!

::: js/src/builtin/TestingFunctions.cpp
@@ +799,2 @@
>          /* Schedule a GC to happen after |arg| allocations. */
> +        JS_ScheduleGC(cx, int(args[0].toNumber()));

Is it ok to have negative parameters here? (e.g. on x86, INT32_MIN will be returned for all the values which are out of range)
Attachment #8883948 - Flags: review?(bbouvier) → review+
(In reply to Benjamin Bouvier [:bbouvier] from comment #2)
Good point.  I'll add a call to min().
Pushed by jcoppeard@mozilla.com:
https://hg.mozilla.org/integration/mozilla-inbound/rev/d6da227491c4
Fix schedulegc parameter check r=bbouvier
https://hg.mozilla.org/mozilla-central/rev/d6da227491c4
Status: NEW → RESOLVED
Closed: 7 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla56
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Created:
Updated:
Size: