1383591 - Differential Testing: Different output message involving "use strict"

Status: RESOLVED FIXED

(Core :: JavaScript Engine: JIT, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

(function () {
    function f(x) {
        "use strict";
        if (x) {
            Object.seal(this);
        }
        this[0] = 1;
    }
    for (var y of [1, 0, arguments, 1]) {
        try {
            new f(y);
        } catch (e) {
            print(e);
        }
    }
})()

$ ./js-dbg-64-dm-linux-5928d905c0bc --fuzzing-safe --no-threads --baseline-eager --no-ion testcase.js
TypeError: can't define property 0: Object is not extensible
TypeError: can't define property 0: Object is not extensible
TypeError: can't define property 0: Object is not extensible

$ ./js-dbg-64-dm-linux-5928d905c0bc --fuzzing-safe --no-threads --ion-eager testcase.js
TypeError: can't define property 0: Object is not extensible
TypeError: can't define property 0: Object is not extensible

Tested this on m-c rev 5928d905c0bc.

My configure flags are:

AR=ar sh /home/ubuntu/trees/mozilla-central/js/src/configure --enable-debug --enable-more-deterministic --with-ccache --enable-gczeal --enable-debug-symbols --disable-tests

python -u ~/funfuzz/js/compileShell.py -b "--enable-debug --enable-more-deterministic" -r 5928d905c0bc

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   https://hg.mozilla.org/mozilla-central/rev/d2f850fe57e1
user:        Jan de Mooij
date:        Fri Oct 28 12:08:29 2016 +0200
summary:     Bug 1313064 - Fix SETELEM check in SetObjectElementOperation to check for the strict version too. r=anba

Jan, is bug 1313064 a likely regressor?

Setting [fuzzblocker] because this seems related to "use strict" and "use strict" differential testing bugs can usually have different causes.

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Whoops, only meant to ni? Jan for now.

Comment 2

[Jan de Mooij [:jandem]]

Attachment: Patch

The setelem OOL path was using current->mir()->strict() but that doesn't always work for OOL paths of course as current is the last block.

This patch sets |current| to nullptr before we generate OOL code, to prevent this kind of bug from happening in the future.

Comment 3

[Nicolas B. Pierron [:nbp]]

Comment on attachment 8889411 [details] [diff] [review]
Patch

Review of attachment 8889411 [details] [diff] [review]:
-----------------------------------------------------------------

Good catch!

Comment 4

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/mozilla-inbound/rev/2bb6be91be39
Don't use |current| block in OutOfLineStoreElementHole code. r=nbp

Comment 5

[Jan de Mooij [:jandem]]

The actual bug predates bug 1313064, it's a very old one I think.

Comment 6

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

https://hg.mozilla.org/mozilla-central/rev/2bb6be91be39