Differential Testing: Different output message involving length

RESOLVED FIXED in Firefox 57

Status

()

Core
JavaScript Engine: JIT
--
major
RESOLVED FIXED
10 months ago
10 months ago

People

(Reporter: gkw, Assigned: bhackett)

Tracking

(Blocks: 2 bugs, {testcase})

Trunk
mozilla57
x86_64
All
testcase
Points:
---
Dependency tree / graph

Firefox Tracking Flags

(firefox57 fixed)

Details

Attachments

(1 attachment)

(Reporter)

Description

10 months ago
function f(x) {
    for (var i = 0; i < x.length; ++i) {
        print(uneval((function () {})(x[i])));
    }
}
f(Error());
f([[]]);


$ ./js-dbg-64-dm-linux-388d81ed93fa --fuzzing-safe --no-threads --baseline-eager --no-ion testcase.js
(void 0)
$

$ ./js-dbg-64-dm-linux-388d81ed93fa --fuzzing-safe --no-threads --ion-eager testcase.js
$

Tested this on m-c rev 388d81ed93fa.

My configure flags are:

AR=ar sh ./configure --enable-debug --enable-more-deterministic --with-ccache --enable-gczeal --enable-debug-symbols --disable-tests

python -u ~/funfuzz/js/compileShell.py -b "--enable-debug --enable-more-deterministic" -r 388d81ed93fa

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   https://hg.mozilla.org/mozilla-central/rev/08bef58cdb9d
user:        Brian Hackett
summary:     Bug 1383777 - Support idempotent ICs that access missing properties and object lengths, r=jandem.

Brian, is bug 1383777 a likely regressor?
Flags: needinfo?(bhackett1024)
(Reporter)

Comment 1

10 months ago
Brian, re-ping? Also pinging Jan.
Flags: needinfo?(jdemooij)
(Assignee)

Comment 2

10 months ago
Created attachment 8895333 [details] [diff] [review]
patch

Sorry for the delay in getting to this.

When a getprop has only produced undefined or null values in the past, IonBuilder may emit a MGetPropertyCache and replaces its result with that MConstant, with no type barrier.  It then treats the MGetPropertyCache as if it is allowed to produce any value.  Later on we use that result type / type set to determine whether it is allowed to produce int32, undefined, etc. values.  This fix improves the type information on the MGetPropertyCache so that the code determining what values the cache may produce does not get overly permissive.
Assignee: nobody → bhackett1024
Flags: needinfo?(bhackett1024)
Attachment #8895333 - Flags: review?(jdemooij)
(Assignee)

Updated

10 months ago
Duplicate of this bug: 1388587
(Assignee)

Updated

10 months ago
Flags: needinfo?(jdemooij)

Comment 4

10 months ago
Comment on attachment 8895333 [details] [diff] [review]
patch

Review of attachment 8895333 [details] [diff] [review]:
-----------------------------------------------------------------

Sorry for the delay.
Attachment #8895333 - Flags: review?(jdemooij) → review+

Comment 5

10 months ago
Pushed by bhackett@mozilla.com:
https://hg.mozilla.org/integration/mozilla-inbound/rev/41d6cb7fcbcd
Retain result type information for getprop caches that only produce null/undefined values, r=jandem.

Comment 6

10 months ago
bugherder
https://hg.mozilla.org/mozilla-central/rev/41d6cb7fcbcd
Status: NEW → RESOLVED
Last Resolved: 10 months ago
status-firefox57: --- → fixed
Resolution: --- → FIXED
Target Milestone: --- → mozilla57
You need to log in before you can comment on or make changes to this bug.