1388587 - Differential Testing: Different output message involving every

Status: RESOLVED DUPLICATE of bug 1384737

(Core :: JavaScript Engine: JIT, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

var x = [];
x[0] = Array.prototype.every.call(0, function () {});
for (let i = 0; i < 1; ++i) {
    Array.prototype.every.call(x, (function () {
        print("foo");
    }))
}


$ ./js-dbg-64-dm-linux-a921bfb8a2cf --fuzzing-safe --no-threads --baseline-eager --no-ion testcase.js
foo

$ ./js-dbg-64-dm-linux-a921bfb8a2cf --fuzzing-safe --no-threads --ion-eager testcase.js


Tested this on m-c rev a921bfb8a2cf.

My configure flags are:

AR=ar sh ./configure --enable-debug --enable-more-deterministic --with-ccache --enable-gczeal --enable-debug-symbols --disable-tests

python -u ~/funfuzz/js/compileShell.py -b "--enable-debug --enable-more-deterministic" -r a921bfb8a2cf

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   https://hg.mozilla.org/mozilla-central/rev/08bef58cdb9d
user:        Brian Hackett
date:        Tue Jul 25 17:18:29 2017 -0600
summary:     Bug 1383777 - Support idempotent ICs that access missing properties and object lengths, r=jandem.

Brian/Jan, is bug 1383777 a likely regressor? Also, is there a chance bug 1384042 might affect this?

Comment 1

[Brian Hackett [Laid off!]]

The patch in bug 1384737 fixes this.