1407058 - Differential Testing: Different output message involving Object.defineProperty

Status: RESOLVED FIXED

(Core :: JavaScript Engine: JIT, defect, P2)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

try {
    var \u3056;
} catch (e) {}
(function () {
    "use strict";
    function f() {
        Object.defineProperty(this, "x", ({
            get: \u3056
        }))
        this["x"] = 9;
    }
    for (let c of [, new String]) {
        try {
            new f();
        } catch (e) {
            print(e);
        }
    }
})();


$ ./js-dbg-64-dm-linux-1db601511bf3 --fuzzing-safe --no-threads --baseline-eager --no-ion testcase.js
TypeError: setting getter-only property "x"

$ ./js-dbg-64-dm-linux-1db601511bf3 --fuzzing-safe --no-threads --no-baseline --no-ion testcase.js
TypeError: setting getter-only property "x"
TypeError: setting getter-only property "x"


Tested this on m-c rev 1db601511bf3.

My configure flags are:

AR=ar sh ./configure --enable-debug --enable-more-deterministic --with-ccache --enable-gczeal --enable-debug-symbols --disable-tests

python -u ~/funfuzz/js/compileShell.py -b "--enable-debug --enable-more-deterministic" -r 1db601511bf3

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   https://hg.mozilla.org/mozilla-central/rev/57132aac9262
user:        Jan de Mooij
date:        Tue Sep 26 12:26:50 2017 +0200
summary:     Bug 1153592 part 2 - Remove JSPROP_SHARED; ensure accessor props don't have slots. r=evilpie

Jan, is bug 1153592 a likely regressor?

Comment 1

[Jan de Mooij [:jandem]]

Attachment: Patch

Great find.

I implemented isDataProperty/needSlot as !getter && !setter, but that misses the JSPROP_GETTER|JSPROP_SETTER case with nullptr getter/setter of course :( So this patch fixes that - I factored this out into a static Shape method to avoid duplicating this logic everywhere.

A lot more to clean up in this area but this should do for now.

Comment 2

[Tom S [:evilpie]]

Comment on attachment 8916924 [details] [diff] [review]
Patch

Review of attachment 8916924 [details] [diff] [review]:
-----------------------------------------------------------------

I hope in the future we can just use the attributes for this.

Comment 3

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/mozilla-inbound/rev/0308ff8eba03
Fix isDataProperty to return false for accessors with nullptr getter/setter. r=evilpie

Comment 4

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

https://hg.mozilla.org/mozilla-central/rev/0308ff8eba03