Closed Bug 1407058 Opened 3 years ago Closed 3 years ago

Differential Testing: Different output message involving Object.defineProperty

Categories

(Core :: JavaScript Engine: JIT, defect, P2, major)

x86_64
All
defect

Tracking

()

RESOLVED FIXED
mozilla58
Tracking Status
firefox58 --- fixed

People

(Reporter: gkw, Assigned: jandem)

References

Details

(Keywords: testcase)

Attachments

(1 file)

try {
    var \u3056;
} catch (e) {}
(function () {
    "use strict";
    function f() {
        Object.defineProperty(this, "x", ({
            get: \u3056
        }))
        this["x"] = 9;
    }
    for (let c of [, new String]) {
        try {
            new f();
        } catch (e) {
            print(e);
        }
    }
})();


$ ./js-dbg-64-dm-linux-1db601511bf3 --fuzzing-safe --no-threads --baseline-eager --no-ion testcase.js
TypeError: setting getter-only property "x"

$ ./js-dbg-64-dm-linux-1db601511bf3 --fuzzing-safe --no-threads --no-baseline --no-ion testcase.js
TypeError: setting getter-only property "x"
TypeError: setting getter-only property "x"


Tested this on m-c rev 1db601511bf3.

My configure flags are:

AR=ar sh ./configure --enable-debug --enable-more-deterministic --with-ccache --enable-gczeal --enable-debug-symbols --disable-tests

python -u ~/funfuzz/js/compileShell.py -b "--enable-debug --enable-more-deterministic" -r 1db601511bf3

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   https://hg.mozilla.org/mozilla-central/rev/57132aac9262
user:        Jan de Mooij
date:        Tue Sep 26 12:26:50 2017 +0200
summary:     Bug 1153592 part 2 - Remove JSPROP_SHARED; ensure accessor props don't have slots. r=evilpie

Jan, is bug 1153592 a likely regressor?
Flags: needinfo?(jdemooij)
Attached patch PatchSplinter Review
Great find.

I implemented isDataProperty/needSlot as !getter && !setter, but that misses the JSPROP_GETTER|JSPROP_SETTER case with nullptr getter/setter of course :( So this patch fixes that - I factored this out into a static Shape method to avoid duplicating this logic everywhere.

A lot more to clean up in this area but this should do for now.
Assignee: nobody → jdemooij
Status: NEW → ASSIGNED
Flags: needinfo?(jdemooij)
Attachment #8916924 - Flags: review?(evilpies)
Comment on attachment 8916924 [details] [diff] [review]
Patch

Review of attachment 8916924 [details] [diff] [review]:
-----------------------------------------------------------------

I hope in the future we can just use the attributes for this.
Attachment #8916924 - Flags: review?(evilpies) → review+
Priority: -- → P2
Pushed by jandemooij@gmail.com:
https://hg.mozilla.org/integration/mozilla-inbound/rev/0308ff8eba03
Fix isDataProperty to return false for accessors with nullptr getter/setter. r=evilpie
https://hg.mozilla.org/mozilla-central/rev/0308ff8eba03
Status: ASSIGNED → RESOLVED
Closed: 3 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla58
You need to log in before you can comment on or make changes to this bug.