Differential Testing: Different output message involving --no-array-proto-values

RESOLVED INVALID

Status

()

defect
--
major
RESOLVED INVALID
Last year
Last year

People

(Reporter: gkw, Unassigned)

Tracking

(Blocks 2 bugs, {regression, testcase})

Trunk
x86
All
Points:
---
Dependency tree / graph

Firefox Tracking Flags

(firefox61 affected)

Details

(Whiteboard: [fuzzblocker])

print([]["values"]);

$ ./js-dbg-64-dm-linux-da809ecceaf3 --fuzzing-safe --no-threads --no-baseline --no-ion --no-array-proto-values testcase.js
undefined
$ 

$ ./js-dbg-64-dm-linux-da809ecceaf3 --fuzzing-safe --no-threads --ion-eager testcase.js
function values() {
    [native code]
}

Tested this on m-c rev da809ecceaf3.

My configure flags are:

AR=ar sh ./configure --enable-debug --enable-more-deterministic --with-ccache --enable-gczeal --enable-debug-symbols --disable-tests

python -u -m funfuzz.js.compile_shell -b "--enable-debug --enable-more-deterministic" -r da809ecceaf3

This seem to point to https://hg.mozilla.org/mozilla-central/rev/e1ca344ca6b5 and hence bug 1420101, so setting needinfo? from :evilpie.

This blocks testing with --no-array-proto-values.
Flags: needinfo?(evilpies)
Um, isn't that the entire *point* of the command line flag?  If you pass it, Array.prototype.values doesn't exist.  If you don't pass it, it does.  Maybe the fuzzers need to learn about this behavior or something, but this looks like it's behaving exactly as designed.
2 options:

(1) We stop testing --no-array-proto-values with compare_jit
(2) We standardise the output in deterministic builds.

I guess the first is preferred?
Yeah, I think so.  It seems like differential testing really wants to depend upon one commonly-agreed view of the world.  That seems to be having an Array.prototype.values around.

Particularly in this case, there are four lines of very simple code that control this behavior.  I am entirely unworried about those four lines having bugs; they couldn't have been written any more simply or clearly.
Yeah go with (1). I will remove this flag after we ship Array.prototype.values for a period of time in Firefox 60.
Status: NEW → RESOLVED
Closed: Last year
Flags: needinfo?(evilpies)
Resolution: --- → INVALID
> I will remove this flag after we ship Array.prototype.values for a period of time in Firefox 60.

This update is invaluable, thanks!
You need to log in before you can comment on or make changes to this bug.