1453867 - Differential Testing: Different output message involving --no-array-proto-values

Status: RESOLVED INVALID

(Core :: JavaScript Engine: JIT, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

print([]["values"]);

$ ./js-dbg-64-dm-linux-da809ecceaf3 --fuzzing-safe --no-threads --no-baseline --no-ion --no-array-proto-values testcase.js
undefined
$ 

$ ./js-dbg-64-dm-linux-da809ecceaf3 --fuzzing-safe --no-threads --ion-eager testcase.js
function values() {
    [native code]
}

Tested this on m-c rev da809ecceaf3.

My configure flags are:

AR=ar sh ./configure --enable-debug --enable-more-deterministic --with-ccache --enable-gczeal --enable-debug-symbols --disable-tests

python -u -m funfuzz.js.compile_shell -b "--enable-debug --enable-more-deterministic" -r da809ecceaf3

This seem to point to https://hg.mozilla.org/mozilla-central/rev/e1ca344ca6b5 and hence bug 1420101, so setting needinfo? from :evilpie.

This blocks testing with --no-array-proto-values.

Comment 1

[Jeff Walden [:Waldo]]

Um, isn't that the entire *point* of the command line flag?  If you pass it, Array.prototype.values doesn't exist.  If you don't pass it, it does.  Maybe the fuzzers need to learn about this behavior or something, but this looks like it's behaving exactly as designed.

Comment 2

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

2 options:

(1) We stop testing --no-array-proto-values with compare_jit
(2) We standardise the output in deterministic builds.

I guess the first is preferred?

Comment 3

[Jeff Walden [:Waldo]]

Yeah, I think so.  It seems like differential testing really wants to depend upon one commonly-agreed view of the world.  That seems to be having an Array.prototype.values around.

Particularly in this case, there are four lines of very simple code that control this behavior.  I am entirely unworried about those four lines having bugs; they couldn't have been written any more simply or clearly.

Comment 4

[Tom S [:evilpie]]

Yeah go with (1). I will remove this flag after we ship Array.prototype.values for a period of time in Firefox 60.

Comment 5

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

> I will remove this flag after we ship Array.prototype.values for a period of time in Firefox 60.

This update is invaluable, thanks!