1556294 - Differential Testing: Different output message involving BigInt64Array

Status: RESOLVED DUPLICATE of bug 1556220

(Core :: JavaScript Engine: JIT, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

for (let x of [0, 0]) {
    try {
        new BigInt64Array()[0] = 1;
    } catch (e) {
        print(e);
    }
}

$ ./js-dbg-64-dm-linux-x86_64-6d71d3ca0124 --fuzzing-safe --no-threads --no-baseline --no-ion testcase.js
TypeError: not a BigInt
TypeError: not a BigInt

$ ./js-dbg-64-dm-linux-x86_64-6d71d3ca0124 --fuzzing-safe --no-threads --baseline-eager --no-ion testcase.js
TypeError: not a BigInt

Tested this on m-c rev 6d71d3ca0124.

My configure flags are:

AR=ar sh ./configure --enable-debug --enable-more-deterministic --with-ccache --enable-gczeal --enable-debug-symbols --disable-tests --disable-cranelift

python3 -u -m funfuzz.js.compile_shell -b "--enable-debug --enable-more-deterministic" -r 6d71d3ca0124

Setting s-s as a start as this involves TypedArrays.

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

autobisectjs shows this is probably related to the following changeset:

The first bad revision is:
changeset: https://hg.mozilla.org/mozilla-central/rev/efc786c70693
user: Robin Templeton
date: Tue Apr 02 17:11:13 2019 +0000
summary: bug 1456569 - Implement BigInt64 and BigUint64Array. r=wingo,jwalden,sfink

Robin, is bug 1456569 a likely regressor?

Comment 2

[Andy Wingo [:wingo]]

Thanks. I was able to repro with a normal --enable-debug --enable-project=js build. It would seem that this error is also related to CacheIR and setting for bigint typed arrays, like bug 1556220. Indeed the fix from bug 1556220 fixes this one, so I added the test case there.