1769723 - Differential Testing: Different output message involving --ion-eager

Status: RESOLVED FIXED

(Core :: JavaScript Engine: JIT, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

function f(x) {
    return (+(x || Math.abs(1)) ? 0 : x);
}
f();
f();
f();
f();
f();
f();
f();
f();
f();
f();
f();
print(f("\0"));

stdout: (also happens when you pass it in as a testcase)

$ ./js-dbg-64-linux-x86_64-1254448a9518 --fuzzing-safe --differential-testing --ion-offthread-compile=off --baseline-eager --no-ion
js> function f(x) {
    return (+(x || Math.abs(1)) ? 0 : x);
}
js> f();
0
js> f();
0
js> f();
0
js> f();
0
js> f();
0
js> f();
0
js> f();
0
js> f();
0
js> f();
0
js> f();
0
js> f();
0
js> print(f("\0"));

js> 


$ ./js-dbg-64-linux-x86_64-1254448a9518 --fuzzing-safe --differential-testing --ion-offthread-compile=off --ion-eager
js> function f(x) {
    return (+(x || Math.abs(1)) ? 0 : x);
}
js> f();
0
js> f();
0
js> f();
0
js> f();
0
js> f();
0
js> f();
0
js> f();
0
js> f();
0
js> f();
0
js> f();
0
js> f();
0
js> print(f("\0"));
0
js> 

Note that a "0" is printed after the print statement with --ion-eager.

The first bad revision is:
changeset:   https://hg.mozilla.org/mozilla-central/rev/b3b4b19b2fec
user:        André Bargull
date:        Fri May 06 17:24:14 2022 +0000
summary:     Bug 1767966 - Part 6: Handle boxed values in single-test blocks. r=jandem

Compile with AR=ar sh ./configure --enable-debug --with-ccache --enable-gczeal --enable-debug-symbols --disable-bootstrap --disable-tests, tested on m-c rev 1254448a9518.

Setting s-s to be safe as a start. Andre, is bug 1767966 a likely regressor?

Comment 1

[BugBot [:suhaib / :marco/ :calixte]]

Set release status flags based on info from the regressing bug 1767966

Comment 2

[André Bargull [:anba]]

Attachment: Bug 1769723: Don't remove unbox instructions when folding tests. r=jandem!

Backed out changeset b3b4b19b2fec

Comment 3

[Daniel Veditz [:dveditz]]

From D146954

(Removing the MUnbox instruction doesn't lead to type confusion attacks, because BlockIsSingleTest verified that the MUnbox was only used for a MTest instruction.)

Does that mean this is not a vulnerability?

Comment 4

[Iain Ireland [:iain]]

This is a correctness bug, but not a security bug.

Comment 6

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/mozilla-central/rev/ed94d4236236
Don't remove unbox instructions when folding tests. r=jandem

Comment 7

[Natalia Csoregi [:nataliaCs]]

https://hg.mozilla.org/mozilla-central/rev/ed94d4236236