787861 - IonMonkey: Differential Testing: Getting different TypeError messages w/without --no-jm involving instanceof

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

x = ArrayBuffer();
function f() {
    1 instanceof x
}
for (var a = 0; a < 99; a++) {
    try {
        f()
    } catch (e) {
        print(e)
    }
}

shows a lot of the following TypeError messages on 64-bit js opt shell on IonMonkey changeset f9ff9c554d4b without any CLI arguments:

TypeError: invalid 'instanceof' operand x

but with --no-jm, it also shows:

TypeError: invalid 'instanceof' operand ({})

after several instances of the first TypeError.

Thanks go out to Nicolas for helping with the reduction of this testcase.


(not sure if autoBisectJs is correct):

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   103173:0bc212d0183b
parent:      103059:b457b592f609
parent:      103172:a7fadfbad932
user:        David Anderson
date:        Fri Aug 03 18:58:30 2012 -0700
summary:     Merge from mozilla-central.

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Probably fixed by bug 797185.

autoBisect shows this is probably related to the following changeset:

The first good revision is:
changeset:   109238:a85c0f30cdfa
user:        Jan de Mooij
date:        Thu Oct 04 13:26:16 2012 +0200
summary:     Bug 797185 - Disable DVG stack search when building with --enable-more-deterministic. r=decoder