787864 - IonMonkey: Differential Testing: Getting different TypeError messages w/without --no-jm involving toString

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

x = {}
x.toString = function() {
    this.y._
}
for (var a = 0; a < 99; a++) {
    try {
        x.toString()
    } catch (e) {}
}
try {
    x.toString()
} catch (e) {
    print(e)
}

on 64-bit js debug shell on IonMonkey changeset f9ff9c554d4b without --no-jm shows:

$ ./js testcase.js 
TypeError: this.y is undefined

but with --no-jm shows:

$ ./js --no-jm testcase.js 
TypeError: undefined has no properties

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

(not sure if this is entirely correct)

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   103173:0bc212d0183b
parent:      103059:b457b592f609
parent:      103172:a7fadfbad932
user:        David Anderson
date:        Fri Aug 03 18:58:30 2012 -0700
summary:     Merge from mozilla-central.


This may instead be related to Nicolas' bug 781660, bug 787309 and bug 787848.

Comment 2

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Probably fixed by bug 797185.

autoBisect shows this is probably related to the following changeset:

The first good revision is:
changeset:   109238:a85c0f30cdfa
user:        Jan de Mooij
date:        Thu Oct 04 13:26:16 2012 +0200
summary:     Bug 797185 - Disable DVG stack search when building with --enable-more-deterministic. r=decoder