Closed Bug 787864 Opened 9 years ago Closed 8 years ago

IonMonkey: Differential Testing: Getting different TypeError messages w/without --no-jm involving toString

Categories

(Core :: JavaScript Engine, defect)

Other Branch
x86_64
macOS
defect
Not set
normal

Tracking

()

RESOLVED FIXED

People

(Reporter: gkw, Unassigned)

References

Details

(Keywords: regression, testcase, Whiteboard: [ion:p2])

x = {}
x.toString = function() {
    this.y._
}
for (var a = 0; a < 99; a++) {
    try {
        x.toString()
    } catch (e) {}
}
try {
    x.toString()
} catch (e) {
    print(e)
}

on 64-bit js debug shell on IonMonkey changeset f9ff9c554d4b without --no-jm shows:

$ ./js testcase.js 
TypeError: this.y is undefined

but with --no-jm shows:

$ ./js --no-jm testcase.js 
TypeError: undefined has no properties
Summary: IonMonkey: Differential Testing: Getting different TypeError messages w/without --no-jm → IonMonkey: Differential Testing: Getting different TypeError messages w/without --no-jm involving toString
(not sure if this is entirely correct)

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   103173:0bc212d0183b
parent:      103059:b457b592f609
parent:      103172:a7fadfbad932
user:        David Anderson
date:        Fri Aug 03 18:58:30 2012 -0700
summary:     Merge from mozilla-central.


This may instead be related to Nicolas' bug 781660, bug 787309 and bug 787848.
Probably fixed by bug 797185.

autoBisect shows this is probably related to the following changeset:

The first good revision is:
changeset:   109238:a85c0f30cdfa
user:        Jan de Mooij
date:        Thu Oct 04 13:26:16 2012 +0200
summary:     Bug 797185 - Disable DVG stack search when building with --enable-more-deterministic. r=decoder
Status: NEW → RESOLVED
Closed: 8 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.