789300 - IonMonkey: Differential Testing: Getting different output w/without --ion-eager

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

print(NaN ? "" : function() {})

shows the following on 64-bit js opt shell on IonMonkey changeset 93ebcdb7b37b without --ion-eager:

function () {}

but shows nothing (except newlines?) with --ion-eager, when the testcase is passed in as a CLI argument.

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

(I think this might be wrong, but posting nonetheless)

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   105607:6cd206b37176
parent:      104959:b63bb39ed1c0
parent:      105606:a0240c1043ee
user:        David Anderson
date:        Wed Aug 29 17:51:24 2012 -0700
summary:     Merge from mozilla-central.

Comment 2

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

try {
    (function() {
        Object.defineProperty(this, "s0", {
            get: function() {
                Object.defineProperty(this.t1, 7, {
                    value: '' / window
                })
            }
        })
    })()
    {
        a2 = []
    }
    s0 + ''
} catch (e) {}
try {
    t1 = (a2)
    gc()
    s0 + 2
    function window() {}
    b = this.s0;
    print(function(){});
    var window = (""),
        al
} catch (e) {}

Locking this bug s-s because the gc in the middle of this testcase seems essential:

$ ./js testcase.js
function (){}

$ ./js --ion-eager testcase.js


As one can see, there is no output from --ion-eager. Note that "function (){}" shows when the testcase is pasted into the shell both with and without --ion-eager.

Comment 3

[Sean Stangl [:sstangl]]

Attachment: Properly detect NaN truthiness.

Comment 4

[David Anderson [:dvander] - inactive, e-mail if emergency]

Comment on attachment 662309 [details] [diff] [review]
Properly detect NaN truthiness.

Review of attachment 662309 [details] [diff] [review]:
-----------------------------------------------------------------

We can take the security flag off this.

Comment 5

[Sean Stangl [:sstangl]]

http://hg.mozilla.org/integration/mozilla-inbound/rev/7e4a6bba7ce5

Comment 6

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Sean checked that comment 2 is a different bug altogether, spun off as s-s bug 792234.

This bug should only be marked non-s-s when bug 792234 is opened up.

Comment 7

[Graeme McCutcheon [:graememcc]]

https://hg.mozilla.org/mozilla-central/rev/7e4a6bba7ce5