Closed Bug 798668 Opened 12 years ago Closed 11 years ago

Differential Testing: Getting different output w/without --ion-eager involving defineProperty

Categories

(Core :: JavaScript Engine, defect)

x86_64
macOS
defect
Not set
critical

Tracking

()

RESOLVED DUPLICATE of bug 827659
Tracking Status
firefox18 --- affected

People

(Reporter: gkw, Unassigned)

References

Details

(Keywords: regression, testcase, Whiteboard: [ion:p1])

w = []
x = this
y = new Map
try {
    (function() {
        Object.defineProperty(this, "m", {
            get: function() {
                x.this
            }
        })
        Object.defineProperty(this, "this", {
            get: function() {}
        })
    })()
    y.set()
    for (v of y) {
        Object.defineProperty(this.w, 7, {
            get: (function() {
                return m
            })
        })()
    }
} catch (e) {}
try {
    (function() {
        x = 0[4]
        Object.defineProperty(this, "z", {
            get: function() {
                toString = (function() {
                    w.concat()
                })
            }
        })
    })()(m)
} catch (e) {}
try {
    z
    print(this)
} catch (e) {}

on 64-bit js shell on m-c changeset 58f3ccaa02b8, without --ion-eager shows no output (presumably a newline), but with --ion-eager shows:

undefined



Due to skipped revisions, the first bad revision could be any of:
changeset:   106581:23a84dbb258f
user:        Alex Crichton
date:        Wed Jul 18 23:55:55 2012 -0700
summary:     Bug 775782 - Instrument pro/epilogue of functions for the SPS profiler in ionmonkey. r=pierron,dvander

changeset:   106582:b82fb4d04f60
parent:      106581:23a84dbb258f
parent:      100107:d78729026fb9
user:        David Anderson
date:        Mon Jul 23 12:37:49 2012 -0700
summary:     Merge from mozilla-central.

changeset:   106583:50e28df7ff8f
parent:      106582:b82fb4d04f60
parent:      100276:5598b8c4f271
user:        David Anderson
date:        Tue Jul 24 16:32:08 2012 -0700
summary:     Merge from mozilla-central.

changeset:   106584:7f0f1fdfa5e2
user:        Nicolas B. Pierron
date:        Tue Jul 24 17:24:08 2012 -0700
summary:     Bug 767349 - Simulate hidden instructions when the target is hidden. r=luke

changeset:   106585:2af804d84437
user:        Nicolas Pierron
date:        Tue Jul 24 17:24:07 2012 -0700
summary:     Bug 767349 - Track bad resume points when snapshots are encoded. r=dvander

changeset:   106586:eef915d5a18f
user:        Nicolas B. Pierron
date:        Tue Jul 24 17:48:47 2012 -0700
summary:     Bug 776748 - Do not invalidate ionScript when JM is invalidated. r=dvander

changeset:   106587:41f66d0e46b3
user:        David Anderson
date:        Wed Jul 25 02:08:41 2012 -0700
summary:     Backed out changeset eef915d5a18f

changeset:   106588:d80fbd8493f1
parent:      106587:41f66d0e46b3
parent:      100401:d03aed049b7b
user:        David Anderson
date:        Wed Jul 25 14:30:08 2012 -0700
summary:     Merge from mozilla-central.

changeset:   106589:81146d7c9f51
user:        Sean Stangl
date:        Wed Jul 25 17:10:20 2012 -0700
summary:     Bug 777570 - visitMathFunctionD() should be isCall(). r=dvander

changeset:   106590:02f44534f7f5
user:        Nicolas B. Pierron
date:        Thu Jul 26 11:17:31 2012 -0700
summary:     Bug 776748 - Do not invalidate ionScript when JM is invalidated. r=dvander

changeset:   106591:31f9c38e4cb9
parent:      106590:02f44534f7f5
parent:      100585:f528e021ceb1
user:        David Anderson
date:        Thu Jul 26 18:19:02 2012 -0700
summary:     Merge from mozilla-central.

changeset:   106592:1274d6819bae
user:        Jan de Mooij
date:        Fri Jul 27 13:08:24 2012 -0700
summary:     Fix hasLazyType assertion (bug 777647, r=dvander).

changeset:   106593:ee40f69169e9
user:        Jan de Mooij
date:        Fri Jul 27 13:12:30 2012 -0700
summary:     Don't go through GetPcScript to monitor AddValue edge cases (bug 776022, r=dvander).

changeset:   106594:ba811ef4de1c
user:        David Anderson
date:        Fri Jul 27 14:57:07 2012 -0700
summary:     Fix typo in recent merge.

changeset:   106595:a21e8bf3531f
user:        David Anderson
date:        Fri Jul 27 16:13:02 2012 -0700
summary:     Include loop entry types when determining OSR types (bug 774644, r=jandem).

changeset:   106596:a9addbf7e526
user:        Jan de Mooij
date:        Tue Jul 24 16:39:17 2012 +0200
summary:     [mq]: heur

changeset:   106597:db83474903a5
user:        David Anderson
date:        Fri Jul 27 17:16:35 2012 -0700
summary:     Backed out changeset a9addbf7e526

changeset:   106598:ae339e63d268
user:        David Anderson
date:        Fri Jul 27 17:17:26 2012 -0700
summary:     Backout due to orange.

changeset:   106599:83c83b185199
user:        Jan de Mooij
date:        Tue Jul 24 16:39:17 2012 +0200
summary:     Implement JSOP_MOD for doubles (bug 716694, r=dvander).

changeset:   106600:7a13838698ed
user:        Shu-yu Guo
date:        Sun Jul 29 11:52:45 2012 -0700
summary:     Refactor |Compile| to be templated and not use fp (bug 773339, r=dvander).

changeset:   106601:75f02a17f7cd
user:        Jan de Mooij
date:        Mon Jul 30 20:37:14 2012 +0200
summary:     Bug 776880 - Fix dropArguments call in CallConstructor to include |this|. r=dvander

changeset:   106602:54f9ee5403f0
user:        Jan de Mooij
date:        Mon Jul 30 20:43:44 2012 +0200
summary:     No bug - Add Compile to js::ion namespace to fix Clang build. r=dvander

changeset:   106603:08187a7ea897
parent:      106602:54f9ee5403f0
parent:      100846:4ca1d7d1d2da
user:        David Anderson
date:        Mon Jul 30 13:15:39 2012 -0700
summary:     Merge from mozilla-central.
Simpler:

var x = this
function m() { x.t; }
Object.defineProperty(this, "t", { get: function() { print("Get t"); } });
try { m(); } catch (e) { print(e); }
x = undefined;
try { m(); } catch (e) { print(e); }
try { m(); } catch (e) { print(e); }

... which actually makes it seem a bit like bug 798670.
Summary: Differential Testing: Getting different output w/without --ion-eager involving defineProperty and concat → Differential Testing: Getting different output w/without --ion-eager involving defineProperty
The first bad revision is:
changeset:   106687:a258b96b94ea
user:        Kannan Vijayan
date:        Wed Aug 15 13:03:10 2012 -0400
summary:     Rolling back patch for bug 782432.  Causes regressions in 32-bit SS.
x = y = String.slice
try {
    print(((function () {
        (x instanceof y)
    }))())
} catch (e) {}

Here's another testcase that when tested on 32-bit js shell on m-c changeset 70337fa2fe62, without --ion-eager shows no output (presumably a newline), but with --ion-eager shows:

undefined
(In reply to Gary Kwong [:gkw, :nth10sd] from comment #3)
> x = y = String.slice
> try {
>     print(((function () {
>         (x instanceof y)
>     }))())
> } catch (e) {}
> 
> Here's another testcase that when tested on 32-bit js shell on m-c changeset
> 70337fa2fe62, without --ion-eager shows no output (presumably a newline),
> but with --ion-eager shows:
> 
> undefined

Filed as Bug 799785: it's a separate issue.
I wasn't able to reproduce this issue with the testcase in comment 0, but with the testcase in comment 1, I was able to bisect that bug 827659 might have fixed this.

autoBisect shows this is probably related to the following changeset:

The first good revision is:
changeset:   118117:86e85b93cad1
user:        Jan de Mooij
date:        Tue Jan 08 19:13:19 2013 +0100
summary:     Bug 827659 - Ensure |this| is an object when inlining getter/setter calls. r=bhackett

jandem, does this seem possible?
Flags: needinfo?(jdemooij)
(In reply to Gary Kwong [:gkw] from comment #5)
> jandem, does this seem possible?

Yes that seems reasonable.
Status: NEW → RESOLVED
Closed: 11 years ago
Flags: needinfo?(jdemooij)
Resolution: --- → DUPLICATE
You need to log in before you can comment on or make changes to this bug.