798670 - Differential Testing: Getting different output w/without --ion-eager involving __proto__

Status: RESOLVED DUPLICATE of bug 827659

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

function f(x) {
    x["__proto__"]
}
for each(a in [{}, null]) {
    try {
        f(a)
    } catch (e) {
        print(e)
    }
}

on 64-bit js shell on m-c changeset 58f3ccaa02b8, without --ion-eager shows:

TypeError: null has no properties

but with --ion-eager shows:

TypeError: anonymous method called on incompatible null


(not sure if this is correct:)

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   106565:adb60cc7b150
parent:      106564:5d1128ed64af
parent:      99642:9b876829ed32
user:        David Anderson
date:        Wed Jul 18 19:02:32 2012 -0700
summary:     Merge from mozilla-central.

Comment 1

[Jeff Walden [:Waldo]]

The result without --ion-eager is correct: trying to get a property off of |null| shouldn't work.  It looks like in the latter case something's caching the __proto__ getter function (which is a JSNative-backed function) and calling that with |null| as |this|, rather than throwing before it even attempts to find the property at all, let alone call the function.

Comment 2

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

dvander, does the regression window seem plausible?

Moreover, comment 1 seems to indicate that this is an Ion bug.

Comment 3

[David Anderson [:dvander] - inactive, e-mail if emergency]

(In reply to Gary Kwong [:gkw, :nth10sd] from comment #2)
> dvander, does the regression window seem plausible?
> 
> Moreover, comment 1 seems to indicate that this is an Ion bug.

If it's an early Ion bug, there's probably not a terribly useful regression range, since stuff wasn't really stable for a long time.

Comment 5

[Jan de Mooij [:jandem]]

Duping forward, that bug has a patch.