803332 - IonMonkey: Differential Testing: Getting different output w/without --ion-eager with getPropertyDescriptor and Proxy

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

try {
    x = this
    y = {}
    x.y.getPropertyDescriptor = (function() {
        print()
    })
    w = Proxy.create(y)
    z = Object.create(w)
} catch (e) {}
(function() {
    z.s
})()

shows one newline on js opt shell on mozilla-central changeset cd3270dc35cc without --ion-eager but shows two newlines with --ion-eager.

$ ./js testcase.js

$ ./js --ion-eager testcase.js


$


Due to skipped revisions, the first bad revision could be any of:
changeset:   106741:6cd206b37176
parent:      106740:b63bb39ed1c0
parent:      103644:a0240c1043ee
user:        David Anderson
date:        Wed Aug 29 17:51:24 2012 -0700
summary:     Merge from mozilla-central.

changeset:   106742:7bf95bb09233
parent:      106741:6cd206b37176
parent:      103794:706174d31a02
user:        David Anderson
date:        Wed Aug 29 17:57:37 2012 -0700
summary:     Merge from mozilla-central.

changeset:   106747:003feda8a0b3
parent:      106742:7bf95bb09233
parent:      106746:630296b1c46d
user:        David Anderson
date:        Wed Aug 29 17:58:13 2012 -0700
summary:     Merge.

changeset:   106748:8f2d38db4b56
user:        David Anderson
date:        Wed Aug 29 18:04:42 2012 -0700
summary:     Fix merge bustage.

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

dvander, does the regression window seem plausible?

Comment 2

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

autoBisect shows this is probably related to the following changeset:

The first good revision is:
changeset:   127385:0a4d014de179
user:        Kannan Vijayan
date:        Mon Mar 04 11:24:18 2013 -0500
summary:     Bug 846973 - Change all uses of lookupProperty to be effectless. r=jandem

I just spoke to djvj in-person and he is reasonably certain that bug 846973 did fix this bug.