821931 - Differential Testing: Different error message involving --enable-more-deterministic

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

try {
    a = []
} catch (e) {}
try {
    a.length()
} catch (e) {
    print(e)
}

shows the following in js opt shell on m-c changeset edd45de440ba without -a:

TypeError: undefined is not a function

but shows the following with -a:

TypeError: 0 is not a function

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   109238:a85c0f30cdfa
user:        Jan de Mooij
date:        Thu Oct 04 13:26:16 2012 +0200
summary:     Bug 797185 - Disable DVG stack search when building with --enable-more-deterministic. r=decoder

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

This seems to only happen with --enable-more-deterministic.

Comment 2

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

jandem, do you think bug 797185 might be responsible for this?

Comment 3

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Another testcase that does not involve .length:

Object.defineProperty(this, "v", {
    get: function() {
        return this.eval()
    }
})
eval = 7
for each(w in [0, 0, 0]) {
    try {
        v
    } catch (e) {
        print(e)
    }
}

 ./js w1743-cj-in.js
TypeError: undefined is not a function
TypeError: undefined is not a function
TypeError: 7 is not a function

./js --ion-eager w1743-cj-in.js
TypeError: undefined is not a function
TypeError: undefined is not a function
TypeError: undefined is not a function

(it has the same regressing changeset as in comment 0)

This clouds numerous compareJIT bugs with multiple dupes. It will be nice for this to be fixed.

Comment 4

[Jan de Mooij [:jandem]]

(In reply to Gary Kwong [:gkw] from comment #2)
> jandem, do you think bug 797185 might be responsible for this?

That bug makes the decompiler always take a fallback path, to help differential testing, but apparently that's not enough to get consistent error messages...

Does the testcase in comment 3 also require "-a"? Maybe I will have some time to look into this next week, however I'm not sure if this is worth fixing considering our plans to remove JM...

Comment 5

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

> Does the testcase in comment 3 also require "-a"? Maybe I will have some
> time to look into this next week, however I'm not sure if this is worth
> fixing considering our plans to remove JM...

I retested the testcase in comment 0, and to reproduce it you need the "--no-ti -a" flags.

To reproduce the testcase in comment 3, you need only "--ion-eager", and "-a" is not needed.

Comment 6

[Jesse Ruderman]

Here's an updated version of comment 0's testcase.  It still shows a difference between --ion-eager and normal.

function f(){
  var a = []
  try {
      a.length()
  } catch (e) {
      print(e)
  }
}
f();
f();

normal:       TypeError: 0 is not a function
--ion-eager:  TypeError: undefined is not a function

Comment 7

[Jan de Mooij [:jandem]]

It looks like this is caused by the property cache.. Let me check if we can remove the property cache without hurting benchmarks (bug 704356).

Comment 8

[Jan de Mooij [:jandem]]

(In reply to Jan de Mooij [:jandem] from comment #7)
> It looks like this is caused by the property cache.. Let me check if we can
> remove the property cache without hurting benchmarks (bug 704356).

Property cache is gone.