825382 - IonMonkey: Differential Testing: Getting different output w/without --ion-eager with byteLength

Status: RESOLVED DUPLICATE of bug 827659

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

g = f = x = new ArrayBuffer
var eval = this
try {
    g.toSource = (function() {
        x.byteLength
    })
    eval()
} catch (e) {}
try {
    x = [, , , , , , , , , , , 0].slice(6)[5]
    print(uneval(this))
} catch (e) {}

shows the following output in js debug and opt shell on m-c changeset 0bb4773db082 without --ion-eager:

...
/snipped for the sake of brevity
...
}, version:function version() {
    [native code]
}, wrap:function wrap() {
    [native code]
}, wrapWithProto:function wrapWithProto() {
    [native code]
}, x:0})

but does not show anything with --ion-eager.

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   109238:a85c0f30cdfa
user:        Jan de Mooij
date:        Thu Oct 04 13:26:16 2012 +0200
summary:     Bug 797185 - Disable DVG stack search when building with --enable-more-deterministic. r=decoder

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

autoBisect shows this is probably related to the following changeset:

The first good revision is:
changeset:   118117:86e85b93cad1
user:        Jan de Mooij
date:        Tue Jan 08 19:13:19 2013 +0100
summary:     Bug 827659 - Ensure |this| is an object when inlining getter/setter calls. r=bhackett

jandem, is this a possible fix?

Comment 2

[Jan de Mooij [:jandem]]

(In reply to Gary Kwong [:gkw] from comment #1)
> jandem, is this a possible fix?

Yes. x.byteLength is a getter. First x is an ArrayBuffer, then x becomes 0. Before the fix for bug 827659, this would throw with --ion-eager because we'd call the getter with a primitive value. With the patch for bug 827659, it correctly results in |undefined| without an exception.

Comment 3

[Lukas Blakk [:lsblakk] use ?needinfo]

Batch edit: Bugs marked status-b2g18: affected after 2/13 branching of v1.0.1 are now also status-b2g18-v1.0.1: affected