826031 - IonMonkey: Differential Testing: Getting different output w/without --ion-eager with .some

Status: RESOLVED DUPLICATE of bug 825379

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

w = this
try {
    [0, 0].some(function() {
        w.eval("function f(){yield}")
    })
    f()
    print("FOO")
} catch (e) {}

on js opt shell on m-c changeset a812ef63de87 without --ion-eager shows:

FOO

but with --ion-eager shows nothing.

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   116356:ab307f02af0c
user:        Jeff Walden
date:        Sat Sep 15 11:19:54 2012 -0700
summary:     Bug 792108 - Implement JSCLASS_EMULATES_UNDEFINED to allow objects of a given class to act like the value |undefined| in certain contexts.  Also add a TI flag for such objects, permitting us to assume that no objects use the flag until one is observed, also speeding up object-is-truthy tests when no falsy object is observed.  r=jandem, r=bz

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Jeff, is the changeset in comment 0 a likely one?

Comment 2

[Jeff Walden [:Waldo]]

Hmm; maybe.  I dunno.  I need to look more.  Also, this reproduces on Linux64 as well, so flipping OS to All.

Here's a slightly-reformatted version that doesn't spew the whole global if you run it.  :-)

var global = this;
try {
    [0, 0].some(function() {
        global.eval("function f() { yield; }");
    });
    f();
    print("FOO");
} catch (e) {}

Comment 3

[Jan de Mooij [:jandem]]

See bug 825379, JSContext::findVersion misbehaving with Ion frames.