827104 - IonMonkey: Differential Testing: is undefined vs. undefined has no properties

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following testcase shows different behavior with no options vs. --no-ti on mozilla-central revision 20d1a5916ef6:


var a = [];
for (var i = 0; i < 1000; i++) {
  a.x = {}
}
a[i][0] = 0;


$ opt64/js test.js
test.js:5:0 TypeError: can't convert undefined to object


$ opt64/js --no-ti test.js
test.js:5:0 TypeError: a[i] is undefined


This is a fuzzblocker because it keeps popping up very frequently.

Comment 1

[Christian Holler (:decoder)]

Seeing the same also for null (foo is null vs. null has no properties).

Comment 2

[Tom S [:evilpie]]

Attachment: fix

I hate this code. We should just get rid of the special error message. This fixes it, but I am not sure if it has bad effects on other stuff.

Comment 3

[Sean Stangl [:sstangl]]

Tom, is this patch up for a review?

Comment 4

[Tom S [:evilpie]]

I think we can take this patch, this should strictly just improve the error reporting.

Comment 5

[Tom S [:evilpie]]

Verified, still passes and fixes the issue.

Comment 6

[Jan de Mooij [:jandem]]

Comment on attachment 698420 [details] [diff] [review]
fix

Review of attachment 698420 [details] [diff] [review]:
-----------------------------------------------------------------

Looks good, but please add a testcase that fails without the patch (and works with the patch + --baseline-eager)

Comment 7

[Tom S [:evilpie]]

This fails with baseline at the moment.

Comment 8

[Tom S [:evilpie]]

Jan, any ideas on how to fix this?

Comment 9

[Jan de Mooij [:jandem]]

(In reply to Tom Schuster [:evilpie] from comment #8)
> Jan, any ideas on how to fix this?

Changing ToObject to ToObjectFromStack in DoSetElemFallback seems to work for me..

Comment 10

[Tom S [:evilpie]]

Attachment: v2

You are right. Failure on my part.

Comment 11

[Phil Ringnalda (:philor)]

https://hg.mozilla.org/mozilla-central/rev/a7e44219367a