827659 - IonMonkey: Differential Testing: Getting different output w/without --ion-eager with byteOffset

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

var y;
function f() {
    y.byteOffset;
}
for (let j = 0; j < 1; ++j) {
    y = new Float32Array();
}
try {
    f();
    y = 0;
    f();
    f();
} catch (e) {
    print(e);
}

shows no output on js opt shell on m-c changeset 795632f0e4fe without any CLI arguments but shows the following output with --ion-eager:

TypeError: anonymous method called on incompatible number

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Nicolas says in-person that this is likely a security-sensitive bug because it is a type inference issue, assuming sec-critical worse-case first.

Comment 2

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Due to skipped revisions, the first bad revision could be any of:
changeset:   106484:0a0ecbc48d9a
parent:      106483:aa575ceb5fee
parent:      97848:1a5d6b1adf31
user:        David Anderson
date:        Thu Jun 28 15:17:18 2012 -0700
summary:     Merge from mozilla-central.

changeset:   106485:0cb6898fc026
user:        David Anderson
date:        Thu Jun 28 15:19:36 2012 -0700
summary:     Fix build.

Comment 3

[Jan de Mooij [:jandem]]

This is bug 798670 again. I don't think it's sec-critical as long as the getters/setters handle this correctly.

Comment 4

[Jan de Mooij [:jandem]]

Attachment: Patch

Don't optimize getter/setter calls if |this| is not definitely an object. The alternative is to add an MGuardObject, but this is simpler and should be fine, I think.

Comment 5

[Jan de Mooij [:jandem]]

Attachment: Patch

Thinking abot this more, guarding is probably better. Typesets in typical DOM loops often include null/undefined.

Comment 6

[Brian Hackett [Laid off!]]

Not s-s, see comment 3 and bug 819610.

Comment 8

[Jan de Mooij [:jandem]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/86e85b93cad1

Comment 9

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/86e85b93cad1

Comment 10

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Testcases have been landed by virtue of being marked in-testsuite+ -> VERIFIED as well.

Comment 11

[Alex Keybl [:akeybl]]

Not s-s, so it's not clear what the user impact is. Please re-nominate if there is significant user impact.

Comment 14

[Lukas Blakk [:lsblakk] use ?needinfo]

Batch edit: Bugs marked status-b2g18: affected after 2/13 branching of v1.0.1 are now also status-b2g18-v1.0.1: affected