848906 - IonMonkey: Differential Testing: Prototype ignored

Status: RESOLVED WORKSFORME

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following testcase shows different behavior with options --ion-eager vs. no options on ionmonkey revision 8565e1fcdf91 (baseline branch):


var gTestcases;
function TestCase(n, d, e, a) {
  gTestcases = this;
}
function jsTestDriverEnd() {
  gTestcases.dump()
}
TestCase.prototype.dump='PASS';
Date.prototype=new TestCase;
try { evaluate("jsTestDriverEnd();"); } catch(exc) { print(exc); }
try { evaluate("jsTestDriverEnd();"); } catch(exc) { print(exc); }


$ debug64/js test.js
TypeError: undefined is not a function
TypeError: "PASS" is not a function

$ debug64/js --ion-eager test.js
TypeError: undefined is not a function
TypeError: undefined is not a function


This bug only affects builds with --enable-deterministic but I didn't have an m-c build handy with this option, so it could be a general IonMonkey problem.

Comment 1

[Jan de Mooij [:jandem]]

(In reply to Christian Holler (:decoder) from comment #0)
> This bug only affects builds with --enable-deterministic but I didn't have
> an m-c build handy with this option, so it could be a general IonMonkey
> problem.

Yeah, I can reproduce the problem with a mozilla-central --enable-more-deterministic build. Works fine with --baseline-eager.

(For differential testing with baseline you can use "--no-ion --baseline-eager". Or put a JS_NOT_REACHED or something in DecompileValueGenerator, that function seems to cause most differential testing problems with Ion...)

Comment 2

[Iain Ireland [:iain]]

This bug no longer occurs. We have changed the code that emits the "not a function" message. Now the output is:

iain@iain-laptop:~/src/central/js/src/obj-scratch$ dist/bin/js ~/src/foo.js
TypeError: gTestcases.dump is not a function
TypeError: gTestcases.dump is not a function
iain@iain-laptop:~/src/central/js/src/obj-scratch$ dist/bin/js --ion-eager ~/src/foo.js
TypeError: gTestcases.dump is not a function
TypeError: gTestcases.dump is not a function


Note also that the original output is suspicious, even in the case without --ion-eager. There's no good reason that the two invocations of jsTestDriverEnd should throw different errors here. We should get | "PASS" is not a function | both times. Using this slightly modified script, we can see that both the interpreter and ion see the correct value of dump in all cases:

```
var gTestcases;
function TestCase(n, d, e, a) {
  gTestcases = this;
}
function jsTestDriverEnd() {
    print(gTestcases.dump);
    gTestcases.dump();
}
Date.prototype=new TestCase;
try { evaluate("jsTestDriverEnd();"); } catch(exc) { print(exc); }
try { evaluate("jsTestDriverEnd();"); } catch(exc) { print(exc); }
TestCase.prototype.dump='PASS';
try { evaluate("jsTestDriverEnd();"); } catch(exc) { print(exc); }
try { evaluate("jsTestDriverEnd();"); } catch(exc) { print(exc); }
```

The output (with and without --ion-eager) is: 

undefined
TypeError: gTestcases.dump is not a function
undefined
TypeError: gTestcases.dump is not a function
PASS
TypeError: gTestcases.dump is not a function
PASS
TypeError: gTestcases.dump is not a function

Whatever the bug was, it's pretty clearly fixed now. Closing as WORKSFORME.