850949 - IonMonkey: Differential Testing: Getting different TypeError messages w/without --ion-eager involving Object.defineProperty

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

try {
    (function() {
        var y = Object.defineProperty(y)
    })();
} catch (e) {
    print(e);
}

shows the following error message on js debug shell on mozilla-central changeset c1a5c44ae3d8 without any CLI arguments:

TypeError: y is not an object

but shows the following with --ion-eager:

TypeError: Object.defineProperty(...) is not an object

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   118999:39885ae3a597
user:        Brendan Eich
date:        Tue Jan 15 18:17:50 2013 -0800
summary:     Bug 810525 - unregress DecompileValueGenerator change to handle object literal reference bases (r=jandem).

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Spoke to Brian about this - we could assume that bug 804676 fixed this, it's hard to say, but getting the testcase landed may be a good idea.

autoBisect shows this is probably related to the following changeset:

The first good revision is:
changeset:   129593:ee14945b452c
parent:      128511:d989eab66df4
user:        Brian Hackett
date:        Thu Apr 11 18:39:32 2013 -0600
summary:     Bug 804676 - Remove dependence of Ion compilation on ScriptAnalysis::analyzeTypes.