870328 - Result mismatch involving eval

Status: RESOLVED FIXED

Description

[Gary Kwong [:gkw] [:nth10sd]]

Created attachment 747380 [details]
testcase

The attached (not-so-reduced) testcase shows the following output on js debug shell on m-c changeset e19d0885977c (https://ftp.mozilla.org/pub/mozilla.org/firefox/tinderbox-builds/mozilla-central-macosx64-debug/1368021890/jsshell-mac64.zip) with --no-baseline --ion-parallel-compile=on --thread-count=9 -a --ion-eager:

NestTest mismatch resultO: undefined
resultD:
jsfunfuzz stopping due to finding a bug.
w28-reduced.js:52:5 ReferenceError: assignment to undeclared variable x

Note the unexpected mismatch error.

Without some of the flags, it only shows (expected):

w28-reduced.js:52:5 ReferenceError: assignment to undeclared variable x


autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   131118:39ff12be624b
user:        Jan de Mooij
date:        Tue May 07 16:27:14 2013 +0200
summary:     Bug 690446 - Emit *GNAME ops in non-eval strict-mode code. r=bhackett

Comment 1

[Jan de Mooij [:jandem]]

Created attachment 747433 [details] [diff] [review]
Patch

The isSetName check in visitSetPropertyCacheT did not include JSOP_SETGNAME. The patch fixes it to match the check in visitSetPropertyCacheV.

(If isSetName is false, the cache does not check for undeclared vars in strict mode.)

Comment 2

[Jan de Mooij [:jandem]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/197a59a83835

Comment 3

[David Baron :dbaron: 🏴󠁵󠁳󠁣󠁡󠁿 ⌚UTC-8 (if account gets disabled due to email bounces, ask a bugzilla admin to reenable it)]

https://hg.mozilla.org/mozilla-central/rev/197a59a83835