Closed Bug 942390 Opened 6 years ago Closed 6 years ago

Differential Testing: Different output message involving __iterator__

Categories

(Core :: JavaScript Engine: JIT, defect, major)

x86
macOS
defect
Not set
major

Tracking

()

RESOLVED FIXED
mozilla28
Tracking Status
firefox28 --- fixed

People

(Reporter: gkw, Assigned: jandem)

References

(Blocks 2 open bugs)

Details

(Keywords: testcase)

Attachments

(1 file)

Object.defineProperty(__proto__, "__iterator__", {
    get: (function() {
        print('FOO')
    })
})
__proto__ = (function(){})
for (var m = 0; m < 7; ++m) {
    for (var a in 6) {}
}

when run with --fuzzing-safe --no-baseline --no-ion --no-ti, shows "FOO" 7 times in stdout, without the flag, shows "FOO" only 1 time.

Tested on a 32-bit js opt threadsafe more-deterministic shell on m-c changeset f7ad046f783f.

My configure flags are:

LD=ld CROSS_COMPILE=1 CXX="clang++ -Qunused-arguments -arch i386" RANLIB=ranlib CC="clang -Qunused-arguments -arch i386" AS=$CC AR=ar STRIP="strip -x -S" HOST_CC="clang -Qunused-arguments" HOST_CXX="clang++ -Qunused-arguments" sh ./configure --target=i386-apple-darwin9.2.0 --enable-macos-target=10.5 --enable-optimize --disable-debug --enable-profiling --enable-gczeal --enable-debug-symbols --enable-methodjit --enable-type-inference --disable-tests --enable-more-deterministic --with-ccache --enable-threadsafe <other NSPR flags>

Jan, any idea what went wrong here?
Flags: needinfo?(jdemooij)
Attached patch PatchSplinter Review
There's an __iterator__ getter on the prototype. If we cache the iterator in the iterator cache, we don't call it. This patch makes us not cache the iterator in this case. It also fixes a typo: obj should be pobj I think.
Assignee: nobody → jdemooij
Status: NEW → ASSIGNED
Attachment #8337691 - Flags: review?(bhackett1024)
Flags: needinfo?(jdemooij)
Attachment #8337691 - Flags: review?(bhackett1024) → review+
https://hg.mozilla.org/mozilla-central/rev/4c360770998d
Status: ASSIGNED → RESOLVED
Closed: 6 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla28
Flags: in-testsuite?
You need to log in before you can comment on or make changes to this bug.