942390 - Differential Testing: Different output message involving __iterator__

Status: RESOLVED FIXED

(Core :: JavaScript Engine: JIT, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Object.defineProperty(__proto__, "__iterator__", {
    get: (function() {
        print('FOO')
    })
})
__proto__ = (function(){})
for (var m = 0; m < 7; ++m) {
    for (var a in 6) {}
}

when run with --fuzzing-safe --no-baseline --no-ion --no-ti, shows "FOO" 7 times in stdout, without the flag, shows "FOO" only 1 time.

Tested on a 32-bit js opt threadsafe more-deterministic shell on m-c changeset f7ad046f783f.

My configure flags are:

LD=ld CROSS_COMPILE=1 CXX="clang++ -Qunused-arguments -arch i386" RANLIB=ranlib CC="clang -Qunused-arguments -arch i386" AS=$CC AR=ar STRIP="strip -x -S" HOST_CC="clang -Qunused-arguments" HOST_CXX="clang++ -Qunused-arguments" sh ./configure --target=i386-apple-darwin9.2.0 --enable-macos-target=10.5 --enable-optimize --disable-debug --enable-profiling --enable-gczeal --enable-debug-symbols --enable-methodjit --enable-type-inference --disable-tests --enable-more-deterministic --with-ccache --enable-threadsafe <other NSPR flags>

Jan, any idea what went wrong here?

Comment 1

[Jan de Mooij [:jandem]]

Attachment: Patch

There's an __iterator__ getter on the prototype. If we cache the iterator in the iterator cache, we don't call it. This patch makes us not cache the iterator in this case. It also fixes a typo: obj should be pobj I think.

Comment 2

[Jan de Mooij [:jandem]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/4c360770998d

Comment 3

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/4c360770998d