996895 - Differential Testing: Different output message involving filterPar

Status: RESOLVED DUPLICATE of bug 991457

(Core :: JavaScript Engine: JIT, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

x = new Array
x[5] = Array.prototype.forEach.call(0,(function(){}))
Object.defineProperty(x, 2, {
    get: (function() {
        1()
    })
})
try {
    x.filterPar(function() {})
    print("FOO")
} catch (e) {}


$ ./js-opt-64-dm-ts-darwin-265d82091bce --fuzzing-safe --ion-parallel-compile=off 9779.js
FOO

$ ./js-opt-64-dm-ts-darwin-265d82091bce --fuzzing-safe --ion-parallel-compile=off --no-baseline 9779.js

$

(Tested this on 64-bit Mac js opt threadsafe deterministic shell off m-c rev 265d82091bce, and I think it also reproduces on Linux)

My configure flags (Mac) are:

CC="clang -Qunused-arguments" CXX="clang++ -Qunused-arguments" AR=ar sh /Users/skywalker/trees/mozilla-central/js/src/configure --target=x86_64-apple-darwin12.5.0 --enable-optimize --disable-debug --enable-profiling --enable-gczeal --enable-debug-symbols --disable-tests --enable-more-deterministic --with-ccache --enable-threadsafe <other NSPR options>

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   http://hg.mozilla.org/mozilla-central/rev/f0f6a25259c5
user:        Brian Hackett
date:        Thu Nov 07 11:12:15 2013 -0800
summary:     Bug 935324 - Clean up adding of type properties to objects, r=jandem.

Brian, is this related to bug 935324?

Comment 1

[Brian Hackett [Laid off!]]

I can't reproduce this.

Comment 2

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Setting needinfo? from myself to try and see if this still reproduces.

Comment 3

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

This seems fixed as of m-c tip, I ran autoBisect:

autoBisect shows this is probably related to the following changeset:

The first good revision is:
changeset:   http://hg.mozilla.org/mozilla-central/rev/7ac91d7d6269
parent:      178312:9b2c4a85a5e1
user:        Jan de Mooij
date:        Mon Apr 14 15:20:11 2014 +0200
summary:     Bug 991457 - Don't DCE MLoadElement if it needs a hole check. r=h4writer

Jan, is bug 991457 a likely fix?

Comment 4

[Jan de Mooij [:jandem]]

(In reply to Gary Kwong [:gkw] [:nth10sd] from comment #3)
> Jan, is bug 991457 a likely fix?

Yeah, that seems possible. Also, bug 991457 was a simple one-liner so it's unlikely to be hiding the original problem.