999849 - OdinMonkey: Differential Testing: Different output message involving prototype

Status: RESOLVED DUPLICATE of bug 999790

(Core :: JavaScript Engine: JIT, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

+++ This bug was initially created as a clone of Bug #999790 +++

(function() {
    print(function() {
        "use asm";
        return {}
    }.prototype)
})()

$ ./js-opt-64-dm-ts-darwin-1ab07aa4d004 --fuzzing-safe --ion-parallel-compile=off 3893.js
undefined

$ ./js-opt-64-dm-ts-darwin-1ab07aa4d004 --fuzzing-safe --no-asmjs --ion-eager --ion-parallel-compile=off 3893.js
[object Object]

(Tested this on 64-bit Mac js opt threadsafe deterministic shell off m-c rev 1ab07aa4d004, and I think it also reproduces on Linux)

My configure flags (Mac) are:

CC="clang -Qunused-arguments" CXX="clang++ -Qunused-arguments" AR=ar sh /Users/skywalker/trees/mozilla-central/js/src/configure --target=x86_64-apple-darwin12.5.0 --enable-optimize --disable-debug --enable-profiling --enable-gczeal --enable-debug-symbols --disable-tests --enable-more-deterministic --with-ccache --enable-threadsafe <other NSPR options>

This seems to go back further than http://hg.mozilla.org/mozilla-central/rev/541248fb29e4, but I'm not sure.

Benjamin, is this intended?

Comment 1

[Luke Wagner [:luke]]

Ah, yes, this bug goes back to the beginning: asm.js module function and its exported functions are natives and fun_resolve doesn't lazily resolve .prototype when fun->isBuiltin().  Shouldn't be too hard to fix.