Closed
Bug 798668
Opened 12 years ago
Closed 12 years ago
Differential Testing: Getting different output w/without --ion-eager involving defineProperty
Categories
(Core :: JavaScript Engine, defect)
Tracking
()
RESOLVED
DUPLICATE
of bug 827659
| Tracking | Status | |
|---|---|---|
| firefox18 | --- | affected |
People
(Reporter: gkw, Unassigned)
References
Details
(Keywords: regression, testcase, Whiteboard: [ion:p1])
w = []
x = this
y = new Map
try {
(function() {
Object.defineProperty(this, "m", {
get: function() {
x.this
}
})
Object.defineProperty(this, "this", {
get: function() {}
})
})()
y.set()
for (v of y) {
Object.defineProperty(this.w, 7, {
get: (function() {
return m
})
})()
}
} catch (e) {}
try {
(function() {
x = 0[4]
Object.defineProperty(this, "z", {
get: function() {
toString = (function() {
w.concat()
})
}
})
})()(m)
} catch (e) {}
try {
z
print(this)
} catch (e) {}
on 64-bit js shell on m-c changeset 58f3ccaa02b8, without --ion-eager shows no output (presumably a newline), but with --ion-eager shows:
undefined
Due to skipped revisions, the first bad revision could be any of:
changeset: 106581:23a84dbb258f
user: Alex Crichton
date: Wed Jul 18 23:55:55 2012 -0700
summary: Bug 775782 - Instrument pro/epilogue of functions for the SPS profiler in ionmonkey. r=pierron,dvander
changeset: 106582:b82fb4d04f60
parent: 106581:23a84dbb258f
parent: 100107:d78729026fb9
user: David Anderson
date: Mon Jul 23 12:37:49 2012 -0700
summary: Merge from mozilla-central.
changeset: 106583:50e28df7ff8f
parent: 106582:b82fb4d04f60
parent: 100276:5598b8c4f271
user: David Anderson
date: Tue Jul 24 16:32:08 2012 -0700
summary: Merge from mozilla-central.
changeset: 106584:7f0f1fdfa5e2
user: Nicolas B. Pierron
date: Tue Jul 24 17:24:08 2012 -0700
summary: Bug 767349 - Simulate hidden instructions when the target is hidden. r=luke
changeset: 106585:2af804d84437
user: Nicolas Pierron
date: Tue Jul 24 17:24:07 2012 -0700
summary: Bug 767349 - Track bad resume points when snapshots are encoded. r=dvander
changeset: 106586:eef915d5a18f
user: Nicolas B. Pierron
date: Tue Jul 24 17:48:47 2012 -0700
summary: Bug 776748 - Do not invalidate ionScript when JM is invalidated. r=dvander
changeset: 106587:41f66d0e46b3
user: David Anderson
date: Wed Jul 25 02:08:41 2012 -0700
summary: Backed out changeset eef915d5a18f
changeset: 106588:d80fbd8493f1
parent: 106587:41f66d0e46b3
parent: 100401:d03aed049b7b
user: David Anderson
date: Wed Jul 25 14:30:08 2012 -0700
summary: Merge from mozilla-central.
changeset: 106589:81146d7c9f51
user: Sean Stangl
date: Wed Jul 25 17:10:20 2012 -0700
summary: Bug 777570 - visitMathFunctionD() should be isCall(). r=dvander
changeset: 106590:02f44534f7f5
user: Nicolas B. Pierron
date: Thu Jul 26 11:17:31 2012 -0700
summary: Bug 776748 - Do not invalidate ionScript when JM is invalidated. r=dvander
changeset: 106591:31f9c38e4cb9
parent: 106590:02f44534f7f5
parent: 100585:f528e021ceb1
user: David Anderson
date: Thu Jul 26 18:19:02 2012 -0700
summary: Merge from mozilla-central.
changeset: 106592:1274d6819bae
user: Jan de Mooij
date: Fri Jul 27 13:08:24 2012 -0700
summary: Fix hasLazyType assertion (bug 777647, r=dvander).
changeset: 106593:ee40f69169e9
user: Jan de Mooij
date: Fri Jul 27 13:12:30 2012 -0700
summary: Don't go through GetPcScript to monitor AddValue edge cases (bug 776022, r=dvander).
changeset: 106594:ba811ef4de1c
user: David Anderson
date: Fri Jul 27 14:57:07 2012 -0700
summary: Fix typo in recent merge.
changeset: 106595:a21e8bf3531f
user: David Anderson
date: Fri Jul 27 16:13:02 2012 -0700
summary: Include loop entry types when determining OSR types (bug 774644, r=jandem).
changeset: 106596:a9addbf7e526
user: Jan de Mooij
date: Tue Jul 24 16:39:17 2012 +0200
summary: [mq]: heur
changeset: 106597:db83474903a5
user: David Anderson
date: Fri Jul 27 17:16:35 2012 -0700
summary: Backed out changeset a9addbf7e526
changeset: 106598:ae339e63d268
user: David Anderson
date: Fri Jul 27 17:17:26 2012 -0700
summary: Backout due to orange.
changeset: 106599:83c83b185199
user: Jan de Mooij
date: Tue Jul 24 16:39:17 2012 +0200
summary: Implement JSOP_MOD for doubles (bug 716694, r=dvander).
changeset: 106600:7a13838698ed
user: Shu-yu Guo
date: Sun Jul 29 11:52:45 2012 -0700
summary: Refactor |Compile| to be templated and not use fp (bug 773339, r=dvander).
changeset: 106601:75f02a17f7cd
user: Jan de Mooij
date: Mon Jul 30 20:37:14 2012 +0200
summary: Bug 776880 - Fix dropArguments call in CallConstructor to include |this|. r=dvander
changeset: 106602:54f9ee5403f0
user: Jan de Mooij
date: Mon Jul 30 20:43:44 2012 +0200
summary: No bug - Add Compile to js::ion namespace to fix Clang build. r=dvander
changeset: 106603:08187a7ea897
parent: 106602:54f9ee5403f0
parent: 100846:4ca1d7d1d2da
user: David Anderson
date: Mon Jul 30 13:15:39 2012 -0700
summary: Merge from mozilla-central.
|
||
Comment 1•12 years ago
|
||
Simpler:
var x = this
function m() { x.t; }
Object.defineProperty(this, "t", { get: function() { print("Get t"); } });
try { m(); } catch (e) { print(e); }
x = undefined;
try { m(); } catch (e) { print(e); }
try { m(); } catch (e) { print(e); }
... which actually makes it seem a bit like bug 798670.
|
|
||
Updated•12 years ago
|
Summary: Differential Testing: Getting different output w/without --ion-eager involving defineProperty and concat → Differential Testing: Getting different output w/without --ion-eager involving defineProperty
|
|
||
Comment 2•12 years ago
|
||
The first bad revision is:
changeset: 106687:a258b96b94ea
user: Kannan Vijayan
date: Wed Aug 15 13:03:10 2012 -0400
summary: Rolling back patch for bug 782432. Causes regressions in 32-bit SS.
|
||
Updated•12 years ago
|
Whiteboard: [ion:p1]
|
|
Reporter | |
Comment 3•12 years ago
|
||
x = y = String.slice
try {
print(((function () {
(x instanceof y)
}))())
} catch (e) {}
Here's another testcase that when tested on 32-bit js shell on m-c changeset 70337fa2fe62, without --ion-eager shows no output (presumably a newline), but with --ion-eager shows:
undefined
|
||
Comment 4•12 years ago
|
||
(In reply to Gary Kwong [:gkw, :nth10sd] from comment #3)
> x = y = String.slice
> try {
> print(((function () {
> (x instanceof y)
> }))())
> } catch (e) {}
>
> Here's another testcase that when tested on 32-bit js shell on m-c changeset
> 70337fa2fe62, without --ion-eager shows no output (presumably a newline),
> but with --ion-eager shows:
>
> undefined
Filed as Bug 799785: it's a separate issue.
|
|
Reporter | |
Comment 5•12 years ago
|
||
I wasn't able to reproduce this issue with the testcase in comment 0, but with the testcase in comment 1, I was able to bisect that bug 827659 might have fixed this.
autoBisect shows this is probably related to the following changeset:
The first good revision is:
changeset: 118117:86e85b93cad1
user: Jan de Mooij
date: Tue Jan 08 19:13:19 2013 +0100
summary: Bug 827659 - Ensure |this| is an object when inlining getter/setter calls. r=bhackett
jandem, does this seem possible?
Flags: needinfo?(jdemooij)
|
||
Comment 6•12 years ago
|
||
(In reply to Gary Kwong [:gkw] from comment #5)
> jandem, does this seem possible?
Yes that seems reasonable.
Status: NEW → RESOLVED
Closed: 12 years ago
Flags: needinfo?(jdemooij)
Resolution: --- → DUPLICATE
You need to log in
before you can comment on or make changes to this bug.
Description
•