The following testcase shows different behavior with options --ion-eager vs. no options on ionmonkey revision 8565e1fcdf91 (baseline branch): var gTestcases; function TestCase(n, d, e, a) { gTestcases = this; } function jsTestDriverEnd() { gTestcases.dump() } TestCase.prototype.dump='PASS'; Date.prototype=new TestCase; try { evaluate("jsTestDriverEnd();"); } catch(exc) { print(exc); } try { evaluate("jsTestDriverEnd();"); } catch(exc) { print(exc); } $ debug64/js test.js TypeError: undefined is not a function TypeError: "PASS" is not a function $ debug64/js --ion-eager test.js TypeError: undefined is not a function TypeError: undefined is not a function This bug only affects builds with --enable-deterministic but I didn't have an m-c build handy with this option, so it could be a general IonMonkey problem.

(In reply to Christian Holler (:decoder) from comment #0) > This bug only affects builds with --enable-deterministic but I didn't have > an m-c build handy with this option, so it could be a general IonMonkey > problem. Yeah, I can reproduce the problem with a mozilla-central --enable-more-deterministic build. Works fine with --baseline-eager. (For differential testing with baseline you can use "--no-ion --baseline-eager". Or put a JS_NOT_REACHED or something in DecompileValueGenerator, that function seems to cause most differential testing problems with Ion...)

This bug no longer occurs. We have changed the code that emits the "not a function" message. Now the output is: iain@iain-laptop:~/src/central/js/src/obj-scratch$ dist/bin/js ~/src/foo.js TypeError: gTestcases.dump is not a function TypeError: gTestcases.dump is not a function iain@iain-laptop:~/src/central/js/src/obj-scratch$ dist/bin/js --ion-eager ~/src/foo.js TypeError: gTestcases.dump is not a function TypeError: gTestcases.dump is not a function Note also that the original output is suspicious, even in the case without --ion-eager. There's no good reason that the two invocations of jsTestDriverEnd should throw different errors here. We should get | "PASS" is not a function | both times. Using this slightly modified script, we can see that both the interpreter and ion see the correct value of dump in all cases: ``` var gTestcases; function TestCase(n, d, e, a) { gTestcases = this; } function jsTestDriverEnd() { print(gTestcases.dump); gTestcases.dump(); } Date.prototype=new TestCase; try { evaluate("jsTestDriverEnd();"); } catch(exc) { print(exc); } try { evaluate("jsTestDriverEnd();"); } catch(exc) { print(exc); } TestCase.prototype.dump='PASS'; try { evaluate("jsTestDriverEnd();"); } catch(exc) { print(exc); } try { evaluate("jsTestDriverEnd();"); } catch(exc) { print(exc); } ``` The output (with and without --ion-eager) is: undefined TypeError: gTestcases.dump is not a function undefined TypeError: gTestcases.dump is not a function PASS TypeError: gTestcases.dump is not a function PASS TypeError: gTestcases.dump is not a function Whatever the bug was, it's pretty clearly fixed now. Closing as WORKSFORME.