Bug 251668 – Differential Testing: Different output during loop in eval

• Component: JavaScriptCore
• Status: RESOLVED INVALID

[Wonyoung Jung]

Created attachment 464819 [details]
testcase for reproduce

Attached testcase prints different result depending on whether BaselineJIT is enabled/disabled.
I'm not sure this case is a bug. Can you please check it out?

- Tested version: WebKit-7615.1.18.8 (commit hash: b0db89e8f5e9d65a74fac732b3a90dc444ed3a42)
- Steps to reproduce:
  - with JIT: `jsc --validateOptions=true --thresholdForJITSoon=10 --thresholdForJITAfterWarmUp=10 --thresholdForOptimizeAfterWarmUp=100 --thresholdForOptimizeAfterLongWarmUp=100 --thresholdForOptimizeSoon=100 --thresholdForFTLOptimizeAfterWarmUp=1000 --thresholdForFTLOptimizeSoon=1000 --validateBCE=true --forceWeakRandomSeed=true --forcedWeakRandomSeed=1 poc.js`
  - without BaselineJIT: `jsc --validateOptions=true --thresholdForJITSoon=10 --thresholdForJITAfterWarmUp=10 --thresholdForOptimizeAfterWarmUp=100 --thresholdForOptimizeAfterLongWarmUp=100 --thresholdForOptimizeSoon=100 --thresholdForFTLOptimizeAfterWarmUp=1000 --thresholdForFTLOptimizeSoon=1000 --validateBCE=true --forceWeakRandomSeed=true --forcedWeakRandomSeed=1 --useBaselineJIT=false poc.js`

- Actual results:
  - with JIT: 
    - prints "-1" 15 times 
  - without JIT: 
    - prints "-1" 16 times (or )


** changing N in `while (v1 < N) { ...` to 1, produces stdout randomly like:
- with JIT: "-1\n-1\nException: ReferenceError: Can't find variable: v0\nglobal code@" or "-1"
- without BaselineJIT: "-1"

[Radar WebKit Bug Importer]

<rdar://problem/105102438>

[Mark Lam]

There's no bug here.  The test itself has variable behavior.  It spawns a thread that prints more output.  However, that thread is in a race against the main thread that will terminate the process.  Depending on where the main thread terminates the process, the other thread may or may not have gotten in a few more prints.

Hence, the code is behaving correctly.  The test is just bad.