487957 - Many facebook quizzes/surveys fail with jit enabled since upvar part 2 landed

Status: RESOLVED DUPLICATE of bug 488015

(Core :: JavaScript Engine, defect, P1)

Description

[Bill Gianopoulos [:WG9s]]

Many Facebook surveys and quizzes no longer work correctly with JIT content enabled.

The symptom is that you can complete the entire survey or quiz, but when you get tot he page where you should be able to publish the result to your profile, you cannot.  The window that should have the message that will be published is empty and the publish key performs no action.

Using hg bisect I tracked the issue down to this checkin:

The first bad revision is:
changeset:   26992:2cf0bbe3772a
parent:      26955:7d681f116714
user:        Brendan Eich <[e-mail]>
date:        Sun Apr 05 21:17:22 2009 -0700
summary:     upvar2, aka the big one take 2 (452598, r=mrbkap).

Comment 1

[Bill Gianopoulos [:WG9s]]

I should have mentioned (in case the URL in the bug is dependent on if you have
already taken the test or not) that a good testcase for this bug is the "What
does your name mean?" application.

Comment 2

[Bill Gianopoulos [:WG9s]]

Attachment: screenshot showing bug

This is how it displays with current trunk with javascript.options.jit.content;true

Comment 3

[Bill Gianopoulos [:WG9s]]

Attachment: screenshot showing correct rendering

This is how it looks either without upvar part 2 or if javascript.options.jit.content;false

Comment 4

[Brendan Eich [:brendan]]

Any hope of a reduction? Just to be sure, does tracemonkey tip do likewise?

/be

Comment 5

[Bill Gianopoulos [:WG9s]]

(In reply to comment #4)
> Any hope of a reduction? Just to be sure, does tracemonkey tip do likewise?
> 
> /be

I see the same behavior with the latest tracemonkey Linux nightly.
Unfortunately, this looks like it will take some time to come up with a reduced testcase and this is time I am not sure I have right now.

Comment 6

[Brendan Eich [:brendan]]

Any error console traffic peculiar to the bug biting?

/be

Comment 7

[Brendan Eich [:brendan]]

In http://static.ak.fbcdn.net/rsrc.php/z54IQ/lpkg/dxujbe7f/en_US/141/157446/js/2err7kaon1q8s48s.pkg.js at pc offset 24, line number 101, due to clicking on the publish button, I see

$("feedform_user_message") is null

being thrown.

The script is short-ish:

(gdb) call js_Disassemble(cx, script, 0, __stdoutp)
main:
00000:  getthisprop "_isNile"
00003:  and 9 (6)
00006:  getthisprop "_supportsUserMessage"
00009:  ifeq 47 (38)
00012:  bindname "user_message"
00015:  callname "$"
00018:  string "feedform_user_message"
00021:  call 1
00024:  getprop "value"
00027:  setname "user_message"
00030:  pop
00031:  getthisprop "_userMessage"
00034:  getarg 0
00037:  name "user_message"
00040:  setprop "user_message"
00043:  setprop "value"
00046:  pop
00047:  callname "AsyncRequest"
00050:  new 0
00053:  callprop "setURI"
00056:  getthisprop "_uri"
00059:  call 1
00062:  callprop "setData"
00065:  getarg 0
00068:  call 1
00071:  callprop "setContextData"
00074:  string "nectar_isaction"
00077:  true
00078:  call 2
00081:  callprop "setHandler"
00084:  this
00085:  getprop "showConfirmed"
00088:  callprop "bind"
00091:  this
00092:  call 1
00095:  call 1
00098:  callprop "send"
00101:  call 0
00104:  pop
00105:  stop

Null closure:

(gdb) p fp.fun
$8 = (JSFunction *) 0x4ff0a000
(gdb) p/x fp.fun.flags
$9 = 0xc008

Anonymous function, on line 101.

(gdb) p fp.fun.atom
$10 = (JSAtom *) 0x0

Will try to reduce, else breakpoint in the compiler to catch the likely analysis bug as it bites.

/be

Comment 8

[Bill Gianopoulos [:WG9s]]

(In reply to comment #6)
> Any error console traffic peculiar to the bug biting?
> 
> /be

Unfortunately not.

Comment 9

[Brendan Eich [:brendan]]

Definite error console traffic:

Error: $("feedform_user_message") is null
Source File: http://static.ak.fbcdn.net/rsrc.php/z54IQ/lpkg/dxujbe7f/en_US/141/157446/js/2err7kaon1q8s48s.pkg.js
Line: 101

Line 101 is:

return this;};FeedFormBase.prototype._confirm=function(data){if(this._isNile&&this._supportsUserMessage){user_message=$('feedform_user_message').value;this._userMessage.value=data.user_message=user_message;}

The URL is wget'able, and http://jsbeautifier.org/ is your friend (hat tip: mrbkap).

/be

Comment 10

[Bill Gianopoulos [:WG9s]]

(In reply to comment #9)
> Definite error console traffic:
> 
> Error: $("feedform_user_message") is null
> Source File:
> http://static.ak.fbcdn.net/rsrc.php/z54IQ/lpkg/dxujbe7f/en_US/141/157446/js/2err7kaon1q8s48s.pkg.js
> Line: 101
> 
> Line 101 is:
> 
> return
> this;};FeedFormBase.prototype._confirm=function(data){if(this._isNile&&this._supportsUserMessage){user_message=$('feedform_user_message').value;this._userMessage.value=data.user_message=user_message;}
> 
> The URL is wget'able, and http://jsbeautifier.org/ is your friend (hat tip:
> mrbkap).
> 
> /be

Hmm I don't get that error.  This is one of the issues in trying to debug and reduce facebook things.  Everything takes so many different paths depending on if you have any friends who have already taken this quiz etc.

Comment 11

[Bill Gianopoulos [:WG9s]]

I do get these 2 error messages, but I get them both in the jit true case where it fails and the jit false case where it works:

Error: useProxyFallback is not defined
Source file: http://dino.socialcash.com/xfcomm.js
Line: 1
 ----------
Error: useProxyFallback is not defined
Source file: http://dino.socialcash.com/xfcomm.js
Line: 1

Comment 12

[Kris]

I can confirm this bug. Using trunk build.

Comment 13

[Benjamin Smedberg]

Is this still reproducable today? Several upvar fixes have landed in the past few days.

Comment 14

[Bill Gianopoulos [:WG9s]]

Still reproducible with Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2a1pre) Gecko/20090414 Firefox/3.6a1pre (.NET CLR 3.5.30729) ID:20090414032705 tracemonkey build.

Comment 15

[Brendan Eich [:brendan]]

Fixed by patch for bug 488015. Dup'ing forward.

/be