570162 - Comparison with 'this' unexpectedly fails

Status: RESOLVED INCOMPLETE

(Core :: JavaScript Engine, defect)

Description

[Greg Beeley]

User-Agent:       Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.2.3) Gecko/20100401 Firefox/3.6.3
Build Identifier: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.2.3) Gecko/20100401 Firefox/3.6.3

var prevcmp = (this == item[2]);
var str = this?(' ' + this.id + ' ' + this.__WgtrName):'';
if (!prevcmp && this == item[2]) pg_explog.push('wow!');

We used this debugging code to identify this problem.  The environment isn't publicly accessible online, and requires database/ajax stuff, and I have not been able to create a straightforward reproducer (i.e., without requiring the extensive database backend) of the problem.

In the above code, the comparison 'this == item[2]' fails on the first line, but succeeds on the third line after the dummy assignment to 'str' is done.  None of the properties (e.g., __WgtrName or item[2]) have getters attached to them.

This bug was much rarer on our Linux install of Firefox than on our Windows XP install (where I was able to reproduce it 50% of the time).

I understand that you may not be able to track this down without a straightforward bug reproducer, but I thought I should file the bug anyhow "just in case".

The dummy assignment to 'str' was our bug workaround for this.

Additional info:  At entry to the function containing the above lines, a debugging test showed that the comparison succeeded.  The above code behavior was noted while inside two nested loops.  None of the loops modified 'this' or 'item[2]' (but even if so, the aforementioned behavior should not have occurred).

Reproducible: Sometimes

Steps to Reproduce:
(see Details above).
Actual Results:  
"wow!" does occasionally get logged to the logging array pg_explog above.

Expected Results:  
The comparison (this == item[2]) should either succeed on line 1 and 3, or fail on line 1 and 3, but not fail on line 1 and succeed on line 3.

Comment 1

[Greg Beeley]

Additional information:  'this' in the above discussion refers to an IFRAME object.

Comment 2

[Greg Beeley]

Additional info:  the function containing the above code was called using functionobject.call()

Comment 3

[Boris Zbarsky [:bzbarsky]]

Greg, does turning content jit off make the bug disappear?

Comment 4

[Blake Kaplan (:mrbkap) (inactive)]

Greg, can you still reproduce this?

Comment 5

[David Mandelin [:dmandelin]]

No STR => can't fix it. If this is still happening, please give us some more info and we may try to fix for Fx4.