597816 - http://i.yimg.jp/lib/news/jquery/jquery.js used in some pages of yahoo.co.jp throws NS_ERROR_XPC_BAD_CONVERT_JS

Status: RESOLVED DUPLICATE of bug 601733

(Core :: JavaScript Engine, defect)

Description

[Toshihiro Yamada]

User-Agent:       Mozilla/5.0 (Windows NT 5.1; rv:2.0b7pre) Gecko/20100918 Firefox/4.0b7pre
Build Identifier: Mozilla/5.0 (Windows NT 5.1; rv:2.0b7pre) Gecko/20100918 Firefox/4.0b7pre

http://i.yimg.jp/lib/news/jquery/jquery.js is used on some pages with the system of public comments.
This scripts throws NS_ERROR_XPC_BAD_CONVERT_JS and the system doesn't work at all.

Error detail:
Error: uncaught exception: [Exception... "Could not convert JavaScript argument arg 0 [nsIDOMHTMLDivElement.appendChild]"  nsresult: "0x80570009 (NS_ERROR_XPC_BAD_CONVERT_JS)"  location: "JS frame :: http://i.yimg.jp/lib/news/jquery/jquery.js :: anonymous :: line 11"  data: no]

Regression Range:(Not sure)
Works:  2010-04-05 nightly
Broken: 2010-04-06 nightly

Reproducible: Always

Steps to Reproduce:
1.Open some news pages of www.yahoo.co.jp (ex. http://headlines.yahoo.co.jp/hl?a=20100919-00000020-jij-bus_all (Only Japanese))
Actual Results:  
Exception is thrown and comments (shown below of page) aren't shown at all.

Expected Results:  
No exception and comments are shown.

Comment 1

[Makoto Kato [:m_kato]]

confirmed 2010-09-18 build

Comment 2

[Boris Zbarsky [:bzbarsky]]

Toshihiro Yamada, which part of the regression range are you not sure about?  What are the changeset IDs of the builds in question?  Depending on exactly what changeset the 2010-04-06 build is built from, the possible changesets that might have caused this change drastically...

Comment 3

[Toshihiro Yamada]

It seems to be (based on the .txt files in the nightly build folders):
mozilla-central nightly
OK:2010-04-05 (c4df407008b5)
NG:2010-04-06 (523d0f8e0926)

And I made same investigation in tracemonkey nightly:
OK:2010-03-30 (bf9c4630fa38)
NG:2010-03-31 (d9ede2c4c678)

Comment 4

[Johnny Stenback (:jst)]

Blocking on this regression. Based on the tracemonkey regression range, this looks like a JS engine regression.

Comment 5

[Boris Zbarsky [:bzbarsky]]

With both of the tracemonkey revisions from comment 3, I get:

Error: uncaught exception: [Exception... "Node cannot be inserted at the specified point in the hierarchy"  code: "3" nsresult: "0x80530003 (NS_ERROR_DOM_HIERARCHY_REQUEST_ERR)"  location: "http://i.yimg.jp/lib/news/jquery/jquery.js Line: 11"]

on the page from comment 0, and the rendering looks the same in both builds...  Toshihiro Yamada, could you double-check that range?  Maybe post a screenshot of the ok and broken rendering?  I'm happy to bisect here, but need to make sure I know what I'm looking for.

Comment 6

[Toshihiro Yamada]

(In reply to comment #5)
> With both of the tracemonkey revisions from comment 3, I get:
> 
> Error: uncaught exception: [Exception... "Node cannot be inserted at the
> specified point in the hierarchy"  code: "3" nsresult: "0x80530003
> (NS_ERROR_DOM_HIERARCHY_REQUEST_ERR)"  location:
> "http://i.yimg.jp/lib/news/jquery/jquery.js Line: 11"]
> 
> on the page from comment 0, and the rendering looks the same in both builds... 
> Toshihiro Yamada, could you double-check that range?  Maybe post a screenshot
> of the ok and broken rendering?  I'm happy to bisect here, but need to make
> sure I know what I'm looking for.

Oh, I'm very sorry.
Completely, I mixed up the regression range in the check.

I recheck it...

Collected range is here:
OK:2010-03-29 (181ef94693d5)
NG:2010-03-30 (bf9c4630fa38)

Checkins in this range:
http://hg.mozilla.org/tracemonkey/pushloghtml?fromchange=181ef94693d5&tochange=bf9c4630fa38

Comment 7

[Boris Zbarsky [:bzbarsky]]

The first bad revision is:
changeset:   39610:bf9c4630fa38
user:        Brendan Eich <[e-mail]>
date:        Tue Mar 30 00:44:28 2010 -0700
summary:     Fix arguments objects to share a runtime-wide empty scope, instead of each getting a differently shaped own scope at birth (554626, r=igor).

Comment 8

[Toshihiro Yamada]

Now, first test URL had been gone since page is removed from server.

It's new URL to reproduce the problem.
http://headlines.yahoo.co.jp/hl?a=20100928-00000163-jij-pol

Comment 9

[Toshihiro Yamada]

Attachment: jquery.js decoded and removed some code depending on other browsers

I made some investigation.

I attach the decoded jquery.js.
The cause of exception is a function 'append' line 112 in the attached file.

Exception is thrown when this function is called from the sentence,
$("#commentbody").append(tmpl_sort,{created_at_sort:sort_list["created_at"],points_sort:sort_list["points"],minus_points_sort:sort_list["minus_points"],sum_points_sort:sort_list["sum_points"],lost_points_sort:sort_list["lost_points"]});
in a js file "http://i.yimg.jp/lib/news/comment/comment_1_7-min.js"
(This code is in the function "setSort")

Additionally, no exception is thrown when call function 'domManip' instead of 'append'.

Comment 10

[Toshihiro Yamada]

OK, I got some more results.

Problem is appeared when function 'append' is called with arguments contains the JQueryTemplate(http://i.yimg.jp/lib/news/jquery/jquery.template.js).
This is used some place in http://i.yimg.jp/lib/news/comment/comment_1_7-min.js
and all of them throws exception.

In any case, it is seemed the combination of function 'append' and JQueryTemplate is essential 
since 'append' with non-template arguments works fine 
and function 'domManip' with arguments contains containJQueryTemplate also works fine.

I can't track down anymore due to JQuery's complexity and limitation of Web Console...

Comment 11

[Boris Zbarsky [:bzbarsky]]

John, can you help here?

Comment 12

[Toshihiro Yamada]

From some more test, I noticed something interesting.

In the code path using JQueryTemplate is here:
1. Call function '$("#commentbody").append' with two arguments (from http://i.yimg.jp/lib/news/comment/comment_1_7-min.js)
     First is JqueryTemplate, second is strings for replacing ${XXX}s in the template. 
2. Function 'append' calls function 'domManip' (line 113 in the attached file)
     In this time, called function 'domManip' is at line 219 in http://i.yimg.jp/lib/news/jquery/jquery.template.js
3. In function 'domManip', JQueryTemplate in an argument args is processed and replaced one string.
4. Applying original JQuery's 'domManip' (line 267 in the attached file)

In 4., Template's 'domManip' passes its arguments to original 'domManip', and in it, argument 'g' is different between fx3.6 and fx4.0b.
   fx3.6:g.length = 2, g[0] = string obtained in 3., g[1] = undefined
   fx4.0:g.length = 2, g[0] = string obtained in 3., g[1] = second argument of 1.
(In any case, g[i]=args[i] and difference is only whether the changes of args are reflected to the 'arguments' or not)

After that, in fx4.0, 'domManip' attempts to append non-DOM object to DivElement and throw exception.

I have no idea which behavior is correct, but this is apparently the reason why the exception is thrown.

Comment 13

[Toshihiro Yamada]

Attachment: small testcase

OK, I succeed to make the small testcase. 

I misunderstood the problem a little.

Problem is 'delete' doesn't work correctly.
In the testcase, attempts to delete second argument of arguments in function b.
But it isn't deleted and remains after that and causes exception.

The original case is also similar theory.
In domManip of JQueryTemplete, apparently it fails to delete unneeded argument.
(line 224 http://i.yimg.jp/lib/news/jquery/jquery.template.js)
By it, exception is caused.

In both cases, by changing the sentence to 'XXX = undefined', problem is gone.

Comment 14

[Robert Sayre]

(In reply to comment #13)
> Created attachment 479671 [details]
> small testcase
> 
> OK, I succeed to make the small testcase. 

Fantastic! Thank you so much.

Comment 15

[Toshihiro Yamada]

Works fine with latest hourly build of tracemonkey(61cf1922e29d). 

seems this bug is fixed by the fix of Bug 601733.