640880 - JavaScript reports undefined variable

Status: RESOLVED DUPLICATE of bug 676343

(Core :: JavaScript Engine, defect)

Description

[felix winkelmann]

User-Agent:       Mozilla/5.0 (Windows NT 6.0; rv:2.0b13pre) Gecko/20110310 Firefox/4.0b13pre
Build Identifier: Mozilla/5.0 (Windows NT 6.0; rv:2.0b13pre) Gecko/20110310 Firefox/4.0b13pre

Opening the mentioned URL will load large amounts of JavaScript and runs a test-suite, generated by a compiler that targets JavaScript. Conkeror, FF 3.0, Opera 11 and Chrome run it without problems, but recent versions of FF report an iundefined variable. I get this alert box, which is presented by code that catches the JS error and prints some additional source-language specific information:

Error: k3252 is not defined

Call trace:

  (t413 #<procedure>)
  (%show #<procedure> #<output port "document">)
  (t491 (#<promise>))
  (%show   #<output port "document">)
  (t473 #<promise>)
  (display #<promise> #<output port "document">)
  (%check-port #<output port "document"> output display)
  (t413 #<promise>)
  (%show #<promise> #<output port "document">)
  (t491 ())
  (%show ) #<output port "document">)
  (display   ==> )
  (t413   ==> )
  (%show   ==>  #<output port "document">)
  (apply #<procedure> (#<promise>))
  (force #<promise>)
  (apply #<procedure> (6))
  (values 6)
  (t473 6)
  (display 6 #<output port "document">)
  (%check-port #<output port "document"> output display)
  (t413 6)
  (%show 6 #<output port "document">)
  (newline )
  (%show 
 #<output port "document">)
  (%make-promise #<procedure>)
  (force #<promise>)
  (call-with-values #<procedure> #<procedure>)
  (force #<promise>)
  (call-with-values #<procedure> #<procedure>)
  (apply #<procedure> (3))
  (values 3)    <---


Reproducible: Always

Steps to Reproduce:
1. Open given URL.
Actual Results:  
The JS engine reports an undefined variable:

"Error: k3252 is not defined"


Expected Results:  
The test-suite should run to completion.

Comment 1

[Alex Lakatos[:AlexLakatos]]

This error appears in Build identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15
AND Build identifier: Mozilla/5.0 (Windows NT 5.1; rv:2.0b13pre) Gecko/20110313 Firefox/4.0b13pre.

Google Chrome 9 works fine.

Comment 2

[Benjamin Smedberg]

Is it possible to get a more minimal testcase? Also, a specific regression range would be good: you can use http://harthur.github.com/mozregression/ to help narrow things down to a particular nightly build.

Comment 3

[felix winkelmann]

Reducing the size of the testcase is difficult. Actually, I assume the deep function-nesting is causing the problem. The code that triggers the problem seems to be 0004-r4rstest.js, which is loaded dynamically by the code in test.html.

Comment 4

[Alice0775 White]

Regression window(m-c nightly):
Works:
http://hg.mozilla.org/mozilla-central/rev/da613c9fae8c
Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2a1pre) Gecko/20090513 Namoroka/3.6a1pre ID:20090513044918
Fails(an error alert pops up):
http://hg.mozilla.org/mozilla-central/rev/a1fc27041e53
Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2a1pre) Gecko/20090514 Namoroka/3.6a1pre ID:20090514043824
Pushlog:
http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=da613c9fae8c&tochange=a1fc27041e53


Regression window(tm nightly):
Works:
http://hg.mozilla.org/tracemonkey/rev/ef840521653f
Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2a1pre) Gecko/20090510 Namoroka/3.6a1pre ID:20090510031736
Fails(an error alert pops up):
http://hg.mozilla.org/tracemonkey/rev/010768e6119c
Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2a1pre) Gecko/20090514 Namoroka/3.6a1pre ID:20090514031914
Pushlog:
http://hg.mozilla.org/tracemonkey/pushloghtml?fromchange=ed70badf19d7&tochange=010768e6119c

Comment 5

[Alice0775 White]

In local build(from tm repository)
build from 010768e6119c : fails
build from 22ef5690efbf : works
build from 0827b97fb89b : works
build from 3416e3d9c616 : works
build from 9caa852c758c : works
build from ed70badf19d7 : works
Triggerd by:
010768e6119c	Brendan Eich — Bug 492914 - TM: trace aborts due to flat closure analysis bug (r=mrbkap).

Comment 6

[Jan de Mooij [:jandem]]

Attachment: Shell testcase

Here's a reduced shell testcase.

$ ./js test.js
test.js:229: ReferenceError: k3252 is not defined

Looks like this is indeed caused by the deep function nesting...

Comment 7

[Jan de Mooij [:jandem]]

Attachment: Reduced testcase

Small bug in my experimental reducer, removed about 100 more lines.

Comment 8

[Jan de Mooij [:jandem]]

Duping forward.