683140 - TI: breaks layout of Jira dashboard

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Will Roberts [:bws42]]

The Jira dashboard contains a bunch of widgets which use AJAX to query for information. Once the data is received the widgets resize themselves vertically as necessary to display all the information.

On m-c this started occurring with the landing of TI, I haven't had a change to bisect down the tracemonkey repo to see when this started.

Comment 1

[Boris Zbarsky [:bzbarsky]]

Requesting tracking for this regression.

Comment 2

[Brian Hackett [Laid off!]]

Is there a way to get this site to reset fully after closing the browser?  I disabled TI and the mjit, restarted and got it to render correctly, but now after turning back on TI/mjit it still renders correctly, even after closing and reopening the browser several times.

Comment 3

[Jan de Mooij [:jandem]]

Creating a new profile (firefox -p) seems to work. What's strange though is that if I create a new profile, disable TI/mjit and restart, it still fails to resize the widgets.

Comment 4

[Jan de Mooij [:jandem]]

Nasty bug. It's related to multiple globals and Array.prototype.slice. Here's a minimal shell testcase:
--
var g = newGlobal("same-compartment");
g.eval("this.f = function(a) {" +
       "print(a instanceof Array);" +
       "a = Array.prototype.slice.call(a);" +
       "print(a instanceof Array); }");
g.f([1, 2, 3]);
--
Output before TI landed: false, true
Output after TI landed:  false, false

This also fails with TI and JM disabled.

(To reproduce this bug you have to remove all DOM Storage items for this website. localStorage is used to store the size of all "gadgets". After TI landed we don't update the localStorage value and therefore always use the default height for the gadgets)

Comment 5

[Jan de Mooij [:jandem]]

Here's another testcase:
--
var g = newGlobal("new-compartment");
g.a = g.Array(10);
print(g.a instanceof Array);
g.a = Array.prototype.slice(g.a);
print(g.a instanceof Array);
--
Before, no args: false, true
After,  no args: false, false
After,  -n     : false, true

This may be a slightly different problem, but it's definitely related.

Comment 6

[caolichun]

Attachment: firefox7.0 beta show all date

firefox7.0 beta show all date

Comment 7

[caolichun]

Attachment: firefox9.0a1 can't show all date

firefox9.0a1 can't show all date

Comment 8

[Brian Hackett [Laid off!]]

Attachment: patch

Sorry about the late patch here.  In certain cases Array.{slice,splice,concat} will try to reuse the type of the input array for the result array, but could change the prototype in doing so.  This fix avoids that, and uses the default 'new' type for the scope chain when cross-global arrays are involved.

https://hg.mozilla.org/projects/jaegermonkey/rev/3a8b5e4a286b

Comment 9

[Luke Wagner [:luke]]

Comment on attachment 560494 [details] [diff] [review]
patch

Nice factoring and comment.

Comment 10

[Will Roberts [:bws42]]

Original issue is now fixed with a nightly based on http://hg.mozilla.org/mozilla-central/rev/648d084ca28e

Comment 11

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

After the changeset mentioned in comment 10 landed, the code editor for addons on the Addon Builder website no longer loads (for example, https://builder.addons.mozilla.org/addon/1014623/latest/ ).

Comment 12

[Daniel Buchner [:dbuc]]

I'm almost positive the issue with the Add-on Builder's code is related to Array proto issues, as mentioned in comment 8.

Comment 13

[Brian Hackett [Laid off!]]

Per bug 688478 the addon builder behaves correctly with TI disabled, which means this bug is not involved and the array proto issue is a red herring.  (Will investigate/fix that bug very soon)

https://hg.mozilla.org/mozilla-central/rev/c943bbf9dac4

Comment 14

[LegNeato]

Looks like by date this was fixed in time for Fx9. Please email [e-mail] if that is not the case.

Comment 15

[u279076]

(In reply to Christian Legnitto [:LegNeato] from comment #14)
> Looks like by date this was fixed in time for Fx9. Please email
> [e-mail] if that is not the case.

Do we need to use a debug build to test? Is the 9.0b6 release build sufficient?