Closed Bug 683140 Opened 8 years ago Closed 8 years ago

TI: breaks layout of Jira dashboard


(Core :: JavaScript Engine, defect)

Not set



Tracking Status
firefox9 + ---


(Reporter: bws42, Unassigned)


(Blocks 1 open bug, )


(Keywords: regression, Whiteboard: fixed-in-jaegermonkey [qa+])


(3 files)

The Jira dashboard contains a bunch of widgets which use AJAX to query for information. Once the data is received the widgets resize themselves vertically as necessary to display all the information.

On m-c this started occurring with the landing of TI, I haven't had a change to bisect down the tracemonkey repo to see when this started.
Requesting tracking for this regression.
Keywords: regression
Is there a way to get this site to reset fully after closing the browser?  I disabled TI and the mjit, restarted and got it to render correctly, but now after turning back on TI/mjit it still renders correctly, even after closing and reopening the browser several times.
Creating a new profile (firefox -p) seems to work. What's strange though is that if I create a new profile, disable TI/mjit and restart, it still fails to resize the widgets.
Ever confirmed: true
Nasty bug. It's related to multiple globals and Array.prototype.slice. Here's a minimal shell testcase:
var g = newGlobal("same-compartment");
g.eval("this.f = function(a) {" +
       "print(a instanceof Array);" +
       "a =;" +
       "print(a instanceof Array); }");
g.f([1, 2, 3]);
Output before TI landed: false, true
Output after TI landed:  false, false

This also fails with TI and JM disabled.

(To reproduce this bug you have to remove all DOM Storage items for this website. localStorage is used to store the size of all "gadgets". After TI landed we don't update the localStorage value and therefore always use the default height for the gadgets)
Here's another testcase:
var g = newGlobal("new-compartment");
g.a = g.Array(10);
print(g.a instanceof Array);
g.a = Array.prototype.slice(g.a);
print(g.a instanceof Array);
Before, no args: false, true
After,  no args: false, false
After,  -n     : false, true

This may be a slightly different problem, but it's definitely related.
firefox7.0 beta show all date
firefox9.0a1 can't show all date
Attached patch patchSplinter Review
Sorry about the late patch here.  In certain cases Array.{slice,splice,concat} will try to reuse the type of the input array for the result array, but could change the prototype in doing so.  This fix avoids that, and uses the default 'new' type for the scope chain when cross-global arrays are involved.
Attachment #560494 - Flags: review?(luke)
Whiteboard: fixed-in-jaegermonkey
Comment on attachment 560494 [details] [diff] [review]

Nice factoring and comment.
Attachment #560494 - Flags: review?(luke) → review+
Original issue is now fixed with a nightly based on
After the changeset mentioned in comment 10 landed, the code editor for addons on the Addon Builder website no longer loads (for example, ).
I'm almost positive the issue with the Add-on Builder's code is related to Array proto issues, as mentioned in comment 8.
Per bug 688478 the addon builder behaves correctly with TI disabled, which means this bug is not involved and the array proto issue is a red herring.  (Will investigate/fix that bug very soon)
Closed: 8 years ago
Resolution: --- → FIXED
Whiteboard: fixed-in-jaegermonkey → fixed-in-jaegermonkey [qa+]
Looks like by date this was fixed in time for Fx9. Please email if that is not the case.
Target Milestone: --- → mozilla9
(In reply to Christian Legnitto [:LegNeato] from comment #14)
> Looks like by date this was fixed in time for Fx9. Please email
> if that is not the case.

Do we need to use a debug build to test? Is the 9.0b6 release build sufficient?
You need to log in before you can comment on or make changes to this bug.