TI: breaks layout of Jira dashboard

RESOLVED FIXED in mozilla9

Status

()

Core
JavaScript Engine
RESOLVED FIXED
7 years ago
6 years ago

People

(Reporter: bws42, Unassigned)

Tracking

(Blocks: 1 bug, {regression})

Trunk
mozilla9
x86_64
Linux
regression
Points:
---

Firefox Tracking Flags

(firefox9+)

Details

(Whiteboard: fixed-in-jaegermonkey [qa+], URL)

Attachments

(3 attachments)

(Reporter)

Description

7 years ago
The Jira dashboard contains a bunch of widgets which use AJAX to query for information. Once the data is received the widgets resize themselves vertically as necessary to display all the information.

On m-c this started occurring with the landing of TI, I haven't had a change to bisect down the tracemonkey repo to see when this started.
Requesting tracking for this regression.
Blocks: 619415
tracking-firefox9: --- → ?
Keywords: regression
Is there a way to get this site to reset fully after closing the browser?  I disabled TI and the mjit, restarted and got it to render correctly, but now after turning back on TI/mjit it still renders correctly, even after closing and reopening the browser several times.
Creating a new profile (firefox -p) seems to work. What's strange though is that if I create a new profile, disable TI/mjit and restart, it still fails to resize the widgets.
Status: UNCONFIRMED → NEW
Ever confirmed: true
tracking-firefox9: ? → +
Nasty bug. It's related to multiple globals and Array.prototype.slice. Here's a minimal shell testcase:
--
var g = newGlobal("same-compartment");
g.eval("this.f = function(a) {" +
       "print(a instanceof Array);" +
       "a = Array.prototype.slice.call(a);" +
       "print(a instanceof Array); }");
g.f([1, 2, 3]);
--
Output before TI landed: false, true
Output after TI landed:  false, false

This also fails with TI and JM disabled.

(To reproduce this bug you have to remove all DOM Storage items for this website. localStorage is used to store the size of all "gadgets". After TI landed we don't update the localStorage value and therefore always use the default height for the gadgets)
Here's another testcase:
--
var g = newGlobal("new-compartment");
g.a = g.Array(10);
print(g.a instanceof Array);
g.a = Array.prototype.slice(g.a);
print(g.a instanceof Array);
--
Before, no args: false, true
After,  no args: false, false
After,  -n     : false, true

This may be a slightly different problem, but it's definitely related.

Comment 6

7 years ago
Created attachment 559857 [details]
firefox7.0 beta show all date

firefox7.0 beta show all date

Comment 7

7 years ago
Created attachment 559858 [details]
firefox9.0a1 can't show all date

firefox9.0a1 can't show all date
Created attachment 560494 [details] [diff] [review]
patch

Sorry about the late patch here.  In certain cases Array.{slice,splice,concat} will try to reuse the type of the input array for the result array, but could change the prototype in doing so.  This fix avoids that, and uses the default 'new' type for the scope chain when cross-global arrays are involved.

https://hg.mozilla.org/projects/jaegermonkey/rev/3a8b5e4a286b
Attachment #560494 - Flags: review?(luke)
Whiteboard: fixed-in-jaegermonkey

Comment 9

7 years ago
Comment on attachment 560494 [details] [diff] [review]
patch

Nice factoring and comment.
Attachment #560494 - Flags: review?(luke) → review+
(Reporter)

Comment 10

7 years ago
Original issue is now fixed with a nightly based on http://hg.mozilla.org/mozilla-central/rev/648d084ca28e
After the changeset mentioned in comment 10 landed, the code editor for addons on the Addon Builder website no longer loads (for example, https://builder.addons.mozilla.org/addon/1014623/latest/ ).
I'm almost positive the issue with the Add-on Builder's code is related to Array proto issues, as mentioned in comment 8.
Per bug 688478 the addon builder behaves correctly with TI disabled, which means this bug is not involved and the array proto issue is a red herring.  (Will investigate/fix that bug very soon)

https://hg.mozilla.org/mozilla-central/rev/c943bbf9dac4
Status: NEW → RESOLVED
Last Resolved: 7 years ago
Resolution: --- → FIXED
Whiteboard: fixed-in-jaegermonkey → fixed-in-jaegermonkey [qa+]

Comment 14

6 years ago
Looks like by date this was fixed in time for Fx9. Please email release-drivers@mozilla.org if that is not the case.
Target Milestone: --- → mozilla9
(In reply to Christian Legnitto [:LegNeato] from comment #14)
> Looks like by date this was fixed in time for Fx9. Please email
> release-drivers@mozilla.org if that is not the case.

Do we need to use a debug build to test? Is the 9.0b6 release build sufficient?
You need to log in before you can comment on or make changes to this bug.