710780 - Fail to load Comments and "Add your comment" button - news.cnet.com

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect)

Description

[Alice0775 White]

Attachment: Screenshot, comparison between Nightly11.0a1 and Aurora10.0a2

Build Identifier:
http://hg.mozilla.org/mozilla-central/rev/fd6ab19f312c
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:11.0a1) Gecko/20111214 Firefox/11.0a1 ID:20111214031134
 
See Forum ( http://forums.mozillazine.org/viewtopic.php?f=23&t=2387705 )
The page did not make "Join the conversation!(Log in or register)", "Add your comment" button and commnets.

* If I set javascript.options.methodjit.content to false, the page load properly.


Reproducible: Always

Steps to Reproduce:
1. Start Firefox with clean profile
2. Open URL, no need log-in

3. Look for "Join the conversation!(Log in or register)"
4. Look for "Add your comment" button


Actual Results:
  The page did not make "Join the conversation!(Log in or register)", "Add your comment" button and commnets.
  And the following error is shown in Error Console.
  
Error: arguments.callee.caller is null
Source File: http://global.cbsistatic.com/cnwk.1d/html/rb/js/tron/oreo.moo.rb.combined.js
Line: 5

  
Expected Results:
  The page should make "Join the conversation!(Log in or register)", "Add your comment" button and commnets.

Regression window(m-c)
Works;
http://hg.mozilla.org/mozilla-central/rev/a68c96c1d8e0
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:11.0a1) Gecko/20111203 Firefox/11.0a1 ID:20111203031117
Fails:
http://hg.mozilla.org/mozilla-central/rev/13afcd4c097c
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:11.0a1) Gecko/20111203 Firefox/11.0a1 ID:20111203122618
Pushlog:
http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=a68c96c1d8e0&tochange=13afcd4c097c


Regression window(jm)
Works;
http://hg.mozilla.org/projects/jaegermonkey/rev/1d1656b60947
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:10.0a1) Gecko/20111021 Firefox/10.0a1 ID:20111021040331
Fails:
http://hg.mozilla.org/projects/jaegermonkey/rev/d849045ad3f2
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:10.0a1) Gecko/20111022 Firefox/10.0a1 ID:20111022040331
Pushlog:
http://hg.mozilla.org/projects/jaegermonkey/pushloghtml?fromchange=1d1656b60947&tochange=d849045ad3f2
Triggered by;
d849045ad3f2	Brian Hackett — Add JSScript::function, bug 693754.

Comment 2

[Boris Zbarsky [:bzbarsky]]

Brian, could you take a look?

Comment 3

[Brian Hackett [Laid off!]]

Attachment: patch

The code in fun_getProperty that scans for the topmost activation of a function did not work when the function was cloned (not a top level function) and the frame was pushed by the mjit.  fp->fun() is sometimes the canonical function for a script, and sometimes the callee function.  I'm going to put together a patch to make it always the former (as it was before objshrink) and as part of that will go through all uses of fp->fun() and fp->maybeFun() to look for similar bugs.

Comment 4

[Luke Wagner [:luke]]

Comment on attachment 582053 [details] [diff] [review]
patch

I made a fp->callee/fun bug the other day.  I was thinking that it's pretty easy to make (esp. now that function objects are JSFunctions).  VM call paths ensure fp->callee() == fp->fun(), so I think it's just the mjit path where we bake 'fp->fun = immediate' into the prologue.  Perhaps it would be worth the perf ding to have fp->fun() == fp->callee() (or just rm fp->callee altogether)?

Comment 5

[Brian Hackett [Laid off!]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/ef1cc0b263a1

Comment 6

[:Ms2ger (he/him; ⌚ UTC+1/+2)]

https://hg.mozilla.org/mozilla-central/rev/ef1cc0b263a1

Comment 9

[Mihaela Velimiroviciu (:mihaelav)]

Mozilla/5.0 (Windows NT 6.1; rv:11.0) Gecko/20100101 Firefox/11.0 beta 4

Verified the fix on latest Firefox 11 (beta 4): "Join the conversation!(Log in or register)", "Add your comment" button and comments are displayed.