Last Comment Bug 710780 - Fail to load Comments and "Add your comment" button - news.cnet.com
: Fail to load Comments and "Add your comment" button - news.cnet.com
Status: VERIFIED FIXED
[qa!]
: regression, verified-beta
Product: Core
Classification: Components
Component: JavaScript Engine (show other bugs)
: 11 Branch
: x86 Windows 7
: -- normal (vote)
: mozilla11
Assigned To: Brian Hackett (:bhackett)
:
Mentors:
http://news.cnet.com/8301-11128_3-573...
: 707643 710443 710775 (view as bug list)
Depends on:
Blocks: 693754
  Show dependency treegraph
 
Reported: 2011-12-14 10:18 PST by Alice0775 White
Modified: 2012-02-23 07:44 PST (History)
12 users (show)
Ms2ger: in‑testsuite+
See Also:
Crash Signature:
(edit)
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---
+
verified


Attachments
Screenshot, comparison between Nightly11.0a1 and Aurora10.0a2 (492.22 KB, image/png)
2011-12-14 10:18 PST, Alice0775 White
no flags Details
patch (1.12 KB, patch)
2011-12-15 11:42 PST, Brian Hackett (:bhackett)
luke: review+
Details | Diff | Splinter Review

Description Alice0775 White 2011-12-14 10:18:51 PST
Created attachment 581700 [details]
Screenshot, comparison between Nightly11.0a1 and Aurora10.0a2

Build Identifier:
http://hg.mozilla.org/mozilla-central/rev/fd6ab19f312c
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:11.0a1) Gecko/20111214 Firefox/11.0a1 ID:20111214031134
 
See Forum ( http://forums.mozillazine.org/viewtopic.php?f=23&t=2387705 )
The page did not make "Join the conversation!(Log in or register)", "Add your comment" button and commnets.

* If I set javascript.options.methodjit.content to false, the page load properly.


Reproducible: Always

Steps to Reproduce:
1. Start Firefox with clean profile
2. Open URL, no need log-in

3. Look for "Join the conversation!(Log in or register)"
4. Look for "Add your comment" button


Actual Results:
  The page did not make "Join the conversation!(Log in or register)", "Add your comment" button and commnets.
  And the following error is shown in Error Console.
  
Error: arguments.callee.caller is null
Source File: http://global.cbsistatic.com/cnwk.1d/html/rb/js/tron/oreo.moo.rb.combined.js
Line: 5

  
Expected Results:
  The page should make "Join the conversation!(Log in or register)", "Add your comment" button and commnets.

Regression window(m-c)
Works;
http://hg.mozilla.org/mozilla-central/rev/a68c96c1d8e0
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:11.0a1) Gecko/20111203 Firefox/11.0a1 ID:20111203031117
Fails:
http://hg.mozilla.org/mozilla-central/rev/13afcd4c097c
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:11.0a1) Gecko/20111203 Firefox/11.0a1 ID:20111203122618
Pushlog:
http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=a68c96c1d8e0&tochange=13afcd4c097c


Regression window(jm)
Works;
http://hg.mozilla.org/projects/jaegermonkey/rev/1d1656b60947
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:10.0a1) Gecko/20111021 Firefox/10.0a1 ID:20111021040331
Fails:
http://hg.mozilla.org/projects/jaegermonkey/rev/d849045ad3f2
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:10.0a1) Gecko/20111022 Firefox/10.0a1 ID:20111022040331
Pushlog:
http://hg.mozilla.org/projects/jaegermonkey/pushloghtml?fromchange=1d1656b60947&tochange=d849045ad3f2
Triggered by;
d849045ad3f2	Brian Hackett — Add JSScript::function, bug 693754.
Comment 1 Alice0775 White 2011-12-14 10:23:31 PST
*** Bug 710775 has been marked as a duplicate of this bug. ***
Comment 2 Boris Zbarsky [:bz] 2011-12-14 14:14:35 PST
Brian, could you take a look?
Comment 3 Brian Hackett (:bhackett) 2011-12-15 11:42:00 PST
Created attachment 582053 [details] [diff] [review]
patch

The code in fun_getProperty that scans for the topmost activation of a function did not work when the function was cloned (not a top level function) and the frame was pushed by the mjit.  fp->fun() is sometimes the canonical function for a script, and sometimes the callee function.  I'm going to put together a patch to make it always the former (as it was before objshrink) and as part of that will go through all uses of fp->fun() and fp->maybeFun() to look for similar bugs.
Comment 4 Luke Wagner [:luke] 2011-12-15 11:48:13 PST
Comment on attachment 582053 [details] [diff] [review]
patch

I made a fp->callee/fun bug the other day.  I was thinking that it's pretty easy to make (esp. now that function objects are JSFunctions).  VM call paths ensure fp->callee() == fp->fun(), so I think it's just the mjit path where we bake 'fp->fun = immediate' into the prologue.  Perhaps it would be worth the perf ding to have fp->fun() == fp->callee() (or just rm fp->callee altogether)?
Comment 5 Brian Hackett (:bhackett) 2011-12-15 14:13:42 PST
https://hg.mozilla.org/integration/mozilla-inbound/rev/ef1cc0b263a1
Comment 6 :Ms2ger (⌚ UTC+1/+2) 2011-12-16 05:47:32 PST
https://hg.mozilla.org/mozilla-central/rev/ef1cc0b263a1
Comment 7 Alice0775 White 2011-12-20 18:32:59 PST
*** Bug 707643 has been marked as a duplicate of this bug. ***
Comment 8 David Mandelin [:dmandelin] 2011-12-21 17:18:47 PST
*** Bug 710443 has been marked as a duplicate of this bug. ***
Comment 9 Mihaela Velimiroviciu (:mihaelav) 2012-02-23 07:44:16 PST
Mozilla/5.0 (Windows NT 6.1; rv:11.0) Gecko/20100101 Firefox/11.0 beta 4

Verified the fix on latest Firefox 11 (beta 4): "Join the conversation!(Log in or register)", "Add your comment" button and comments are displayed.

Note You need to log in before you can comment on or make changes to this bug.