Last Comment Bug 762473 - Error appear in error console. And finally, a spinning mark has stayed.
: Error appear in error console. And finally, a spinning mark has stayed.
Status: RESOLVED FIXED
: regression
Product: Core
Classification: Components
Component: JavaScript Engine (show other bugs)
: 16 Branch
: x86 Windows 7
: -- normal (vote)
: mozilla16
Assigned To: Luke Wagner [:luke]
:
Mentors:
http://support.asus.com/ServiceHome.a...
: 762750 (view as bug list)
Depends on: 764249
Blocks: 659577
  Show dependency treegraph
 
Reported: 2012-06-07 06:25 PDT by Alice0775 White
Modified: 2012-06-15 17:58 PDT (History)
6 users (show)
See Also:
Crash Signature:
(edit)
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---


Attachments
fix and test (2.64 KB, patch)
2012-06-07 20:02 PDT, Luke Wagner [:luke]
no flags Details | Diff | Review
fix and test (9.09 KB, patch)
2012-06-07 20:04 PDT, Luke Wagner [:luke]
dvander: review+
Details | Diff | Review

Description Alice0775 White 2012-06-07 06:25:20 PDT
Build Identifier:
http://hg.mozilla.org/mozilla-central/rev/6338a8988917
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:16.0) Gecko/16.0 Firefox/16.0a1 ID:20120606030528

Error appear in error console.
And finally, a spinning mark has stayed


Reproducible: Always

Steps to Reproduce:
0. Open Firefox with clean profile and Open Error Console
1. Open http://support.asus.com/ServiceHome.aspx?SLanguage=en
2. Click "Support"
3. Click items of "Question Category" in random order quickly and repeat

Actual Results:
Error: TypeError: d.events is undefined
Source file: http://support.asus.com/ScriptResource.axd?d=hYONdqIR0xF2OvXEPCfXSbVsr1je_sKVjJVO2_zvSOPibuS2UZMQCZJLQZWkI0c8uZJnUXiHgppL9-SLhBPeKIGIfi8h966JuEIJG41dcHm5Iv2i0&t=ffffffffbd2983fc
Line: 2
Error: TypeError: d.events is undefined
Source file: http://support.asus.com/ScriptResource.axd?d=hYONdqIR0xF2OvXEPCfXSbVsr1je_sKVjJVO2_zvSOPibuS2UZMQCZJLQZWkI0c8uZJnUXiHgppL9-SLhBPeKIGIfi8h966JuEIJG41dcHm5Iv2i0&t=ffffffffbd2983fc
Line: 2

And finally, the spinning mark has stayed

Expected Results:
No error and the spinning mark should disappears


regression window(m-c)
Good:
http://hg.mozilla.org/mozilla-central/rev/a7a905fd70d5
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:16.0) Gecko/16.0 Firefox/16.0a1 ID:20120605030522
Bad:
http://hg.mozilla.org/mozilla-central/rev/c76497029f0d
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:16.0) Gecko/16.0 Firefox/16.0a1 ID:20120605055317
Pushlog:
http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=a7a905fd70d5&tochange=c76497029f0d

Regression window(m-i)
Good:
http://hg.mozilla.org/integration/mozilla-inbound/rev/577a88fc97b6
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:15.0) Gecko/15.0 Firefox/15.0a1 ID:20120604103303
Bad:
http://hg.mozilla.org/integration/mozilla-inbound/rev/b863ef9946b8
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:15.0) Gecko/15.0 Firefox/15.0a1 ID:20120604103803
Pushlog:
http://hg.mozilla.org/integration/mozilla-inbound/pushloghtml?fromchange=577a88fc97b6&tochange=b863ef9946b8

Triggered by: Bug 659577
Comment 1 Jan de Mooij [:jandem] 2012-06-07 06:39:08 PDT
Can you reproduce this with the latest nightly, revision 7e4c2abb9fc9? It may be a duplicate of bug 762105.
Comment 2 Alice0775 White 2012-06-07 06:48:10 PDT
(In reply to Jan de Mooij (:jandem) from comment #1)
> Can you reproduce this with the latest nightly, revision 7e4c2abb9fc9? It
> may be a duplicate of bug 762105.

I can reproduce in
http://hg.mozilla.org/mozilla-central/rev/7e4c2abb9fc9
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:16.0) Gecko/16.0 Firefox/16.0a1 ID:20120607025755
Comment 3 Luke Wagner [:luke] 2012-06-07 20:02:13 PDT
Created attachment 631256 [details] [diff] [review]
fix and test

Thanks for the testcase and simple STR!  I tracked the issue down to this problem:

The non-reentrant-closure optimization had a pre-existing dependency on a call object's slots not moving after nesting->var/argArray starting pointing at them.  This was technically valid before bug 659577 since nesting only pointed into the slots after the function has returned, but it became invalid with bug 659577.

Bug 753158 should remove the entire optimization so I was just going for a simple fix that didn't regress anything.  I also like this approach since I think script->funHasExtensibleScope is generally a useful thing to know.  However, if there is another, simpler way, let me know.
Comment 4 Luke Wagner [:luke] 2012-06-07 20:04:20 PDT
Created attachment 631257 [details] [diff] [review]
fix and test

Oops, wrong patch.
Comment 5 Luke Wagner [:luke] 2012-06-08 11:01:10 PDT
Comment on attachment 631257 [details] [diff] [review]
fix and test

I think bhackett is ooo, so giving the review to dvander.  David: comment 3 explains the reason for this fix.
Comment 6 David Anderson [:dvander] 2012-06-08 11:50:57 PDT
What's the difference between that bit and bindings.extensibleParents?
Comment 7 Luke Wagner [:luke] 2012-06-08 11:52:35 PDT
(In reply to David Anderson [:dvander] from comment #6)
extensibleParents talks about the script's enclosing functions, funHasExtensibleScope talks about the script itself.
Comment 8 Luke Wagner [:luke] 2012-06-08 13:43:52 PDT
*** Bug 762750 has been marked as a duplicate of this bug. ***
Comment 9 Luke Wagner [:luke] 2012-06-08 13:52:57 PDT
https://hg.mozilla.org/mozilla-central/rev/227b4a4c3c46

Note You need to log in before you can comment on or make changes to this bug.