928413 - two consecutive new operators in JavaScript return the same object

Status: RESOLVED WORKSFORME

(Core :: JavaScript Engine, defect)

Description

[dukkenator]

User Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:24.0) Gecko/20100101 Firefox/24.0 (Beta/Release)
Build ID: 20130910160258

Steps to reproduce:

In our heavy-weight site we have the following code fragment (JsonArray is our own function): 
  var result, container;
  result = new JsonArray;
  container = new JsonArray;
  //the following line is only in our local debug build
  result == container && print('result == container');

Where JsonArray is a typical function which does not use "return" operator from the constructor so that the behavior of the new operator is standard.


The site: space.delightex.com

In order to reproduce you should enter the site, create a Space, add two or more objects and repeat pressing "View->Random Positions->All Figures" button

Unfortunately, we could not manage to extract little reproducible code fragment.

The bug is not reproducible neither with FireFox v23 nor with Chrome


Actual results:

Under some circumstances (very likely during GC period) it happens so that 
the "result" has the same value as "container", so we can see the debug output
"result == container" (in our local debug build). In the production (space.delightex.com) returning the same object for 'result' and 'container' results in a stack overflow (parsing a JSON container that contains itself, with recursion).


Expected results:

we expect the new operator to return two different objects when called two times assigning the results to two different vars with two consecutive lines.

Comment 1

[Jan de Mooij [:jandem]]

It's a long shot but I wonder if this is due to Ion's CreateThis* stuff. Hannes can you take a look maybe? This sounds like a pretty serious bug.

Comment 2

[Hannes Verschore [:h4writer]]

I just tried to reproduce on FF24, but didn't succeed. I went to the site, opened debugger tools, registered myself, created a space, added two people in it, and pressed "View->Random Positions->All Figures" for crazy.

I didn't see a stack overflow issue.

Do you have extra information on how to reproduce this. How many times did you have to press. Was there something running in the background. Anything that could make a difference in getting this to trigger for me?

Comment 3

[Tom S. (please needinfo tschuster)]

I would imagine opening the debugger could hide the problem.

Comment 4

[Loic]

I think it's already fixed in FF26+.

Working range:
bad=2013-09-10
good=2013-09-11
http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=e5ca10a2b3d0&tochange=9e9f74116749

Could you install Aurora (see http://www.mozilla.org/en-US/firefox/aurora/) and confirm it's fixed on your side, please.

Comment 5

[dukkenator]

I installed Aurora 26.0a2 (2013-10-20) and tried to reproduce the bug in it, but didn't succeed. Apparently, the bug is not reproducible against Aurora.

Comment 6

[Loic]

Thanks for confirming. As your corporate is developing a rich web app, it would help if you could test it with Beta or Aurora in the future, these versions are very stable and it would allow to fix potential bugs before releasing the Release version.

I close the bug, feel free to reopen if the issue is back.

Comment 7

[dukkenator]

Thanks Loic! When FireFox with this bug fixed will be available? Will it be 26.0 or will it be back-ported to a v24 update?

Comment 8

[Loic]

FF24 is nearly EOLed, because FF25 will be released at the end of the month, so I don't think it will be backported, especially because the bugfix has not been identified (only the working range). So you probably need to wait for FF26.