945651 - Comparison of 0 and null returns true

Status: VERIFIED FIXED

(Core :: JavaScript Engine: JIT, defect)

Description

[Martin Kleinhans]

User Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/31.0.1650.57 Safari/537.36

Steps to reproduce:

I'm working on a rather complex web application with a huge javascript codebase.
At some specific point in the code, a comparison of 0 and null apparently returns true. 

I have tried to isolate the bug without success.
The error can not be reproduced by calling the SAME function with the SAME values on the SAME page manually (e.g. from the console), and it also goes away completely once I open the Script Debugger just once.

I am however fairly certain it is not an issue with the code itself, and that there are no common problems like variables leaks involved.

Affected function (with some debug output) is:

function indexInArray(a,b){
  for(var d=0; d<b.length; d++) {
    if( b[d] == a) {
      if( b[d] === a ) return d;
      console.log('comparison error:', a, b[d], typeof a, typeof b[d]);
    }
  }
  return -1;
}

This is called with the following arguments:
indexInArray( null, [1, 2, 3, 0] );


Actual results:

Console output:
[11:34:50.389] "comparison error:" null 0 "object" "number"


Expected results:

Obviously, 0==null should always be false, so there should be NO console message.

Comment 1

[Martin Kleinhans]

Some additional Information:
We first noticed this Bug with Firefox 24.
We can reproduce it on OSX and Windows XP, Windows 7 with Firefox 24 and 25.

Comment 2

[:Gijs (he/him)]

Can you provide a testcase (non-reduced if you can't seem to reduce it, ie a link to this web app)?

Separately, have you checked whether you can reproduce this on newer versions of Firefox, notably the latests Nightly version (28)? (which you should probably try with a new profile to be safe)

Comment 3

[Loic]

Executing this code in the JS Scratchpad:
function indexInArray(a,b){
  for(var d=0; d<b.length; d++) {
    if( b[d] == a) {
      if( b[d] === a ) return d;
      console.log('comparison error:', a, b[d], typeof a, typeof b[d]);
    }
  }
  return -1;
}
indexInArray( null, [1, 2, 3, 0] );

sends -1.

Comment 4

[Martin Kleinhans]

@Loic: Well, yes.. Like I said, I have not managed to isolate the bug.
And besides, it would still send -1 if the bug occurs; just that it would also log the message :)

@Gijs: Unfortunately I currently can not provide a public link to the web app in question.
It is part of a banks online trading platform; access to the staging area is rather restricted.

I just tried 28.0a1 (2013-12-03), Issue is still there.

Comment 5

[:Gijs (he/him)]

(In reply to Martin Kleinhans from comment #4)
> @Loic: Well, yes.. Like I said, I have not managed to isolate the bug.
> And besides, it would still send -1 if the bug occurs; just that it would
> also log the message :)
> 
> @Gijs: Unfortunately I currently can not provide a public link to the web
> app in question.
> It is part of a banks online trading platform; access to the staging area is
> rather restricted.
> 
> I just tried 28.0a1 (2013-12-03), Issue is still there.

OK. If we can't reproduce and we don't have access to the place where you're reproducing, that makes this issue tricky to debug due to its intermittent nature.

If it's possible for you to determine when this broke, that would be very helpful. If you're comfortable on a commandline you could use http://mozilla.github.io/mozregression/. For more info, see e.g. https://quality.mozilla.org/docs/qmo-community/lesson-plans/how-to-bisect-find-the-culprit/ . But without more information about the circumstances under which this breaks, I'm not sure we can fix this.

I'll move it over to the right component in any case, but it's likely we'll need more to go on than what we know so far in order to fix this.

Comment 6

[Martin Kleinhans]

I just ran some additional test.
When disabling IonMonkey by setting "javascript.options.ion.chrome" to "false", the error does not occur anymore.

Comment 7

[Martin Kleinhans]

Sorry, copy and paste error. Ofc I meant "javascript.options.ion.content", not chrome.. which would have no effect on the content :)

Comment 8

[Jan de Mooij [:jandem]]

Looks like a duplicate of bug 940635...

Comment 9

[Loic]

Bug 940635 has been fixed in Nightly.

Martin, could you download and install Firefox 28 (see http://nightly.mozilla.org/) to confirm it's fixed on your side as you're the only user to reproduce the issue.

Comment 10

[Martin Kleinhans]

Sorry for the delay.
Seems like it was indeed fixed; I can not reproduce the bug any longer with the most recent nightly build!

Comment 11

[:Gijs (he/him)]

Resolving per comment #10. :-)

Comment 12

[Joshua Mitchell (Inactive)]

Issue is resolved - clearing old keywords - qa-wanted clean-up