951970 - Sencha Ext JS components unresponsive when IonMonkey enabled

Status: RESOLVED DUPLICATE of bug 955850

(Core :: JavaScript Engine: JIT, defect)

Description

[Mike Nicholls]

Attachment: Testcase

User Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:27.0) Gecko/20100101 Firefox/27.0 (Beta/Release)
Build ID: 20131216183647

Steps to reproduce:

1.) Ensure IonMonkey is enabled (javascript.options.ion.content = true)
2.) Open the attached testcase
3.) Click on the tab headings



Actual results:

Nothing happens - no errors are logged to the console.


Expected results:

Tabs should switch, as they do in Firefox 26, or when javascript.options.ion.content is set to false.  Testing with nightly builds indicated that the regression might be within this range:
http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=8f805d3ef377&tochange=6b92cb377496

Comment 1

[Boris Zbarsky [:bzbarsky]]

I can confirm that an opt build from rev 6b92cb377496 shows the bug.  A debug build does not.

Comment 2

[Boris Zbarsky [:bzbarsky]]

Actually, my opt build (on Mac) also doesn't show the bug.  A nightly build from the same rev does.  :(

Comment 3

[:Ms2ger (he/him; ⌚ UTC+1/+2)]

Confirm the bug in a Linux x64 nightly from n.m.o built from http://hg.mozilla.org/mozilla-central/rev/862cb6a1cc88.

Comment 4

[:Ms2ger (he/him; ⌚ UTC+1/+2)]

Reproduced the bug with:
  http://ftp.mozilla.org/pub/mozilla.org/firefox/tinderbox-builds/mozilla-central-linux64/1387428606/
  http://ftp.mozilla.org/pub/mozilla.org/firefox/tinderbox-builds/mozilla-central-linux64-pgo/1387440002/
Could not reproduce the bug with:
  http://ftp.mozilla.org/pub/mozilla.org/firefox/tinderbox-builds/mozilla-central-linux64-debug/1387428606/

all from https://tbpl.mozilla.org/?rev=7d120481a6ae

Comment 5

[Jan de Mooij [:jandem]]

I can repro this on OS X with a nightly and local opt build (m-i tip, e2b59ec2df63).

I'll do some more testing.

Comment 6

[Jan de Mooij [:jandem]]

If I add the following code to IonBuilder::jsop_setarg, after the "if (info().argsObjAliasesFormals()) {" statement, the website works fine:

    if (info().hasArguments())
        return abort("..");

This has the same effect as backing out bug 921120 IIUC. Kannan is looking into some other regressions caused by bug 921120 so it's possible this is the same issue.

Comment 7

[bhavana bajaj [:bajaj]]

Tracking as its a fallout from 921120 and passing onto Kannan for further input.

Comment 8

[Kannan Vijayan [:djvj]]

Does this still reproduce?  I'm building 32-bit on OSX right now to try to reproduce, but I'm suspecting that this is also fixed by bug 951528.  Shows up only on 32-bit, same regressor.  High likelyhood of being the same bug.

Comment 9

[Kannan Vijayan [:djvj]]

Nope, this is a dup of bug 955850.  Stack trace basically nails it down.