987644 - Object property undefined inconsistency :o

Status: RESOLVED DUPLICATE of bug 991457

(Core :: JavaScript Engine: JIT, defect)

Description

[Pierre Gotab]

User Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:27.0) Gecko/20100101 Firefox/27.0 (Beta/Release)
Build ID: 20140218140359

Steps to reproduce:

I have this JS code somewhere in my app:

if(!obs[s] || !obs[s][w]) return false;

I didn't do some esoteric JS things. obs is a standard plain object with no prototype or accessors, that looks like {"5":{}, "6":{}, "7":{} ...} ; s is a standard Number with a value of 4 (and also w).


Actual results:

That raises the exception:

TypeError: obs[s] is undefined


Expected results:

No exception... I guess ;)

Note that with Firebug "Script" pannel opened, the error does not raise. Like if the introspection process of Firebug fixed the bug (this is the first time I see Firebug fixing a Firefox bug :p - a firebug contributor points out the JIT compiler).

There is much more info on the former issue on Firebug bugtracker : https://code.google.com/p/fbug/issues/detail?id=7279

I'm on FF 27.0.1 canonical build for Ubuntu 12.0.4 but FYI this bug is reproducible using FF 28.0 on Ubuntu 13.10, but not on FF 27.0.1 on Windows 7

Comment 1

[Boris Zbarsky [:bzbarsky]]

Pierre, this is hard to do anything about this bug without having access to the exact JS causing the problem.  Is there a link to a page that does that, or can you attach the relevant HTML/JS to this bug report using https://bugzilla.mozilla.org/attachment.cgi?bugid=987644&action=enter ?

Comment 2

[Pierre Gotab]

Attachment: The original code

Look for "// firefox bug" comments in src/game.js:555 and invert them. Then run (like 4-5 times if needed) the game, to make it fail:

TypeError: obs[s] is undefined
if(!obs[s][w]) return false;

Comment 3

[Jan de Mooij [:jandem]]

I don't have time to look into this this week. The TypeError mentioned in comment 0 on this line:

    if(!obs[s] || !obs[s][w]) return false;

Vaguely reminded me of bug 953164. That one didn't land before Firefox 30 and this is in 27, but maybe it's similar code. Hannes needinfo from you because of this, but feel free to reassign if it's something else.

Comment 4

[Jan de Mooij [:jandem]]

This looks a lot like bug 991457, FWIW. Pretty sure it's the same bug, would be great if somebody could verify this.

Comment 5

[Hannes Verschore [:h4writer]]

I thought the same, when I saw the review request. I'm currently verifying it.