Build Identifier: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:2.0b8pre) Gecko/20101108 Firefox/4.0b8pre ID:20101108043306 Detail of search result of hotel does not show on www.holidayinn.com An error message from the site. Detail information does not show. Reproducible: Always Steps to Reproduce: 1. Start Minefield with New profile 2. Go http://www.holidayinn.com/ ( http://www.holidayinn.com/hotels/us/en/reservation ) 3. Input "PHILADELPHIA-HISTORIC DISTRICT" 4. Click "FIND A HOTEL" button 5. Click a link "Holiday Inn : PHILADELPHIA-HISTORIC DISTRICT" under map OR 2. Go http://www.holidayinn.com/hotels/us/en/philadelphia/phlim/hoteldetail Actual Results: An error message from the site. Detail information does not show. Expected Results: Detail information should show. Regression window(cached hourly): Works: http://hg.mozilla.org/mozilla-central/rev/0c9ae492cf5f Mozilla/5.0 (Windows NT 6.1; WOW64; rv:2.0b8pre) Gecko/20101013 Firefox/4.0b8pre ID:20101013163957 Fails: http://hg.mozilla.org/mozilla-central/rev/4c146ed860b3 Mozilla/5.0 (Windows NT 6.1; WOW64; rv:2.0b8pre) Gecko/20101014 Firefox/4.0b8pre ID:20101014021111 Push log: http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=0c9ae492cf5f&tochange=4c146ed860b3 In local build: Build from df2e888625df : Fails Build from e613a2251de9 : Fails Build from c45685276ce5 : Fails Build from 87e44effa997 : Works: Regressed by c45685276ce5 Brian Hackett — Flexible length JSObject, bug 584917. r=brendan,igor

I can reproduce this on Windows and OS X, but it is fixed if I disable javascript.options.methodjit.content. Other than that the error is pretty opaque (nothing in the error console); I'll poke around and try to identify a method JIT change in 584917 which caused this.

If I change the method JIT PICs so that the slots pointer is always used (no inline slot accesses) then things work. It looks like the invariant that objects with the same shape use their inline slots consistently is being broken somewhere, will add asserts to try and catch this.

This should fix the page (still building browser). The problem is that array slowification can break the fixed slots invariant, confusing JM and TM (should only lead to lost updates, not crashing). This changes slowification to produce an object more like other natives --- use fixed slots right, and pack the array to remove holes.

Fix outdated comment.

Comment on attachment 489514 [details] [diff] [review] patch >+ /* >+ * Create new properties pointing to existing elements. Pack the array to French spacing plea/whine/nag. >+ * remove holes, so that shapes use continuous slots (as for other objects). Ultra-super-duper-nit: s/continuous/successive/, or adjacent. >+ ClearValueRange(slots + next, this->capacity - next, false); Yikes -- was there another bug without this? Can you write a test for it? r=me with nits picked. /be

(In reply to comment #5) > >+ ClearValueRange(slots + next, this->capacity - next, false); > > Yikes -- was there another bug without this? Can you write a test for it? No, this is necessary due to using successive slots for properties of the slow array. Previously all elements in the buffer were set to undefined if holes, otherwise added to the array.

When landing, please add a comment like this: http://hg.mozilla.org/tracemonkey/rev/bc000c1509ac

This caused a 6ms/14ms regression on AWFY.

This regression seems to have been fake, did not show up again after cycling AWFY.

http://www.holidayinn.com/hotels/us/en/philadelphia/phlim/hoteldetail now loads fine on Mozilla/5.0 (Windows NT 6.0; rv:2.0b8pre) Gecko/20101123 Firefox/4.0b8pre ID:20101123045657 Thanks to whomever fixed this =)