Bug 18961 - SQUIRRELFISH: Gmail doesn't load
Summary: SQUIRRELFISH: Gmail doesn't load
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: JavaScriptCore (show other bugs)
Version: 528+ (Nightly build)
Hardware: All OS X 10.5
: P2 Normal
Assignee: Cameron Zwarich (cpst)
URL: http://www.gmail.com/
Keywords:
Depends on:
Blocks:
 
Reported: 2008-05-09 02:11 PDT by Cameron Zwarich (cpst)
Modified: 2008-05-11 04:42 PDT (History)
3 users (show)

See Also:


Attachments
Stack trace (10.05 KB, text/plain)
2008-05-09 02:58 PDT, Cameron Zwarich (cpst)
no flags Details
Proposed patch (4.48 KB, patch)
2008-05-11 03:37 PDT, Cameron Zwarich (cpst)
oliver: review+
Details | Formatted Diff | Diff
Proposed patch with test (5.02 KB, patch)
2008-05-11 04:04 PDT, Cameron Zwarich (cpst)
oliver: review+
Details | Formatted Diff | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Cameron Zwarich (cpst) 2008-05-09 02:11:37 PDT
Loading Gmail fails with some undefined value exceptions. I'm going to try to debug this.
Comment 1 Cameron Zwarich (cpst) 2008-05-09 02:58:52 PDT
Created attachment 21033 [details]
Stack trace

Here's a stack trace from the first undefined value exception.
Comment 2 Cameron Zwarich (cpst) 2008-05-09 03:02:50 PDT
I asked gdb to print the bytecode that threw the exception. Here it is:

6 instructions; 84 bytes at 0x1344e460; 1 locals (1 parameters); 15 temporaries

[   0] resolve		 tr0, a(@id0)
[   3] get_by_id	 tr1, tr0, apply(@id1)
[   7] resolve		 tr13, f(@id2)
[  10] resolve		 tr14, arguments(@id3)
[  13] call		 tr0, tr1, tr0, 12, 3
[  19] ret		 tr0

Identifiers:
  id0 = a
  id1 = apply
  id2 = f
  id3 = arguments

Comment 3 Cameron Zwarich (cpst) 2008-05-09 03:12:52 PDT
The value returned by the first resolve is bogus, causing the exception to be thrown when calling toObject() on the base in get_by_id. I'll try to see what is up with that resolve.
Comment 4 Cameron Zwarich (cpst) 2008-05-11 03:01:07 PDT
Google Reader had the least amount of JS out of all of the affected Google products, so I hacked up enough of a local copy to reproduce the error. Using a decent amount of alert debugging, I managed to find the problem. Consider this code:

var o = { };
o = o.Nothere || o;
print(o == undefined);

Trunk prints false, SquirrelFish prints true.
Comment 5 Cameron Zwarich (cpst) 2008-05-11 03:04:35 PDT
Here is the bytecode for my example:

[   0] load		 lr2, undefined(@k0)		
[   3] load		 tr0, undefined(@k0)		
[   6] new_object	 lr2
[   8] get_by_id	 lr2, lr2, Nothere(@id0)
[  12] jtrue		 lr2, 1(->15)
[  15] mov		 tr0, lr2
[  18] resolve_func	 tr0, tr1, print(@id1)
[  22] resolve		 tr14, undefined(@id2)
[  25] eq		 tr13, lr2, tr14
[  29] call		 tr0, tr1, tr0, 12, 2
[  35] end		 tr0

The problem is that LogicalAndNode is using the final destination as a temporary.
Comment 6 Cameron Zwarich (cpst) 2008-05-11 03:05:33 PDT
> The problem is that LogicalAndNode is using the final destination as a
temporary.

Oops, I meant LogicalOrNode, but the problem is in both.
Comment 7 Cameron Zwarich (cpst) 2008-05-11 03:37:49 PDT
Created attachment 21067 [details]
Proposed patch
Comment 8 Oliver Hunt 2008-05-11 03:39:57 PDT
Comment on attachment 21067 [details]
Proposed patch

r=me

woo!
Comment 9 Cameron Zwarich (cpst) 2008-05-11 04:04:47 PDT
Created attachment 21068 [details]
Proposed patch with test

I accidentally didn't add the test to the last patch, and the description was bad. Here's a new patch.
Comment 10 Cameron Zwarich (cpst) 2008-05-11 04:42:56 PDT
Landed in r33031.