536943 - Namoroka does not response for a while and returns wrong result on certain site.

Status: RESOLVED DUPLICATE of bug 532568

(Core :: JavaScript Engine, defect)

Description

[Alice0775 White]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2b6pre) Gecko/20091227 Firefox/3.5.5
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2b6pre) Gecko/20091227 Namoroka/3.6b6pre ID:20091227053009

On Online Javascript beautifer site.
When i click Beautify button, The browser does not response for a while. and returns wrong result.


Reproducible: Always

Steps to Reproduce:
1.Open URL ( http://jsbeautifier.org/  )
2.Click Beautify button several time.

[Alternative STR]
1.Open URL ( http://jsbeautifier.org/  )
2.Input the Following CODE in the text box.

function getElementsByXPath(xpath, node) {
var nodesSnapshot = getXPathResult(xpath, node,
        XPathResult.ORDERED_NODE_SNAPSHOT_TYPE);
var data = [];
for (var i = 0; i < nodesSnapshot.snapshotLength; i++) {
data.push(nodesSnapshot.snapshotItem(i));
}
return data;
}

2.Click Beautify button.

Actual Results:  
The browser is hung up for a while.
And returns wrong results.


Expected Results:  
The browser should not be hung up.


This issue happens on Minefield 3.7a1pre.
Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.3a1pre) Gecko/20091228 Minefield/3.7a1pre ID:20091228003819

However,the issue does not happen on Shretoko.

Comment 1

[Alice0775 White]

Regression Range:

Works fine:
http://hg.mozilla.org/releases/mozilla-1.9.2/rev/7f7565e06255
Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2b6pre) Gecko/20091219 Namoroka/3.6b6pre ID:20091219054015

Broken:
http://hg.mozilla.org/releases/mozilla-1.9.2/rev/040104b681d8
Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2b6pre) Gecko/20091220 Namoroka/3.6b6pre ID:20091220052941

PushLog:
http://hg.mozilla.org/releases/mozilla-1.9.2/pushloghtml?fromchange=7f7565e06255&tochange=040104b681d8

Comment 2

[Alice0775 White]

Regression Range in trunk:

Works fine:
http://hg.mozilla.org/mozilla-central/rev/65c1582465ef
Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.3a1pre) Gecko/20091204 Minefield/3.7a1pre ID:20091204044732

Broken:
http://hg.mozilla.org/mozilla-central/rev/d040e38c4107
Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.3a1pre) Gecko/20091205 Minefield/3.7a1pre ID:20091205042811

PushLog:
http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=65c1582465ef&tochange=d040e38c4107

Comment 3

[Kevin Brosnan]

I see this on Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.3a1pre) Gecko/20091227 Minefield/3.7a1pre

Comment 4

[David Mandelin [:dmandelin]]

The exact changeset where this regression occurred was:

changeset:   33409:040104b681d8
user:        Boris Zbarsky <[e-mail]>
date:        Thu Dec 03 22:43:13 2009 -0500
summary:     Bug 532823 followup.  Fix where we add the 3+fp->argc.  r=brendan

I think this is actually a dup of bug 532568. I also think in the test case for this bug, we are reading wrong values in both the unregressed and the regressed version, but the unregressed wrong value happens not to matter in the test case.

Comment 5

[David Mandelin [:dmandelin]]

The patch for bug 532568 fixes this on trunk.