604892 - Hang in ip-utilities.js?ver=9.1.191.19:342 @ mozjs!str_substr (e.g. University of Toronto Website)

Status: RESOLVED WORKSFORME

(Core :: JavaScript Engine, defect)

Description

[Barry Marshall]

User-Agent:       Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_6_4; en-us) AppleWebKit/533.18.1 (KHTML, like Gecko) Version/5.0.2 Safari/533.18.5
Build Identifier: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:2.0b8pre) Gecko/20101016 Firefox/4.0b8pre

This bug is being filed under OSX because I've got Shark access, but I can recreate variations on this problem with a current WinXP Minefield as well.  I can also recreate this problem with 3.6.10.

This page seems to have some sort of Javascript coding problem, which causes the browser to become unresponsive after the "Stop script" prompt has been confirmed once already.

Reproducible: Always

Steps to Reproduce:
1.Install current Minefield or Firefox 3.6.10
2.Navigate to U of T website
3.Mouse over and hover over Graduate Students link - don't click.   Observe the Mac beachball.  The Graduate Students link background will eventually turn light blue.  
4.Wait for the "unresponsive Javascript" popup to appear.
5.Don't use the mouse.  Using the keyboard, cancel the Javascript code.
6.Mouse over and hover over the "Teaching topics" link.    No beachball, but the background doesn't change.  Don't click.
7.Mouse over and hover over the Graduate Students link
8.Observe the Mac beachball
Actual Results:  
The unresponsive Javascript prompt does not appear again.

The rest of the Firefox UI becomes locked and can not be navigated away from.

Expected Results:  
The Unresponsive Javascript prompt should reappear.

Safari's equivalent unresponsive message always appears and the UI doesn't get locked up.


	58.3%	58.3%	XUL	str_substr(JSContext*, unsigned int, js::Value*)
	0.0%	4.2%	XUL	 js::ExecuteTree(JSContext*, js::TreeFragment*, unsigned int&, js::VMSideExit**, js::VMSideExit**)
	11.4%	11.4%	libSystem.B.dylib	floor
	7.0%	7.0%	libSystem.B.dylib	finite
	0.0%	4.2%	XUL	 str_substr(JSContext*, unsigned int, js::Value*)
	2.8%	2.8%	XUL	dyld_stub_floor
	2.8%	2.8%	XUL	dyld_stub_finite
	0.8%	0.8%	Unknown Library	0x1175becca [unknown]
	0.0%	0.8%	XUL	 js::ExecuteTree(JSContext*, js::TreeFragment*, unsigned int&, js::VMSideExit**, js::VMSideExit**)
	0.8%	0.8%	Unknown Library	0x1175bec85 [unknown]
	0.0%	0.8%	XUL	 js::ExecuteTree(JSContext*, js::TreeFragment*, unsigned int&, js::VMSideExit**, js::VMSideExit**)
	0.8%	0.8%	Unknown Library	0x1175bed04 [unknown]
	0.0%	0.8%	XUL	 js::ExecuteTree(JSContext*, js::TreeFragment*, unsigned int&, js::VMSideExit**, js::VMSideExit**)
	0.8%	0.8%	Unknown Library	0x1175bed2c [unknown]
	0.0%	0.8%	XUL	 js::ExecuteTree(JSContext*, js::TreeFragment*, unsigned int&, js::VMSideExit**, js::VMSideExit**)
	0.8%	0.8%	Unknown Library	0x1175bece2 [unknown]
	0.0%	0.8%	XUL	 js::ExecuteTree(JSContext*, js::TreeFragment*, unsigned int&, js::VMSideExit**, js::VMSideExit**)
	0.7%	0.7%	Unknown Library	0x1175bec02 [unknown]
	0.0%	0.7%	XUL	 js::ExecuteTree(JSContext*, js::TreeFragment*, unsigned int&, js::VMSideExit**, js::VMSideExit**)
	0.7%	0.7%	Unknown Library	0x1175bed3f [unknown]
	0.0%	0.7%	XUL	 js::ExecuteTree(JSContext*, js::TreeFragment*, unsigned int&, js::VMSideExit**, js::VMSideExit**)
	0.7%	0.7%	Unknown Library	0x1175bed76 [unknown]
	0.0%	0.7%	XUL	 js::ExecuteTree(JSContext*, js::TreeFragment*, unsigned int&, js::VMSideExit**, js::VMSideExit**)
	0.7%	0.7%	Unknown Library	0x1175bed18 [unknown]
	0.0%	0.7%	XUL	 js::ExecuteTree(JSContext*, js::TreeFragment*, unsigned int&, js::VMSideExit**, js::VMSideExit**)
	0.7%	0.7%	Unknown Library	0x1175becb3 [unknown]
	0.0%	0.7%	XUL	 js::ExecuteTree(JSContext*, js::TreeFragment*, unsigned int&, js::VMSideExit**, js::VMSideExit**)
	0.7%	0.7%	Unknown Library	0x1175becb8 [unknown]
	0.0%	0.7%	XUL	 js::ExecuteTree(JSContext*, js::TreeFragment*, unsigned int&, js::VMSideExit**, js::VMSideExit**)
	0.7%	0.7%	Unknown Library	0x1175bec9d [unknown]
	0.0%	0.7%	XUL	 js::ExecuteTree(JSContext*, js::TreeFragment*, unsigned int&, js::VMSideExit**, js::VMSideExit**)
	0.7%	0.7%	Unknown Library	0x1175bebdd [unknown]
	0.0%	0.7%	XUL	 js::ExecuteTree(JSContext*, js::TreeFragment*, unsigned int&, js::VMSideExit**, js::VMSideExit**)
	0.7%	0.7%	Unknown Library	0x1175becf1 [unknown]
	0.0%	0.7%	XUL	 js::ExecuteTree(JSContext*, js::TreeFragment*, unsigned int&, js::VMSideExit**, js::VMSideExit**)
	0.7%	0.7%	Unknown Library	0x1175bed64 [unknown]
	0.0%	0.7%	XUL	 js::ExecuteTree(JSContext*, js::TreeFragment*, unsigned int&, js::VMSideExit**, js::VMSideExit**)
	0.7%	0.7%	Unknown Library	0x1175bebb6 [unknown]
	0.0%	0.7%	XUL	 js::ExecuteTree(JSContext*, js::TreeFragment*, unsigned int&, js::VMSideExit**, js::VMSideExit**)
	0.7%	0.7%	Unknown Library	0x1175bec40 [unknown]
	0.0%	0.7%	XUL	 js::ExecuteTree(JSContext*, js::TreeFragment*, unsigned int&, js::VMSideExit**, js::VMSideExit**)
	0.7%	0.7%	Unknown Library	0x1175bed51 [unknown]
	0.0%	0.7%	XUL	 js::ExecuteTree(JSContext*, js::TreeFragment*, unsigned int&, js::VMSideExit**, js::VMSideExit**)
	0.7%	0.7%	Unknown Library	0x1175bec71 [unknown]
	0.0%	0.7%	XUL	 js::ExecuteTree(JSContext*, js::TreeFragment*, unsigned int&, js::VMSideExit**, js::VMSideExit**)
	0.7%	0.7%	Unknown Library	0x1175bebef [unknown]
	0.0%	0.7%	XUL	 js::ExecuteTree(JSContext*, js::TreeFragment*, unsigned int&, js::VMSideExit**, js::VMSideExit**)
	0.7%	0.7%	Unknown Library	0x1175bec2e [unknown]
	0.0%	0.7%	XUL	 js::ExecuteTree(JSContext*, js::TreeFragment*, unsigned int&, js::VMSideExit**, js::VMSideExit**)
	0.6%	0.6%	Unknown Library	0x1175bebcb [unknown]
	0.0%	0.6%	XUL	 js::ExecuteTree(JSContext*, js::TreeFragment*, unsigned int&, js::VMSideExit**, js::VMSideExit**)
	0.6%	0.6%	Unknown Library	0x1175bec5c [unknown]
	0.0%	0.6%	XUL	 js::ExecuteTree(JSContext*, js::TreeFragment*, unsigned int&, js::VMSideExit**, js::VMSideExit**)
	0.6%	0.6%	Unknown Library	0x1175bec16 [unknown]
	0.0%	0.6%	XUL	 js::ExecuteTree(JSContext*, js::TreeFragment*, unsigned int&, js::VMSideExit**, js::VMSideExit**)
	0.6%	0.6%	Unknown Library	0x1175beba3 [unknown]
	0.0%	0.6%	XUL	 js::ExecuteTree(JSContext*, js::TreeFragment*, unsigned int&, js::VMSideExit**, js::VMSideExit**)
	0.0%	0.0%	XUL	XPCJSRuntime::WatchdogMain(void*)
	0.0%	0.0%	Unknown Library	 0x1155fccf8 [18.5KB]
	0.0%	0.0%	Unknown Library	  0x1155fccf8 [18.5KB]
	0.0%	0.0%	mach_kernel	__semwait_signal_nocancel
	0.0%	0.0%	Unknown Library	0x1175becbb [unknown]
	0.0%	0.0%	XUL	 js::ExecuteTree(JSContext*, js::TreeFragment*, unsigned int&, js::VMSideExit**, js::VMSideExit**)


Note that libSystem.B.dylib	floor had an explanation beside it in Shark.

I tried to follow http://beltzner.ca/mike/2010/08/05/how-to-file-a-bug-on-a-firefox-hang-on-osx to get a stack trace, but I guess regular Nightlies don't have smybols?  I'm not a Mac person, so may not have the right terminology here.  At any rate, the end of a slew of warning the stack trace says:

....... done
0x00007fff843d0e46 in finite ()
(gdb) bt
#0  0x00007fff843d0e46 in finite ()
#1  0x0000000100fa999a in str_substr ()
#2  0xc1f2dbdce0300000 in ?? ()
(gdb) detach

... so I'll see if I can find a proper debug build to download.

Comment 1

[(mostly gone) XtC4UaLL [:xtc4uall]]

This is what i get with WinDBG (on WinXP) + a Build built from http://hg.mozilla.org/mozilla-central/rev/397c458b40a4:

0  Id: 954.13dc Suspend: 1 Teb: 7ffde000 Unfrozen
ChildEBP RetAddr  
0012acd0 050aff59 mozjs!str_substr(struct JSContext * cx = 0x05cc8920, unsigned int argc = 2, class js::Value * vp = 0x0012acf0)+0x70 [e:\builds\moz2_slave\mozilla-central-win32-nightly\build\js\src\jsstr.cpp @ 2722]
WARNING: Frame IP not in any known module. Following frames may be wrong.
0012ad20 004f4fd8 <Unloaded_Ed20.dll>+0x50aff58
0012ada0 005052d9 mozjs!js::ExecuteTree(struct JSContext * cx = 0x0012acf0, struct js::TreeFragment * f = 0x036f6534, unsigned int * inlineCallCount = 0x0a31ba0f, struct js::VMSideExit ** innermostNestedGuardp = 0x00000000, struct js::VMSideExit ** lrp = 0x050afe76)+0x228 [e:\builds\moz2_slave\mozilla-central-win32-nightly\build\js\src\jstracer.cpp @ 6706]
0012add8 00547821 mozjs!js::MonitorTracePoint(struct JSContext * cx = 0x05cc8920, unsigned int * inlineCallCount = 0x0012ae00, bool * blacklist = 0x0012adff)+0x199 [e:\builds\moz2_slave\mozilla-central-win32-nightly\build\js\src\jstracer.cpp @ 16519]
0012ae00 00547939 mozjs!RunTracer(struct js::VMFrame * f = 0x0012acf0, struct js::mjit::ic::MICInfo * mic = 0x05cc8240)+0x51 [e:\builds\moz2_slave\mozilla-central-win32-nightly\build\js\src\methodjit\invokehelpers.cpp @ 820]
0012ae4c 00517de3 mozjs!js::mjit::stubs::InvokeTracer(struct js::VMFrame * f = 0xf77f2770, struct js::mjit::ic::MICInfo * mic = 0xf77f2770)+0x9 [e:\builds\moz2_slave\mozilla-central-win32-nightly\build\js\src\methodjit\invokehelpers.cpp @ 917]
0012ae6c 00517f0b mozjs!js::mjit::EnterMethodJIT(struct JSContext * cx = 0x00517de3, struct JSStackFrame * fp = 0x005a44c8, void * code = 0xf77f2770, class js::Value * stackLimit = 0xffff0001)+0x23 [e:\builds\moz2_slave\mozilla-central-win32-nightly\build\js\src\methodjit\methodjit.cpp @ 742]
0012ae84 00517f8e mozjs!CheckStackAndEnterMethodJIT(struct JSContext * cx = 0x05cc8240, struct JSStackFrame * fp = 0x00002000, void * code = 0x000020b9)+0xfb [e:\builds\moz2_slave\mozilla-central-win32-nightly\build\js\src\methodjit\methodjit.cpp @ 767]
0012aea0 00469560 mozjs!js::mjit::JaegerShot(struct JSContext * cx = 0x05cc8920)+0x6e [e:\builds\moz2_slave\mozilla-central-win32-nightly\build\js\src\methodjit\methodjit.cpp @ 784]
0012aeb4 0046992d mozjs!js::RunScript(struct JSContext * cx = 0x05cc8920, struct JSScript * script = 0x0a31b980, struct JSStackFrame * fp = 0x02c103a0)+0x80 [e:\builds\moz2_slave\mozilla-central-win32-nightly\build\js\src\jsinterp.cpp @ 635]
0012af0c 0045be55 mozjs!js::Invoke(struct JSContext * cx = 0x05cc8920, struct js::CallArgs * argsRef = 0x0012af4c, unsigned long flags = 0)+0x3ad [e:\builds\moz2_slave\mozilla-central-win32-nightly\build\js\src\jsinterp.cpp @ 747]
0012af64 0053e6ae mozjs!js_fun_call(struct JSContext * cx = 0x05cc8920, unsigned int argc = 0, class js::Value * vp = 0x02c10378)+0x235 [e:\builds\moz2_slave\mozilla-central-win32-nightly\build\js\src\jsfun.cpp @ 2249]
0012b3e4 0053efb6 mozjs!CallCompiler::generateNativeStub(void)+0xae [e:\builds\moz2_slave\mozilla-central-win32-nightly\build\js\src\methodjit\monoic.cpp @ 435]
0012b424 1010aee0 mozjs!js::mjit::ic::NativeCall(struct js::VMFrame * f = 0xf77f2770, struct js::mjit::ic::CallICInfo * ic = 0xf77f2770)+0x46 [e:\builds\moz2_slave\mozilla-central-win32-nightly\build\js\src\methodjit\monoic.cpp @ 659]
0012b428 10351561 xul!nsRuleNode::GetStyleSVGReset(class nsStyleContext * aContext = 0x02c10270, int aComputeData = 1225992)+0x10 [e:\builds\moz2_slave\mozilla-central-win32-nightly\build\layout\style\nsstylestructlist.h @ 147]
0012b45c 00517de3 xul!nsStyleContext::DoGetStyleSVGReset(int aComputeData = 46203504)+0x21 [e:\builds\moz2_slave\mozilla-central-win32-nightly\build\layout\style\nsstylestructlist.h @ 147]
0012b47c 00517f0b mozjs!js::mjit::EnterMethodJIT(struct JSContext * cx = 0x02c10270, struct JSStackFrame * fp = 0x005a44c8, void * code = 0xf77f2770, class js::Value * stackLimit = 0xffff0001)+0x23 [e:\builds\moz2_slave\mozilla-central-win32-nightly\build\js\src\methodjit\methodjit.cpp @ 742]
0012b494 00517f8e mozjs!CheckStackAndEnterMethodJIT(struct JSContext * cx = 0x05cc8240, struct JSStackFrame * fp = 0x00002000, void * code = 0x000020b9)+0xfb [e:\builds\moz2_slave\mozilla-central-win32-nightly\build\js\src\methodjit\methodjit.cpp @ 767]
0012b4b0 00469560 mozjs!js::mjit::JaegerShot(struct JSContext * cx = 0x05cc8920)+0x6e [e:\builds\moz2_slave\mozilla-central-win32-nightly\build\js\src\methodjit\methodjit.cpp @ 784]
0012b4c4 0046992d mozjs!js::RunScript(struct JSContext * cx = 0x05cc8920, struct JSScript * script = 0x0947aef0, struct JSStackFrame * fp = 0x02c10270)+0x80 [e:\builds\moz2_slave\mozilla-central-win32-nightly\build\js\src\jsinterp.cpp @ 635]

The "Unresponsive Script Warning" points to http://www.teaching.utoronto.ca/scripts/ip-utilities.js?ver=9.1.191.19:342

{
var b=0;
var e=this.length-1;
while(this.substr(b,1) == " ") b++;
while(this.substr(e,1) == " ") e--;
return this.substring(b,e+1);
};

Comment 2

[Wayne Mery (:wsmwk)]

 Barry, xtc, does this still reproduce?

Comment 3

[(mostly gone) XtC4UaLL [:xtc4uall]]

I'm not able to repro in Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.28) Gecko/20120306 Firefox/3.6.28 ID:20120306064154
nor Mozilla/5.0 (Windows NT 6.1; WOW64; rv:18.0) Gecko/18.0 Firefox/18.0 ID:20120828030555

but I presume the Site and my actual used System (CPU-wise) changed too much since the Report got filed.
The Script itself (http://www.teaching.utoronto.ca/scripts/ip-utilities.js?ver=9.1.191.19:342) is still linked though.

Comment 4

[Barry Marshall]

Yeah, I can't get this to happen any more either.  Let's just close it up.