Closed Bug 419878 Opened 16 years ago Closed 16 years ago

browser hang when try to save the change of the widgets of protopage.com

Categories

(Core :: JavaScript Engine, defect)

Product:
Core
Component:
JavaScript Engine
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
RESOLVED DUPLICATE of bug 418737

People

(Reporter: c.levin, Assigned: shaver)

References

(
URL
)

Details

(Keywords: perf, regression) 

User-Agent:       Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.4; en-US; rv:1.9b4pre) Gecko/2008022704 Minefield/3.0b3pre firefox
Build Identifier: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.4; en-US; rv:1.9b4pre) Gecko/2008022704 Minefield/3.0b3pre firefox

Im using protopage.com as my homepage, firefox 2 works fine, today when I tried to add some bookmarks to one of my bookmark widgets. Minefield hang when I finished adding and clicked "save", OSX beach ball show up, and never go away, have to force quit.

Reproducible: Always

Steps to Reproduce:
1.go to protopage.com
2.edit any bookmark widget, click save
3.browser hang
Actual Results:  
browser hang

Expected Results:  
editing penal go away, page load properly, browser works properly

I do not know if this is a problem with previous minefield 3 nightly since I haven't edited my homepage for quite a long time.
just to add, even when I click "cancel", or the "x" try to get rid of the editing penal, minefield froze as well.
also add. no problem with firefox 3 beta 3 on my Linux (EEE default, xandros), so it either a problem after beta 3, or a problem with mac version?
I see a hang for about 20 seconds when clicking Save, then it recovers.
Regression window: 2008-02-18-04 -- 2008-02-18-18
http://bonsai.mozilla.org/cvsquery.cgi?treeid=default&module=all&branch=HEAD&branchtype=match&dir=&file=&filetype=match&who=&whotype=match&sortby=Date&hours=2&date=explicit&mindate=2008-02-18+03%3A00&maxdate=2008-02-18+18%3A00&cvsroot=%2Fcvsroot
bug 322889?
Status: UNCONFIRMED → NEW
Ever confirmed: true
Flags: blocking-firefox3?
Keywords: perf, regression
OS: Mac OS X → All
Hardware: Macintosh → All
Version: unspecified → Trunk
It quite possible, I don't think I waited that long before I forced quit it.
Why do you think it's 322889?  Does the page have a lot of arrays on it?  Where does a profile point?
it hangs on my macbook for at least a minutes, during which CPU usage goes up crazy.
I stopped it in a debugger during the "hang" and it was always doing:
#0  js_LookupPropertyWithFlags
#1  js_LookupProperty
#2  array_lookupProperty
#3  CallEnumeratorNext
#4  js_CallIteratorNext
#5  js_Interpret

#0  array_enumerate
#1  CallEnumeratorNext
#2  js_CallIteratorNext
#3  js_Interpret

or something like that and looking at the checkins in the range above
it's mostly JS Engine stuff, so I just guessed at bug 322889...
Sorry, I don't know enough about JS Engine to know what to expect from
a profile.  FWIW, DumpJSStack() pointed to this URL:
http://protopage.com/web/js/a4.10.js
which seems to have a lot of arrays...
Yeah, that looks like 322889, then!  Taking.
Assignee: nobody → shaver
Component: General → JavaScript Engine
Flags: blocking-firefox3?
Product: Firefox → Core
QA Contact: general → general
I hit this on http://trulia.com/ entering a particular city and state.

(gdb) bt 10
#0  0x23012e53 in array_lookupProperty (cx=0x234a4310, obj=0x1e23f320, id=104381943, objp=0xbfffd024, propp=0xbfffd020) at jsarray.c:646
#1  0x2305c591 in js_CallIteratorNext (cx=0x234a4310, iterobj=0x1e23f360, rval=0xbfffd344) at jsiter.c:542
#2  0x230458be in js_Interpret (cx=0x234a4310, pc=0x21b4e5be "\v", result=0xbfffd47c) at jsinterp.c:3056
#3  0x2305b124 in js_Invoke (cx=0x234a4310, argc=1, vp=0x1d95024, flags=2) at jsinterp.c:1435
#4  0x2305b573 in js_InternalInvoke (cx=0x234a4310, obj=0x1e1903a0, fval=505671872, flags=0, argc=1, argv=0x1d95020, rval=0xbfffd560) at jsinterp.c:1491
#5  0x23006c0a in JS_CallFunctionValue (cx=0x234a4310, obj=0x1e1903a0, fval=505671872, argc=1, argv=0x1d95020, rval=0xbfffd560) at jsapi.c:4982
#6  0x2d94d0a1 in nsJSContext::CallEventHandler (this=0x234a3bb0, aTarget=0x243f7be0, aScope=0x1e3d3c20, aHandler=0x1e23f0c0, aargv=0x238c6620, arv=0xbfffd704) at nsJSEnvironment.cpp:1947
#7  0x2d9be50d in nsJSEventListener::HandleEvent (this=0x243f7d00, aEvent=0x2528ac40) at nsJSEventListener.cpp:248
#8  0x2d77d2d0 in nsEventListenerManager::HandleEventSubType (this=0x243f7ca0, aListenerStruct=0x243f7f08, aListener=0x243f7d00, aDOMEvent=0x2528ac40, aCurrentTarget=0x243f7be0, aPhaseFlags=2) at nsEventListenerManager.cpp:1082
#9  0x2d77db9e in nsEventListenerManager::HandleEvent (this=0x243f7ca0, aPresContext=0x23a33230, aEvent=0xbfffdaa4, aDOMEvent=0xbfffda28, aCurrentTarget=0x243f7be0, aFlags=2, aEventStatus=0xbfffda2c) at nsEventListenerManager.cpp:1184
(More stack frames follow...)
(gdb) up
#1  0x2305c591 in js_CallIteratorNext (cx=0x234a4310, iterobj=0x1e23f360, rval=0xbfffd344) at jsiter.c:542
542             if (!OBJ_LOOKUP_PROPERTY(cx, origobj, id, &obj2, &prop))
(gdb) p/x id
$1 = 0x638bdf7
(gdb) p *origobj
$2 = {
  map = 0x218dc160, 
  fslots = {511013056, 507329568, 588010913, 2, 3, -2147483647}, 
  dslots = 0x247d2f94
}
(gdb) p *(JSClass*)($.fslots[2]&~3)
$3 = {
  name = 0x230b4c50 "Array", 
  flags = 50331907, 
  addProperty = 0x23002f38 <JS_PropertyStub>, 
  delProperty = 0x23002f38 <JS_PropertyStub>, 
  getProperty = 0x23002f38 <JS_PropertyStub>, 
  setProperty = 0x23002f38 <JS_PropertyStub>, 
  enumerate = 0x23002f42 <JS_EnumerateStub>, 
  resolve = 0x23002f4c <JS_ResolveStub>, 
  convert = 0x23065fa0 <js_TryValueOf>, 
  finalize = 0x230133c6 <array_finalize>, 
  getObjectOps = 0x230135e4 <array_getObjectOps>, 
  checkAccess = 0, 
  call = 0, 
  construct = 0, 
  xdrObject = 0, 
  hasInstance = 0, 
  mark = 0, 
  reserveSlots = 0
}
(gdb) p/x origobj.dslots[-1]
$4 = 0x2
(gdb) fin
Run till exit from #1  0x2305c591 in js_CallIteratorNext (cx=0x234a4310, iterobj=0x1e23f360, rval=0xbfffd344) at jsiter.c:542
^C
Program received signal SIGINT, Interrupt.
0x2305c56c in js_CallIteratorNext (cx=0x234a4310, iterobj=0x1e23f360, rval=0xbfffd344) at jsiter.c:542
542             if (!OBJ_LOOKUP_PROPERTY(cx, origobj, id, &obj2, &prop))
(gdb) l
537                 }
538                 goto stop;
539             }
540
541             /* Skip properties not in obj when looking from origobj. */
542             if (!OBJ_LOOKUP_PROPERTY(cx, origobj, id, &obj2, &prop))
543                 return JS_FALSE;
544             if (!prop)
545                 goto restart;
546             OBJ_DROP_PROPERTY(cx, obj2, prop);
(gdb) l 500
495                 if (!xmlops->enumerateValues(cx, obj, JSENUMERATE_NEXT, &state,
496                                              &id, rval)) {
497                     return JS_FALSE;
498                 }
499             } else {
500                 if (!OBJ_ENUMERATE(cx, obj, JSENUMERATE_NEXT, &state, &id))
501                     return JS_FALSE;
502             }
503             STOBJ_SET_SLOT(iterobj, JSSLOT_ITER_STATE, state);
504             if (JSVAL_IS_NULL(state))
(gdb) 
505                 goto stop;
506         } else
507     #endif
508         {
509           restart:
510             if (!OBJ_ENUMERATE(cx, obj, JSENUMERATE_NEXT, &state, &id))
511                 return JS_FALSE;
512
513             STOBJ_SET_SLOT(iterobj, JSSLOT_ITER_STATE, state);
514             if (JSVAL_IS_NULL(state)) {
(gdb) 
515     #if JS_HAS_XML_SUPPORT
516                 if (OBJECT_IS_XML(cx, obj)) {
517                     /*
518                      * We just finished enumerating an XML obj that is present on
519                      * the prototype chain of a non-XML origobj. Stop further
520                      * prototype chain searches because XML objects don't
521                      * enumerate prototypes.
522                      */
523                     JS_ASSERT(origobj != obj);
524                     JS_ASSERT(!OBJECT_IS_XML(cx, origobj));
(gdb) 
525                 } else
526     #endif
527                 {
528                     obj = OBJ_GET_PROTO(cx, obj);
529                     if (obj) {
530                         STOBJ_SET_PARENT(iterobj, obj);
531                         if (!OBJ_ENUMERATE(cx, obj, JSENUMERATE_INIT, &state, NULL))
532                             return JS_FALSE;
533                         STOBJ_SET_SLOT(iterobj, JSSLOT_ITER_STATE, state);
534                         if (!JSVAL_IS_NULL(state))
(gdb) 
535                             goto restart;
536                     }
537                 }
538                 goto stop;
539             }
540
541             /* Skip properties not in obj when looking from origobj. */
542             if (!OBJ_LOOKUP_PROPERTY(cx, origobj, id, &obj2, &prop))
543                 return JS_FALSE;
544             if (!prop)
(gdb) 
545                 goto restart;
546             OBJ_DROP_PROPERTY(cx, obj2, prop);
547
548             /*
549              * If the id was found in a prototype object or an unrelated object
550              * (specifically, not in an inner object for obj), skip it. This step
551              * means that all OBJ_LOOKUP_PROPERTY implementations must return an
552              * object further along on the prototype chain, or else possibly an
553              * object returned by the JSExtendedClass.outerObject optional hook.
554              */

/be
Flags: blocking1.9?
Brendan says this is a dupe of 418737.
Status: NEW → RESOLVED
Closed: 16 years ago
Resolution: --- → DUPLICATE
You need to log in before you can comment on or make changes to this bug.