596461 - JM: 100 % CPU Utilization and browser lockup at abcnews.go.com/nightline

Status: RESOLVED DUPLICATE of bug 597871

(Core :: JavaScript Engine, defect)

Description

[IU]

User-Agent:       Mozilla/5.0 (Windows NT 5.1; rv:2.0b7pre) Gecko/20100914 Firefox/4.0b7pre
Build Identifier: Mozilla/5.0 (Windows NT 5.1; rv:2.0b7pre) Gecko/20100914 Firefox/4.0b7pre ID:00000000000000

At the abcnews.go.com/nightline, with javascript.options.methodjit.content enabled (the default), the browser causes 100 % CPU utilization and becomes completely unresponsive.  The firefox.exe process has to be killed.

No lockup if javascript.options.methodjit.content is disabled.  Reproducible with the attached testcase (unreduced)

M-C regression range:
http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=16eac4b8b8e0&tochange=f1bd314e64ac

TM regression range:
http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=8ce3a4a29efc&tochange=1b55ec0c7aee

Strangely, the above is an empty pughlog, so I can't tell what changed.


Reproducible: Always

Steps to Reproduce:
1. Visit the linked URL or download and load the attachment.
2. Browser locks up with single-core 100 % CPU
3.

Comment 1

[IU]

Attachment: Test case: abcnews.go.com/nightline page

Comment 2

[David Mandelin [:dmandelin]]

Confirmed in TM nightly. We appear to be ilooping in RemoveExcessFrames.

This didn't happen in my local debug build, so it may have been fixed. Will have to check.

Comment 3

[IU]

This bug still exists after the latest TM merge.

Comment 4

[IU]

Attachment: Stack trace

Comment 5

[IU]

Today's TM merge still has the regression.  Tested with cset: c3876f7bc3e8

Comment 6

[Boris Zbarsky [:bzbarsky]]

We need to get the blocking nom here triaged.  In particular, is this a b7 blocker?

Comment 7

[David Anderson [:dvander] - inactive, e-mail if emergency]

Verified to be fixed by bug 597871.