600662 - Twitscoop search causes high CPU usage and hangs Firefox

Status: RESOLVED DUPLICATE of bug 597871

(Core :: JavaScript Engine, defect)

Description

[Andreas Jung]

User-Agent:       Mozilla/5.0 (Windows NT 5.1; rv:2.0b7pre) Gecko/20100928 Firefox/4.0b7pre
Build Identifier: Mozilla/5.0 (Windows NT 5.1; rv:2.0b7pre) Gecko/20100928 Firefox/4.0b7pre

Searching on Twitscoop causes Firefox to use 100% CPU and hangs Firefox forever.

Reproducible: Always

Steps to Reproduce:
1. Go to Twitscoop
2. Click on "Search"
3. Search something

Actual Results:  
Firefox hangs


Expected Results:  
Firefox should not hang and display the search results


I'm not used to WinDbg, so if you need additional information etc. please tell me.

WinDbg analysis:

0:004> |* !analyze -v -hang
ERROR: FindPlugIns 8007007b
*******************************************************************************
*                                                                             *
*                        Exception Analysis                                   *
*                                                                             *
*******************************************************************************

*************************************************************************
***                                                                   ***
***                                                                   ***
***    Your debugger is not using the correct symbols                 ***
***                                                                   ***
***    In order for this command to work properly, your symbol path   ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: kernel32!pNlsUserInfo                         ***
***                                                                   ***
*************************************************************************
*************************************************************************
***                                                                   ***
***                                                                   ***
***    Your debugger is not using the correct symbols                 ***
***                                                                   ***
***    In order for this command to work properly, your symbol path   ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: kernel32!pNlsUserInfo                         ***
***                                                                   ***
*************************************************************************

FAULTING_IP: 
ntdll!DbgBreakPoint+0
7c91120e cc              int     3

EXCEPTION_RECORD:  ffffffff -- (.exr 0xffffffffffffffff)
ExceptionAddress: 7c91120e (ntdll!DbgBreakPoint)
   ExceptionCode: 80000003 (Break instruction exception)
  ExceptionFlags: 00000000
NumberParameters: 3
   Parameter[0]: 00000000
   Parameter[1]: 00000002
   Parameter[2]: 00000003

FAULTING_THREAD:  00000000

BUGCHECK_STR:  HANG

PROCESS_NAME:  firefox.exe

ERROR_CODE: (NTSTATUS) 0xcfffffff - <Unable to get error code text>

EXCEPTION_CODE: (NTSTATUS) 0xcfffffff - <Unable to get error code text>

EXCEPTION_PARAMETER1:  00000000

EXCEPTION_PARAMETER2:  00000002

EXCEPTION_PARAMETER3:  00000003

NTGLOBALFLAG:  0

APPLICATION_VERIFIER_FLAGS:  0

DERIVED_WAIT_CHAIN:  

Dl Eid Cid     WaitType
-- --- ------- --------------------------
   4   658.fc0 Speculated (Triage)    -->
   0   658.448 Unknown                

WAIT_CHAIN_COMMAND:  ~4s;k;;~0s;k;;

BLOCKING_THREAD:  00000448

DEFAULT_BUCKET_ID:  APPLICATION_HANG_BusyHang

PRIMARY_PROBLEM_CLASS:  APPLICATION_HANG_BusyHang

LAST_CONTROL_TRANSFER:  from 102424c0 to 1023466c

STACK_TEXT:  
WARNING: Stack unwind information not available. Following frames may be wrong.
0013b570 102424c0 042ec7a0 04cba510 085ae2f0 xul!js_GetClassPrototype+0x25ec
0013b5c4 10026381 042ec7a0 0013b67c 00000001 xul!NS_Realloc_P+0x5a50
0013b5fc 1027e5a3 042ec7a0 02900868 103e6f00 xul!JS_DeleteProperty2+0x3151
0013b624 102925d7 02900868 103e6f00 08d51a02 xul!gfxSkipCharsIterator::IsOriginalCharSkipped+0x113
0013b644 102926df 0013b67c 029007d0 ffff0001 xul!JS_SetPendingException+0xc17
0013b6b4 10227805 042ec7a0 029007d0 08d60000 xul!JS_SetPendingException+0xd1f
00000000 00000000 00000000 00000000 00000000 xul!NS_CycleCollectorSuspect2_P+0x164d5


FOLLOWUP_IP: 
xul!NS_CycleCollectorSuspect2_P+164d5
10227805 8b4c243c        mov     ecx,dword ptr [esp+3Ch]

SYMBOL_STACK_INDEX:  6

SYMBOL_NAME:  xul!NS_CycleCollectorSuspect2_P+164d5

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: xul

IMAGE_NAME:  xul.dll

DEBUG_FLR_IMAGE_TIMESTAMP:  4ca1e08a

STACK_COMMAND:  ~0s ; kb

BUCKET_ID:  HANG_xul!NS_CycleCollectorSuspect2_P+164d5

FAILURE_BUCKET_ID:  APPLICATION_HANG_BusyHang_cfffffff_xul.dll!NS_CycleCollectorSuspect2_P

WATSON_STAGEONE_URL:  http://watson.microsoft.com/StageOne/firefox_exe/2_0_0_3923/4ca1e16b/ntdll_dll/5_1_2600_5755/49900abe/cfffffff/0000120e.htm?Retriage=1

Followup: MachineOwner
---------

Comment 1

[(mostly gone) XtC4UaLL [:xtc4uall]]

Using WinDbg the Hang is/was at

ChildEBP RetAddr  
0012b58c 100268e0 xul!js_UnwindScope(struct JSContext * cx = <Memory access error>, long stackDepth = <Memory access error>, int normalUnwind = <Memory access error>)+0x47 [e:\builds\moz2_slave\mozilla-central-win32-nightly\build\js\src\jsinterp.cpp @ 1195]
0012b5bc 103f318f xul!js_InternalThrow(struct js::VMFrame * f = 0x0012b5d4)+0x40 [e:\builds\moz2_slave\mozilla-central-win32-nightly\build\js\src\methodjit\invokehelpers.cpp @ 607]
0012b60c 10227033 xul!JaegerThrowpoline(struct js::VMFrame * vmFrame = 0x04129c40)+0xf [e:\builds\moz2_slave\mozilla-central-win32-nightly\build\js\src\methodjit\methodjit.cpp @ 678]
0012b634 1023ad97 xul!EnterMethodJIT(struct JSContext * cx = 0x02b00868, struct JSStackFrame * fp = 0xffff0007, void * code = 0x06e6bb88, void * safePoint = 0xffff0007)+0x63 [e:\builds\moz2_slave\mozilla-central-win32-nightly\build\js\src\methodjit\methodjit.cpp @ 787]
0012b654 1023ae9f xul!RemoveExcessFrames(struct js::VMFrame * f = 0x06e1bd80, struct JSStackFrame * entryFrame = 0x00000001)+0x67 [e:\builds\moz2_slave\mozilla-central-win32-nightly\build\js\src\methodjit\invokehelpers.cpp @ 739]
0012b674 1023c828 xul!RunTracer(struct js::VMFrame * f = <Memory access error>, struct js::mjit::ic::MICInfo * mic = <Memory access error>)+0x6f [e:\builds\moz2_slave\mozilla-central-win32-nightly\build\js\src\methodjit\invokehelpers.cpp @ 875]
0012b6c4 101d5de5 xul!js::mjit::stubs::InvokeTracer(struct js::VMFrame * f = 0x06e6bb88, unsigned long index = 0x58)+0x28 [e:\builds\moz2_slave\mozilla-central-win32-nightly\build\js\src\methodjit\invokehelpers.cpp @ 925]
0012b734 100f7466 xul!js::Invoke(struct JSContext * cx = 0x04129c40, struct js::CallArgs * argsRef = 0x02b007d0, unsigned long flags = 0x97c0000)+0x2c5 [e:\builds\moz2_slave\mozilla-central-win32-nightly\build\js\src\jsinterp.cpp @ 592]
0012b784 102414c9 xul!js_fun_call(struct JSContext * cx = 0x04129c40, unsigned int argc = 1, class js::Value * vp = 0x02b00798)+0x196 [e:\builds\moz2_slave\mozilla-central-win32-nightly\build\js\src\jsfun.cpp @ 2263]
0012bafc 102b43ea xul!CallCompiler::generateNativeStub(void)+0x99 [e:\builds\moz2_slave\mozilla-central-win32-nightly\build\js\src\methodjit\monoic.cpp @ 460]
0012bb6c 101d5de5 xul!js::mjit::ic::NativeCall(struct js::VMFrame * f = 0x06e6bb88, unsigned long index = 0x58)+0x6a [e:\builds\moz2_slave\mozilla-central-win32-nightly\build\js\src\methodjit\monoic.cpp @ 687]
0012bba4 1012f7d3 xul!js::Invoke(struct JSContext * cx = 0x04129c40, struct js::CallArgs * argsRef = 0x02b00718, unsigned long flags = 0x97c0000)+0x2c5 [e:\builds\moz2_slave\mozilla-central-win32-nightly\build\js\src\jsinterp.cpp @ 592]
00000000 00000000 xul!js::mjit::Assembler::loadValueAsComponents(struct JSC::AbstractMacroAssembler<JSC::X86Assembler>::Address address = struct JSC::AbstractMacroAssembler<JSC::X86Assembler>::Address, JSC::X86Registers::RegisterID type = 115784584 (No matching enumerant), JSC::X86Registers::RegisterID payload = <Memory access error>)+0x33 [e:\builds\moz2_slave\mozilla-central-win32-nightly\build\js\src\methodjit\nunboxassembler.h @ 161]

This is WFM on Today's Nightly 20100929 (http://hg.mozilla.org/mozilla-central/rev/a60414d076b5) and a recent TM Build (http://hg.mozilla.org/tracemonkey/rev/7c1d01933899), so i presume this has been fixed in a recent Merge.

Reopen if you can repro the Issue in Builds after that.