684789 - Nightly9.0a1 hangs up on Google Docs

Status: RESOLVED DUPLICATE of bug 684576

(Core :: JavaScript Engine, defect)

Description

[Alice0775 White]

Attachment: WinDbg log

Build Identifier:
http://hg.mozilla.org/mozilla-central/rev/2bb8c0b664cf
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:9.0a1) Gecko/20110905 Firefox/9.0a1 ID:20110905030839

Nightly9.0a1 hangs up on Google Docs

Reproducible: Always

Steps to Reproduce:
1. Open Firefox with clean profile + Flash Player 10.3.183.7
2. Open URL
3. Create Document
4. Type "This is Mozilla Firefox." without quotation marks.
5. Press BackSpace key and keep hold

Actual Results:
  Nightly9.0a1 hangs with high CPU usage.


Expected Results:
  Nightly9.0a1 should not hang

Regression window(cached m-c hourly):
Works:
http://hg.mozilla.org/mozilla-central/rev/d6d6656d8bc6
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:9.0a1) Gecko/20110904 Firefox/9.0a1 ID:20110904035336
Hangs:
http://hg.mozilla.org/mozilla-central/rev/ca5ce4ebff75
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:9.0a1) Gecko/20110904 Firefox/9.0a1 ID:20110904130314
Pushlog:
http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=d6d6656d8bc6&tochange=ca5ce4ebff75


Regression window(cached m-i hourly):
Works:
http://hg.mozilla.org/integration/mozilla-inbound/rev/d1d3ad947e9f
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:9.0a1) Gecko/20110903 Firefox/9.0a1 ID:20110903104140
Hangs:
http://hg.mozilla.org/integration/mozilla-inbound/rev/6e67cafd75c8
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:9.0a1) Gecko/20110903 Firefox/9.0a1 ID:20110903132745
Pushlog:
http://hg.mozilla.org/integration/mozilla-inbound/pushloghtml?fromchange=d1d3ad947e9f&tochange=6e67cafd75c8

Triggered by:
6e67cafd75c8	Jan de Mooij — Bug 670493 - Refactor and optimize booleanJumpScript. r=bhackett

Comment 1

[Boris Zbarsky [:bzbarsky]]

Requesting tracking for this regression...

Comment 2

[Jan de Mooij [:jandem]]

Looks like an infinite loop in FrameState::merge. In a m-c debug build I get this assert: Assertion failure: !fe->data.inRegister(), at /builds/slave/m-cen-osx-dbg/build/js/src/methodjit/FrameState-inl.h:977

Bug 684576 is about the same assert and was fixed yesterday on the JM branch. Probably fixed this bug too because I am unable to reproduce it with a JM tinderbox build (bug 670493 was in the MC->JM merge from yesterday).

It looks like bug 670493 exposed a pre-existing regalloc bug, because it allows us to do regalloc across branches in more cases.