User-Agent: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.4; en-US; rv:1.9b4pre) Gecko/2008022704 Minefield/3.0b3pre firefox Build Identifier: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.4; en-US; rv:1.9b4pre) Gecko/2008022704 Minefield/3.0b3pre firefox Im using protopage.com as my homepage, firefox 2 works fine, today when I tried to add some bookmarks to one of my bookmark widgets. Minefield hang when I finished adding and clicked "save", OSX beach ball show up, and never go away, have to force quit. Reproducible: Always Steps to Reproduce: 1.go to protopage.com 2.edit any bookmark widget, click save 3.browser hang Actual Results: browser hang Expected Results: editing penal go away, page load properly, browser works properly I do not know if this is a problem with previous minefield 3 nightly since I haven't edited my homepage for quite a long time.

just to add, even when I click "cancel", or the "x" try to get rid of the editing penal, minefield froze as well.

also add. no problem with firefox 3 beta 3 on my Linux (EEE default, xandros), so it either a problem after beta 3, or a problem with mac version?

I see a hang for about 20 seconds when clicking Save, then it recovers. Regression window: 2008-02-18-04 -- 2008-02-18-18 http://bonsai.mozilla.org/cvsquery.cgi?treeid=default&module=all&branch=HEAD&branchtype=match&dir=&file=&filetype=match&who=&whotype=match&sortby=Date&hours=2&date=explicit&mindate=2008-02-18+03%3A00&maxdate=2008-02-18+18%3A00&cvsroot=%2Fcvsroot bug 322889?

It quite possible, I don't think I waited that long before I forced quit it.

Why do you think it's 322889? Does the page have a lot of arrays on it? Where does a profile point?

it hangs on my macbook for at least a minutes, during which CPU usage goes up crazy.

I stopped it in a debugger during the "hang" and it was always doing: #0 js_LookupPropertyWithFlags #1 js_LookupProperty #2 array_lookupProperty #3 CallEnumeratorNext #4 js_CallIteratorNext #5 js_Interpret #0 array_enumerate #1 CallEnumeratorNext #2 js_CallIteratorNext #3 js_Interpret or something like that and looking at the checkins in the range above it's mostly JS Engine stuff, so I just guessed at bug 322889... Sorry, I don't know enough about JS Engine to know what to expect from a profile. FWIW, DumpJSStack() pointed to this URL: http://protopage.com/web/js/a4.10.js which seems to have a lot of arrays...

Yeah, that looks like 322889, then! Taking.

I hit this on http://trulia.com/ entering a particular city and state. (gdb) bt 10 #0 0x23012e53 in array_lookupProperty (cx=0x234a4310, obj=0x1e23f320, id=104381943, objp=0xbfffd024, propp=0xbfffd020) at jsarray.c:646 #1 0x2305c591 in js_CallIteratorNext (cx=0x234a4310, iterobj=0x1e23f360, rval=0xbfffd344) at jsiter.c:542 #2 0x230458be in js_Interpret (cx=0x234a4310, pc=0x21b4e5be "\v", result=0xbfffd47c) at jsinterp.c:3056 #3 0x2305b124 in js_Invoke (cx=0x234a4310, argc=1, vp=0x1d95024, flags=2) at jsinterp.c:1435 #4 0x2305b573 in js_InternalInvoke (cx=0x234a4310, obj=0x1e1903a0, fval=505671872, flags=0, argc=1, argv=0x1d95020, rval=0xbfffd560) at jsinterp.c:1491 #5 0x23006c0a in JS_CallFunctionValue (cx=0x234a4310, obj=0x1e1903a0, fval=505671872, argc=1, argv=0x1d95020, rval=0xbfffd560) at jsapi.c:4982 #6 0x2d94d0a1 in nsJSContext::CallEventHandler (this=0x234a3bb0, aTarget=0x243f7be0, aScope=0x1e3d3c20, aHandler=0x1e23f0c0, aargv=0x238c6620, arv=0xbfffd704) at nsJSEnvironment.cpp:1947 #7 0x2d9be50d in nsJSEventListener::HandleEvent (this=0x243f7d00, aEvent=0x2528ac40) at nsJSEventListener.cpp:248 #8 0x2d77d2d0 in nsEventListenerManager::HandleEventSubType (this=0x243f7ca0, aListenerStruct=0x243f7f08, aListener=0x243f7d00, aDOMEvent=0x2528ac40, aCurrentTarget=0x243f7be0, aPhaseFlags=2) at nsEventListenerManager.cpp:1082 #9 0x2d77db9e in nsEventListenerManager::HandleEvent (this=0x243f7ca0, aPresContext=0x23a33230, aEvent=0xbfffdaa4, aDOMEvent=0xbfffda28, aCurrentTarget=0x243f7be0, aFlags=2, aEventStatus=0xbfffda2c) at nsEventListenerManager.cpp:1184 (More stack frames follow...) (gdb) up #1 0x2305c591 in js_CallIteratorNext (cx=0x234a4310, iterobj=0x1e23f360, rval=0xbfffd344) at jsiter.c:542 542 if (!OBJ_LOOKUP_PROPERTY(cx, origobj, id, &obj2, &prop)) (gdb) p/x id $1 = 0x638bdf7 (gdb) p *origobj $2 = { map = 0x218dc160, fslots = {511013056, 507329568, 588010913, 2, 3, -2147483647}, dslots = 0x247d2f94 } (gdb) p *(JSClass*)($.fslots[2]&~3) $3 = { name = 0x230b4c50 "Array", flags = 50331907, addProperty = 0x23002f38 <JS_PropertyStub>, delProperty = 0x23002f38 <JS_PropertyStub>, getProperty = 0x23002f38 <JS_PropertyStub>, setProperty = 0x23002f38 <JS_PropertyStub>, enumerate = 0x23002f42 <JS_EnumerateStub>, resolve = 0x23002f4c <JS_ResolveStub>, convert = 0x23065fa0 <js_TryValueOf>, finalize = 0x230133c6 <array_finalize>, getObjectOps = 0x230135e4 <array_getObjectOps>, checkAccess = 0, call = 0, construct = 0, xdrObject = 0, hasInstance = 0, mark = 0, reserveSlots = 0 } (gdb) p/x origobj.dslots[-1] $4 = 0x2 (gdb) fin Run till exit from #1 0x2305c591 in js_CallIteratorNext (cx=0x234a4310, iterobj=0x1e23f360, rval=0xbfffd344) at jsiter.c:542 ^C Program received signal SIGINT, Interrupt. 0x2305c56c in js_CallIteratorNext (cx=0x234a4310, iterobj=0x1e23f360, rval=0xbfffd344) at jsiter.c:542 542 if (!OBJ_LOOKUP_PROPERTY(cx, origobj, id, &obj2, &prop)) (gdb) l 537 } 538 goto stop; 539 } 540 541 /* Skip properties not in obj when looking from origobj. */ 542 if (!OBJ_LOOKUP_PROPERTY(cx, origobj, id, &obj2, &prop)) 543 return JS_FALSE; 544 if (!prop) 545 goto restart; 546 OBJ_DROP_PROPERTY(cx, obj2, prop); (gdb) l 500 495 if (!xmlops->enumerateValues(cx, obj, JSENUMERATE_NEXT, &state, 496 &id, rval)) { 497 return JS_FALSE; 498 } 499 } else { 500 if (!OBJ_ENUMERATE(cx, obj, JSENUMERATE_NEXT, &state, &id)) 501 return JS_FALSE; 502 } 503 STOBJ_SET_SLOT(iterobj, JSSLOT_ITER_STATE, state); 504 if (JSVAL_IS_NULL(state)) (gdb) 505 goto stop; 506 } else 507 #endif 508 { 509 restart: 510 if (!OBJ_ENUMERATE(cx, obj, JSENUMERATE_NEXT, &state, &id)) 511 return JS_FALSE; 512 513 STOBJ_SET_SLOT(iterobj, JSSLOT_ITER_STATE, state); 514 if (JSVAL_IS_NULL(state)) { (gdb) 515 #if JS_HAS_XML_SUPPORT 516 if (OBJECT_IS_XML(cx, obj)) { 517 /* 518 * We just finished enumerating an XML obj that is present on 519 * the prototype chain of a non-XML origobj. Stop further 520 * prototype chain searches because XML objects don't 521 * enumerate prototypes. 522 */ 523 JS_ASSERT(origobj != obj); 524 JS_ASSERT(!OBJECT_IS_XML(cx, origobj)); (gdb) 525 } else 526 #endif 527 { 528 obj = OBJ_GET_PROTO(cx, obj); 529 if (obj) { 530 STOBJ_SET_PARENT(iterobj, obj); 531 if (!OBJ_ENUMERATE(cx, obj, JSENUMERATE_INIT, &state, NULL)) 532 return JS_FALSE; 533 STOBJ_SET_SLOT(iterobj, JSSLOT_ITER_STATE, state); 534 if (!JSVAL_IS_NULL(state)) (gdb) 535 goto restart; 536 } 537 } 538 goto stop; 539 } 540 541 /* Skip properties not in obj when looking from origobj. */ 542 if (!OBJ_LOOKUP_PROPERTY(cx, origobj, id, &obj2, &prop)) 543 return JS_FALSE; 544 if (!prop) (gdb) 545 goto restart; 546 OBJ_DROP_PROPERTY(cx, obj2, prop); 547 548 /* 549 * If the id was found in a prototype object or an unrelated object 550 * (specifically, not in an inner object for obj), skip it. This step 551 * means that all OBJ_LOOKUP_PROPERTY implementations must return an 552 * object further along on the prototype chain, or else possibly an 553 * object returned by the JSExtendedClass.outerObject optional hook. 554 */ /be

Brendan says this is a dupe of 418737.