Build Identifier: http://hg.mozilla.org/mozilla-central/rev/2bb8c0b664cf Mozilla/5.0 (Windows NT 6.1; WOW64; rv:9.0a1) Gecko/20110905 Firefox/9.0a1 ID:20110905030839 Nightly9.0a1 hangs up on Google Docs Reproducible: Always Steps to Reproduce: 1. Open Firefox with clean profile + Flash Player 10.3.183.7 2. Open URL 3. Create Document 4. Type "This is Mozilla Firefox." without quotation marks. 5. Press BackSpace key and keep hold Actual Results: Nightly9.0a1 hangs with high CPU usage. Expected Results: Nightly9.0a1 should not hang Regression window(cached m-c hourly): Works: http://hg.mozilla.org/mozilla-central/rev/d6d6656d8bc6 Mozilla/5.0 (Windows NT 6.1; WOW64; rv:9.0a1) Gecko/20110904 Firefox/9.0a1 ID:20110904035336 Hangs: http://hg.mozilla.org/mozilla-central/rev/ca5ce4ebff75 Mozilla/5.0 (Windows NT 6.1; WOW64; rv:9.0a1) Gecko/20110904 Firefox/9.0a1 ID:20110904130314 Pushlog: http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=d6d6656d8bc6&tochange=ca5ce4ebff75 Regression window(cached m-i hourly): Works: http://hg.mozilla.org/integration/mozilla-inbound/rev/d1d3ad947e9f Mozilla/5.0 (Windows NT 6.1; WOW64; rv:9.0a1) Gecko/20110903 Firefox/9.0a1 ID:20110903104140 Hangs: http://hg.mozilla.org/integration/mozilla-inbound/rev/6e67cafd75c8 Mozilla/5.0 (Windows NT 6.1; WOW64; rv:9.0a1) Gecko/20110903 Firefox/9.0a1 ID:20110903132745 Pushlog: http://hg.mozilla.org/integration/mozilla-inbound/pushloghtml?fromchange=d1d3ad947e9f&tochange=6e67cafd75c8 Triggered by: 6e67cafd75c8 Jan de Mooij — Bug 670493 - Refactor and optimize booleanJumpScript. r=bhackett

Requesting tracking for this regression...

Looks like an infinite loop in FrameState::merge. In a m-c debug build I get this assert: Assertion failure: !fe->data.inRegister(), at /builds/slave/m-cen-osx-dbg/build/js/src/methodjit/FrameState-inl.h:977 Bug 684576 is about the same assert and was fixed yesterday on the JM branch. Probably fixed this bug too because I am unable to reproduce it with a JM tinderbox build (bug 670493 was in the MC->JM merge from yesterday). It looks like bug 670493 exposed a pre-existing regalloc bug, because it allows us to do regalloc across branches in more cases.