Bug 158290 – Runaway WebContent process CPU & memory @ foxnews.com

• Component: JavaScriptCore
• Status: RESOLVED FIXED

[Michael Saboff]

Some foxnews.com pages with embedded videos have this code:

start : function() {
    if (this.started === true) {
        return;
    }
    try {
        this.plugin.Media.open(this.getMediaName(), this.media.getDuration(), this.getPlayerName()); // <== Exception here
        this.started = true;
    } catch (error) {
        this.error(error);
    }
    this.play(); // recursively call play()
}

play : function() {
    if (this.started !== true) {
        this.start(); // <== call here
        return;
    }
    try {
        this.plugin.Media.play(this.getMediaName(), this.getPlaybackCore().getCurrentTime() || 0);
    } catch (error) {
        this.error(error);
    }
}

This can end up being a mutual recursive call chain that will eventually exceed the stack space.  This happens when this.plugin.Media.open() in start() throws an exception.  That exception is caught in the catch block, but start() then calls play().  At the top of play(), it will recursively call start() and we end up in a recursive loop.  While the stack grows, the amount of memory used goes up dramatically.  The memory use is due to the error objects that are created for each throw.  The catch will be handled in baseline JIT'ed code as the higher tiers will ORS exit at the start of their catch blocks.  The baseline JIT'ed code will allocate a local for the thrown value and the conservative scan of the stack during GC will include the thrown value.  This means that the error objects for all start() frames further up the stack will not be collected.

[Michael Saboff]

<rdar://problem/24756019>

[Michael Saboff]

Created attachment 280288 [details]
Patch

[Mark Lam]

Comment on attachment 280288 [details]
Patch

r=me

[Michael Saboff]

Committed r201589: <http://trac.webkit.org/changeset/201589>

[Csaba Osztrogonác]

(In reply to comment #4)
> Committed r201589: <http://trac.webkit.org/changeset/201589>

stress/recursive-try-catch.js.ftl-no-cjit-validate-sampling-profiler times out on Apple Mac 32 bit debug bot: https://build.webkit.org/builders/Apple%20El%20Capitan%2032-bit%20JSC%20%28BuildAndTest%29/builds/2545