Bug 176299 – WebCore::DocumentLoader m_subresourceLoaders infinite loop

• Component: WebCore Misc.
• Status: RESOLVED CONFIGURATION CHANGED

[mali]

Created attachment 319768 [details]
crash log

we find UIWebView sometimes hangs at main thread, when this happened webcore thread cpu useage goes to 100%.according to the crash log it seems that the webcore thread is doing an infinite loop, hence the main thread won't continue for it's waiting the end of the webcore thread.

Steps:
1. create UIViewController with UIWebview and load url like https://www.baidu.com 
2. pop that UIViewController then go to steps 1

[Alexey Proskuryakov]

Could you please attach a complete project that can be used to reproduce? 

Is this actually limited to iOS 9.3, as the OS field specifies?

[mali]

This is an occasional problem is difficult to reproduce, this happens not only in the 9.3 system, the same occurred in iOS higher than 9.0 version, by reading the webkit source code, we found WTF :: HashMap class has method lookupForWriting which has a while loop, this cycle may not be able to exit for some reason, leading to an infinite loop

```
 inline auto HashTable<Key, Value, Extractor, HashFunctions, Traits, KeyTraits>::lookupForWriting(const T& key) -> LookupType
    {
        ASSERT(m_table);
        checkKey<HashTranslator>(key);

        unsigned k = 0;
        ValueType* table = m_table;
        unsigned sizeMask = m_tableSizeMask;
        unsigned h = HashTranslator::hash(key);
        unsigned i = h & sizeMask;

#if DUMP_HASHTABLE_STATS
        ++HashTableStats::numAccesses;
        unsigned probeCount = 0;
#endif

#if DUMP_HASHTABLE_STATS_PER_TABLE
        ++m_stats->numAccesses;
#endif

        ValueType* deletedEntry = 0;

        while (1) {
            ValueType* entry = table + i;
            
            // we count on the compiler to optimize out this branch
            if (HashFunctions::safeToCompareToEmptyOrDeleted) {
                if (isEmptyBucket(*entry))
                    return LookupType(deletedEntry ? deletedEntry : entry, false);
                
                if (HashTranslator::equal(Extractor::extract(*entry), key))
                    return LookupType(entry, true);
                
                if (isDeletedBucket(*entry))
                    deletedEntry = entry;
            } else {
                if (isEmptyBucket(*entry))
                    return LookupType(deletedEntry ? deletedEntry : entry, false);
            
                if (isDeletedBucket(*entry))
                    deletedEntry = entry;
                else if (HashTranslator::equal(Extractor::extract(*entry), key))
                    return LookupType(entry, true);
            }
#if DUMP_HASHTABLE_STATS
            ++probeCount;
            HashTableStats::recordCollisionAtCount(probeCount);
#endif

#if DUMP_HASHTABLE_STATS_PER_TABLE
            m_stats->recordCollisionAtCount(probeCount);
#endif

            if (k == 0)
                k = 1 | doubleHash(h);
            i = (i + k) & sizeMask;
        }
    }


```

[mali]

I found someone who had the same problem

https://stackoverflow.com/questions/43449989/main-thread-was-blocked-when-i-use-uiwebview

[Radar WebKit Bug Importer]

<rdar://problem/34345524>

[Chris Dumez]

This usually happens when the HashTable gets corrupted. The most common reason for this happening is the application doing something wrong (usually using the WebKit API from a non-main thread).

The WebKit API is not thread safe and using it from non-main threads will lead to issues like this.

[Chris Dumez]

Insufficient information. Please attach a simple project that reproduces the issue.
Also please make sure you have always using the UIWebView API from the main thread.

[mali]

Created attachment 325237 [details]
simple project that reproduces the issue

[mali]

We can use a simple demo in the iOS 11 system to reproduce the problem three times, the conditions of reproduction is 1. Network environment is very poor 2. the web page have a lost of Subresource, and make sure we have always using the UIWebView API from the main thread, when the problem occurs, X10 register value is 0x0000000000000000, X13 register value is 0xffffffffffffffffff，in the following assembly code, If the value of the X10 register and the X13 register value are different will enter the infinite loop

0x18d02c9e0 <+136>: cbz    x13, 0x18d02ca2c          ; <+212>
0x18d02c9e4 <+140>: cmp    w12, #0x0                 ; =0x0 
0x18d02c9e8 <+144>: csel   w12, w15, w12, eq
0x18d02c9ec <+148>: add    w11, w12, w11
0x18d02c9f0 <+152>: and    w11, w11, w9
0x18d02c9f4 <+156>: add    x14, x8, w11, uxtw #4
0x18d02c9f8 <+160>: ldr    x13, [x14]
0x18d02c9fc <+164>: cmp    x13, x10
0x18d02ca00 <+168>: b.ne   0x18d02c9e0               ; <+136>

[Brent Fulgham]

Legacy WebKit is deprecated, and has an interaction model that can lead to deadlocks. We suggest your application move to the modern WKWebView.