Bug 46049

Summary:

REGRESSION: Hang at CNN.com

Product:

WebKit

Reporter:

Jon <jon>

Component:

JavaScriptCore

Assignee:

Michael Saboff <msaboff>

Status:

RESOLVED FIXED

Severity:

Normal

CC:

commit-queue, c.petersen87, eric, ggaren, msaboff

Priority:

Keywords:

NeedsReduction

Version:

528+ (Nightly build)

Hardware:

Mac (Intel)

OS:

OS X 10.6

URL:

http://cnn.com

Attachments:

Description	Flags
Patch to change handling of alternative lengths and looping	barraclough: review+, ggaren: commit-queue-
New Tests	none

Jon

Reported 2010-09-18 20:07:16 PDT

Hang here according to spindump: JSC::RegExp::match(JSC::UString const&, int, WTF::Vector<int, 32ul>*) + 522 (RegexJIT.h:74 in JavaScriptCore). Have to force quit. Only extension is ClickToPlugin. Perhaps due to http://trac.webkit.org/changeset/67790?

Attachments
Patch to change handling of alternative lengths and looping (1.72 KB, patch) 2010-09-20 15:12 PDT, Michael Saboff	barraclough: review+ ggaren: commit-queue-	Details Formatted Diff Diff
New Tests (2.83 KB, patch) 2010-09-21 10:14 PDT, Michael Saboff	no flags	Details Formatted Diff Diff
View All Add attachment proposed patch, testcase, etc.

Geoffrey Garen

Comment 1 2010-09-20 11:12:14 PDT

Can you reproduce this hang?

Michael Saboff

Comment 2 2010-09-20 11:29:56 PDT

This problem may have been addressed by https://bugs.webkit.org/show_bug.cgi?id=46077 and/or https://bugs.webkit.org/show_bug.cgi?id=46083. Verifying at this time.

kvam.jay

Comment 3 2010-09-20 13:50:57 PDT

(In reply to comment #2) > This problem may have been addressed by https://bugs.webkit.org/show_bug.cgi?id=46077 and/or https://bugs.webkit.org/show_bug.cgi?id=46083. Verifying at this time. I can confirm that i'm experiencing the same issue (build: 67838).

Michael Saboff

Comment 4 2010-09-20 13:54:40 PDT

Working on a patch for this issue. Seems to be a problem with expressions like: ^longer|short Where the ^ anchored element has a fixed length greater than the second alternative.

Michael Saboff

Comment 5 2010-09-20 15:12:46 PDT

Created attachment 68143 [details] Patch to change handling of alternative lengths and looping The prior code would set the flag hasShorterAlternatives when comparing any alternative to the first alternative. This patch fixes that to check the first looping alternative to subsequent alternatives.

Geoffrey Garen

Comment 6 2010-09-20 17:04:33 PDT

Committed revision 67894.

Geoffrey Garen

Comment 7 2010-09-20 17:04:51 PDT

Comment on attachment 68143 [details] Patch to change handling of alternative lengths and looping Mark cq- to remove from commit queue, since I landed this.

Geoffrey Garen

Comment 8 2010-09-20 17:06:05 PDT

Let's keep this bug open since we still need a reduction to add as a layout test, even though we wanted to land the fix as soon as possible.

Eric Seidel (no email)

Comment 9 2010-09-20 17:08:40 PDT

I guess ya'll are in a hurry to ship, eh? Layout tests are yummy.

Michael Saboff

Comment 10 2010-09-21 10:14:10 PDT

Created attachment 68256 [details] New Tests Added tests include some that cover this issue.

Chris Petersen

Comment 11 2010-09-21 15:11:34 PDT

I'm encountering a hang with Webkit NB r67838 while I'm still loading http://www.npr.org. Analysis of sampling Safari (pid 4060) every 1 millisecond Call graph: 7299 Thread_132284 DispatchQueue_1: com.apple.main-thread (serial) 7299 JSC::RegExp::match(JSC::UString const&, int, WTF::Vector<int, 32ul>*) 3637 0x24863d31aaee 1415 0x24863d31aaea 1367 0x24863d31ab3d 298 0x24863d31aafa 293 0x24863d31aaf4 289 0x24863d31ab4b 7299 Thread_132295 DispatchQueue_2: com.apple.libdispatch-manager (serial) 7299 start_wqthread 7299 _pthread_wqthread 7299 _dispatch_worker_thread2 7299 _dispatch_queue_invoke 7299 _dispatch_mgr_invoke 7297 kevent 1 _dispatch_mgr_invoke 1 _dispatch_run_timers 1 _dispatch_timer_list_update 7299 Thread_132299: WebCore: IconDatabase 7299 thread_start 7299 _pthread_start 7299 WebCore::IconDatabase::iconDatabaseSyncThread() 7299 WebCore::IconDatabase::syncThreadMainLoop() 7299 _pthread_cond_wait 7299 __semwait_signal 7299 Thread_132303: Safari: SafeBrowsingManager 7299 thread_start 7299 _pthread_start 7299 0x10002f9d1 7299 0x10002fa41 7299 CFRunLoopRunSpecific 7299 __CFRunLoopRun 7299 mach_msg 7299 mach_msg_trap 7299 Thread_132304 7299 thread_start 7299 _pthread_start 7299 __NSThread__main__ 7299 +[NSURLConnection(NSURLConnectionReallyInternal) _resourceLoadLoop:] 7299 CFRunLoopRunSpecific 7299 __CFRunLoopRun 7299 mach_msg 7299 mach_msg_trap 7299 Thread_132307 7299 thread_start 7299 _pthread_start 7299 __CFSocketManager 7299 select$DARWIN_EXTSN 7299 Thread_132308: Safari: SnapshotStore 7299 thread_start 7299 _pthread_start 7299 0x10004738d 7299 0x10004750f 7299 0x1001be851 7299 WTF::ThreadCondition::timedWait(WTF::Mutex&, double) 7299 _pthread_cond_wait 7299 __semwait_signal 7299 Thread_132577 7299 thread_start 7299 _pthread_start 7299 thread_fun 7299 CA::Render::Server::server_thread(void*) 7299 mach_msg 7299 mach_msg_trap 7299 Thread_132940: Safari: SpinningProgressIndicator 7299 thread_start 7299 _pthread_start 7299 __NSThread__main__ 7299 0x1000903f7 7299 -[NSRunLoop(NSRunLoop) run] 7299 -[NSRunLoop(NSRunLoop) runMode:beforeDate:] 7299 CFRunLoopRunSpecific 7299 __CFRunLoopRun 7132 mach_msg 7132 mach_msg_trap 167 __NSFireTimer 121 0x100090a5a 118 0x100090dac 118 0x10008f88c 118 -[NSImage compositeToPoint:operation:] 118 -[NSImage _composite:delta:fromRect:toPoint:] 97 -[NSImage drawInRect:fromRect:operation:fraction:respectFlipped:hints:] 97 -[NSImage _usingBestRepresentationForRect:context:hints:body:] 97 __-[NSImage drawInRect:fromRect:operation:fraction:respectFlipped:hints:]_block_invoke_1 97 -[NSImageRep drawInRect:fromRect:operation:fraction:respectFlipped:hints:] 97 __-[NSImageRep drawInRect:fromRect:operation:fraction:respectFlipped:hints:]_block_invoke_1 97 CGContextDrawImage 97 ripc_DrawImage 91 ripc_RenderImage 91 ripl_BltImage 91 ripd_Lock 91 CGSDeviceLock 91 _CGSLockWindow 91 _CGSSynchronizeWindowBackingStore 91 mach_msg 91 mach_msg_trap 4 ripc_AcquireImage 4 CGSImageDataLock 4 img_data_lock 4 CGColorTransformConvertNeedsCMS 2 ripc_DrawImage 20 -[NSImage _usingBestRepresentationForRect:context:hints:body:] 19 -[NSImage bestRepresentationForRect:context:hints:] 19 -[NSImage _usingCacheRepPerformBlock:] 19 __-[NSImage bestRepresentationForRect:context:hints:]_block_invoke_1 19 -[NSSnapshotContextSignature isApplicableForRect:context:hints:] 19 NSImageInterpolationForReferenceContext_hints_ 1 -[NSAutoreleasePool drain] 1 _CFAutoreleasePoolPop 1 -[NSObject(NSObject) release] 1 __spin_lock 1 __NSHasDisplayScaleFactor 1 0x100090d12 1 -[NSView convertRect:toView:] 1 -[NSView _convertRect:toAncestor:] 1 0x100090d86 1 objc_msgSend 1 0x100090db4 1 CGContextRestoreGState 1 CGGStackRestore 1 CGGStateRelease 1 szone_free_definite_size 34 0x1000909ed 34 objc_msgSend 4 0x1000908e5 4 __compare_and_swap64 4 0x100090a9f 4 ripc_Operation 4 CGSDeviceSynchronize 4 _CGSFlushRegionInline 2 _CGSFlushRegionInline 2 mach_msg 2 mach_msg_trap 2 -[NSObject(NSObject) release] 2 __CFDoExternRefOperation 2 CFBasicHashRemoveValue 2 ___CFBasicHashFindBucket1 1 0x10009096b 1 -[NSCFDictionary keyEnumerator] 1 +[NSObject(NSObject) allocWithZone:] 1 _internal_class_createInstanceFromZone 1 calloc 1 malloc_zone_calloc 1 szone_calloc 1 _CFAutoreleasePoolPush 1 pthread_setspecific 7299 Thread_133630: QTKit: listenOnDelegatePort 7299 thread_start 7299 _pthread_start 7299 listenOnDelegatePort 7299 CFRunLoopRun 7299 CFRunLoopRunSpecific 7299 __CFRunLoopRun 7299 mach_msg 7299 mach_msg_trap 7299 Thread_133631: QTKit: listenOnNotificationPort 7299 thread_start 7299 _pthread_start 7299 listenOnNotificationPort 7299 CFRunLoopRun 7299 CFRunLoopRunSpecific 7299 __CFRunLoopRun 7299 mach_msg 7299 mach_msg_trap 4017 Thread_137608 4017 start_wqthread 4003 _pthread_wqthread 4003 __workq_kernreturn 14 start_wqthread 3295 Thread_135755 3295 start_wqthread 3295 _pthread_wqthread 3295 __workq_kernreturn Total number in stack (recursive counted multiple, when >=5): 9 _pthread_start 9 thread_start 8 mach_msg 8 mach_msg_trap 5 CFRunLoopRunSpecific 5 __CFRunLoopRun Sort by top of stack, same collapsed (when >= 5): mach_msg_trap 43720 __semwait_signal 14598 select$DARWIN_EXTSN 7299 __workq_kernreturn 7298 kevent 7297 0x24863d31aaee 3637 0x24863d31aaea 1415 0x24863d31ab3d 1367 0x24863d31aafa 298 0x24863d31aaf4 293 0x24863d31ab4b 289 objc_msgSend 35 NSImageInterpolationForReferenceContext_hints_ 19 start_wqthread 14

Michael Saboff

Comment 12 2010-09-21 16:26:33 PDT

The patch with the fix (https://bug-46049-attachments.webkit.org/attachment.cgi?id=68143) was actually landed in changeset 67849. Accessing www.npr.org works for me now.

Darin Adler

Comment 13 2010-09-21 17:32:17 PDT

Comment on attachment 68256 [details] New Tests These tests look good.

WebKit Commit Bot

Comment 14 2010-09-22 00:40:55 PDT

Comment on attachment 68256 [details] New Tests Clearing flags on attachment: 68256 Committed r68021: <http://trac.webkit.org/changeset/68021>

Alexey Proskuryakov

Comment 15 2010-09-22 08:41:45 PDT

Can this be closed now?

Michael Saboff

Comment 16 2010-09-22 09:50:33 PDT

With the additions of the tests, this defect is now closed.

Note You need to log in before you can comment on or make changes to this bug.