Bug 46049 – REGRESSION: Hang at CNN.com

• Status: RESOLVED
• Resolution: FIXED
• Component: JavaScriptCore

[Jon]

Hang here according to spindump: JSC::RegExp::match(JSC::UString const&, int, WTF::Vector<int, 32ul>*) + 522 (RegexJIT.h:74 in JavaScriptCore). Have to force quit. Only extension is ClickToPlugin.

Perhaps due to http://trac.webkit.org/changeset/67790?

[Geoffrey Garen]

Can you reproduce this hang?

[Michael Saboff]

This problem may have been addressed by https://bugs.webkit.org/show_bug.cgi?id=46077 and/or https://bugs.webkit.org/show_bug.cgi?id=46083.  Verifying at this time.

(In reply to comment #2)
> This problem may have been addressed by https://bugs.webkit.org/show_bug.cgi?id=46077 and/or https://bugs.webkit.org/show_bug.cgi?id=46083.  Verifying at this time.

I can confirm that i'm experiencing the same issue (build: 67838).

[Michael Saboff]

Working on a patch for this issue.  Seems to be a problem with expressions like:
  ^longer|short
Where the ^ anchored element has a fixed length greater than the second alternative.

[Michael Saboff]

Created attachment 68143 [details]
Patch to change handling of alternative lengths and looping

The prior code would set the flag hasShorterAlternatives when comparing any alternative to the first alternative.  This patch fixes that to check the first looping alternative to subsequent alternatives.

[Geoffrey Garen]

Committed revision 67894.

[Geoffrey Garen]

Comment on attachment 68143 [details]
Patch to change handling of alternative lengths and looping

Mark cq- to remove from commit queue, since I landed this.

[Geoffrey Garen]

Let's keep this bug open since we still need a reduction to add as a layout test, even though we wanted to land the fix as soon as possible.

[Eric Seidel (no email)]

I guess ya'll are in a hurry to ship, eh?  Layout tests are yummy.

[Michael Saboff]

Created attachment 68256 [details]
New Tests

Added tests include some that cover this issue.

[Chris Petersen]

I'm encountering a hang with Webkit NB r67838 while I'm still loading http://www.npr.org.


Analysis of sampling Safari (pid 4060) every 1 millisecond
Call graph:
    7299 Thread_132284   DispatchQueue_1: com.apple.main-thread  (serial)
      7299 JSC::RegExp::match(JSC::UString const&, int, WTF::Vector<int, 32ul>*)
        3637 0x24863d31aaee
        1415 0x24863d31aaea
        1367 0x24863d31ab3d
        298 0x24863d31aafa
        293 0x24863d31aaf4
        289 0x24863d31ab4b
    7299 Thread_132295   DispatchQueue_2: com.apple.libdispatch-manager  (serial)
      7299 start_wqthread
        7299 _pthread_wqthread
          7299 _dispatch_worker_thread2
            7299 _dispatch_queue_invoke
              7299 _dispatch_mgr_invoke
                7297 kevent
                1 _dispatch_mgr_invoke
                1 _dispatch_run_timers
                  1 _dispatch_timer_list_update
    7299 Thread_132299: WebCore: IconDatabase
      7299 thread_start
        7299 _pthread_start
          7299 WebCore::IconDatabase::iconDatabaseSyncThread()
            7299 WebCore::IconDatabase::syncThreadMainLoop()
              7299 _pthread_cond_wait
                7299 __semwait_signal
    7299 Thread_132303: Safari: SafeBrowsingManager
      7299 thread_start
        7299 _pthread_start
          7299 0x10002f9d1
            7299 0x10002fa41
              7299 CFRunLoopRunSpecific
                7299 __CFRunLoopRun
                  7299 mach_msg
                    7299 mach_msg_trap
    7299 Thread_132304
      7299 thread_start
        7299 _pthread_start
          7299 __NSThread__main__
            7299 +[NSURLConnection(NSURLConnectionReallyInternal) _resourceLoadLoop:]
              7299 CFRunLoopRunSpecific
                7299 __CFRunLoopRun
                  7299 mach_msg
                    7299 mach_msg_trap
    7299 Thread_132307
      7299 thread_start
        7299 _pthread_start
          7299 __CFSocketManager
            7299 select$DARWIN_EXTSN
    7299 Thread_132308: Safari: SnapshotStore
      7299 thread_start
        7299 _pthread_start
          7299 0x10004738d
            7299 0x10004750f
              7299 0x1001be851
                7299 WTF::ThreadCondition::timedWait(WTF::Mutex&, double)
                  7299 _pthread_cond_wait
                    7299 __semwait_signal
    7299 Thread_132577
      7299 thread_start
        7299 _pthread_start
          7299 thread_fun
            7299 CA::Render::Server::server_thread(void*)
              7299 mach_msg
                7299 mach_msg_trap
    7299 Thread_132940: Safari: SpinningProgressIndicator
      7299 thread_start
        7299 _pthread_start
          7299 __NSThread__main__
            7299 0x1000903f7
              7299 -[NSRunLoop(NSRunLoop) run]
                7299 -[NSRunLoop(NSRunLoop) runMode:beforeDate:]
                  7299 CFRunLoopRunSpecific
                    7299 __CFRunLoopRun
                      7132 mach_msg
                        7132 mach_msg_trap
                      167 __NSFireTimer
                        121 0x100090a5a
                          118 0x100090dac
                            118 0x10008f88c
                              118 -[NSImage compositeToPoint:operation:]
                                118 -[NSImage _composite:delta:fromRect:toPoint:]
                                  97 -[NSImage drawInRect:fromRect:operation:fraction:respectFlipped:hints:]
                                    97 -[NSImage _usingBestRepresentationForRect:context:hints:body:]
                                      97 __-[NSImage drawInRect:fromRect:operation:fraction:respectFlipped:hints:]_block_invoke_1
                                        97 -[NSImageRep drawInRect:fromRect:operation:fraction:respectFlipped:hints:]
                                          97 __-[NSImageRep drawInRect:fromRect:operation:fraction:respectFlipped:hints:]_block_invoke_1
                                            97 CGContextDrawImage
                                              97 ripc_DrawImage
                                                91 ripc_RenderImage
                                                  91 ripl_BltImage
                                                    91 ripd_Lock
                                                      91 CGSDeviceLock
                                                        91 _CGSLockWindow
                                                          91 _CGSSynchronizeWindowBackingStore
                                                            91 mach_msg
                                                              91 mach_msg_trap
                                                4 ripc_AcquireImage
                                                  4 CGSImageDataLock
                                                    4 img_data_lock
                                                      4 CGColorTransformConvertNeedsCMS
                                                2 ripc_DrawImage
                                  20 -[NSImage _usingBestRepresentationForRect:context:hints:body:]
                                    19 -[NSImage bestRepresentationForRect:context:hints:]
                                      19 -[NSImage _usingCacheRepPerformBlock:]
                                        19 __-[NSImage bestRepresentationForRect:context:hints:]_block_invoke_1
                                          19 -[NSSnapshotContextSignature isApplicableForRect:context:hints:]
                                            19 NSImageInterpolationForReferenceContext_hints_
                                    1 -[NSAutoreleasePool drain]
                                      1 _CFAutoreleasePoolPop
                                        1 -[NSObject(NSObject) release]
                                          1 __spin_lock
                                  1 __NSHasDisplayScaleFactor
                          1 0x100090d12
                            1 -[NSView convertRect:toView:]
                              1 -[NSView _convertRect:toAncestor:]
                          1 0x100090d86
                            1 objc_msgSend
                          1 0x100090db4
                            1 CGContextRestoreGState
                              1 CGGStackRestore
                                1 CGGStateRelease
                                  1 szone_free_definite_size
                        34 0x1000909ed
                          34 objc_msgSend
                        4 0x1000908e5
                          4 __compare_and_swap64
                        4 0x100090a9f
                          4 ripc_Operation
                            4 CGSDeviceSynchronize
                              4 _CGSFlushRegionInline
                                2 _CGSFlushRegionInline
                                2 mach_msg
                                  2 mach_msg_trap
                        2 -[NSObject(NSObject) release]
                          2 __CFDoExternRefOperation
                            2 CFBasicHashRemoveValue
                              2 ___CFBasicHashFindBucket1
                        1 0x10009096b
                          1 -[NSCFDictionary keyEnumerator]
                            1 +[NSObject(NSObject) allocWithZone:]
                              1 _internal_class_createInstanceFromZone
                                1 calloc
                                  1 malloc_zone_calloc
                                    1 szone_calloc
                        1 _CFAutoreleasePoolPush
                          1 pthread_setspecific
    7299 Thread_133630: QTKit: listenOnDelegatePort
      7299 thread_start
        7299 _pthread_start
          7299 listenOnDelegatePort
            7299 CFRunLoopRun
              7299 CFRunLoopRunSpecific
                7299 __CFRunLoopRun
                  7299 mach_msg
                    7299 mach_msg_trap
    7299 Thread_133631: QTKit: listenOnNotificationPort
      7299 thread_start
        7299 _pthread_start
          7299 listenOnNotificationPort
            7299 CFRunLoopRun
              7299 CFRunLoopRunSpecific
                7299 __CFRunLoopRun
                  7299 mach_msg
                    7299 mach_msg_trap
    4017 Thread_137608
      4017 start_wqthread
        4003 _pthread_wqthread
          4003 __workq_kernreturn
        14 start_wqthread
    3295 Thread_135755
      3295 start_wqthread
        3295 _pthread_wqthread
          3295 __workq_kernreturn

Total number in stack (recursive counted multiple, when >=5):
        9       _pthread_start
        9       thread_start
        8       mach_msg
        8       mach_msg_trap
        5       CFRunLoopRunSpecific
        5       __CFRunLoopRun

Sort by top of stack, same collapsed (when >= 5):
        mach_msg_trap        43720
        __semwait_signal        14598
        select$DARWIN_EXTSN        7299
        __workq_kernreturn        7298
        kevent        7297
        0x24863d31aaee        3637
        0x24863d31aaea        1415
        0x24863d31ab3d        1367
        0x24863d31aafa        298
        0x24863d31aaf4        293
        0x24863d31ab4b        289
        objc_msgSend        35
        NSImageInterpolationForReferenceContext_hints_        19
        start_wqthread        14

[Michael Saboff]

The patch with the fix (https://bug-46049-attachments.webkit.org/attachment.cgi?id=68143) was actually landed in changeset 67849.  Accessing www.npr.org works for me now.

[Darin Adler]

Comment on attachment 68256 [details]
New Tests

These tests look good.

[WebKit Commit Bot]

Comment on attachment 68256 [details]
New Tests

Clearing flags on attachment: 68256

Committed r68021: <http://trac.webkit.org/changeset/68021>

[Alexey Proskuryakov]

Can this be closed now?

[Michael Saboff]

With the additions of the tests, this defect is now closed.