1503711 - CERT_FindUserCertsByUsage is causing a lot of hangs

Status: RESOLVED WORKSFORME

(NSS :: Libraries, defect, P3)

Description

[Johann Hofmann [:johannh]]

Based on a new tool that Florian is working on right now we are identifying frequent sources of hangs in Nightly based on BHR data.

A very frequent offender seems to be this (shortened) stacktrace:

CERT_FindUserCertsByUsage nss3
nsNSSComponent::HasUserCertsInstalled(bool *) xul
static bool mozilla::net::CanEnableSpeculativeConnect() xul
nsresult mozilla::net::nsHttpHandler::SpeculativeConnectInternal(class nsIURI *, class nsIPrincipal *, class nsIInterfaceRequestor *, bool) xul
mozilla::net::nsHttpHandler::SpeculativeConnect2(nsIURI *,nsIPrincipal *,nsIInterfaceRequestor *) xul

which was added in bug 910207.

On this single day that code has caused over 2.3 accumulated hours of hang for our Nightly population (in 24,272 occurrences).

You can view the most frequent data here: http://queze.net/bhr/#filter=FindUserCertsByUsage, though please note that it will of course vary by date.

I don't think that we will be able to completely get rid of this code, but it looks to me like nsNSSComponent::HasUserCertsInstalled is a very cheap candidate for optimization. It currently uses CERT_FindUserCertsByUsage to get all certificates and then simply checks whether the returned list is empty or not, whereas it could potentially use a new function that bails early once a certificate is found.

Of course I can't say whether that inefficiency is really the source of this hang. It would be great to get some thoughts from someone who's more familiar with this code :)

Comment 1

[Johann Hofmann [:johannh]]

Oh, I just saw bug 1435141, so this is doing main thread IO. Valentin, should we dupe this bug? What is bug 1435141 blocked on?

Comment 2

[Valentin Gosu [:valentin]]

bug 1435141 comment 12 - when running without a profile, instantiating a nsNSSComponent blocks indefinitely.
I think the solution would be to not do check it when there's no profile, but I didn't manage to get it right.

If there's a way to make HasUserCertsInstalled more efficient, that would be great anyway, and is kinda separate from bug 1435141, so I wouldn't dupe it.

Comment 3

[Alex Thayer [:alexical] (she/her)]

Putting this as fxperf:p2 assuming it is easy to address.

Comment 4

[Dana Keeler (she/her) [:keeler]]

Note that as of bug 1573542 and bug 1581962, Firefox no longer uses CERT_FindUserCertsByUsage