1673636 - Slow script dialog is not shown when lots of new Javascript array objects being created

Status: NEW

(Core :: XPConnect, defect, P3)

Description

[Henrik Skupin [:whimboo][⌚️UTC+2]]

As seen on bug 1670181 comment 16 websites can abuse the browser to hang / freeze by allocating lots of new Javascript array objects that then triggers a lot of minor GCs.

Trying to shutdown Firefox will cause a hang until the processes get killed by the terminator.

Here a gecko profile:
https://share.firefox.dev/33JXohQ

When that happens the content process has a 100% CPU usage until it gets killed, or Firefox closed (which also hangs due to the not reacting content process).

Comment 1

[Olli Pettay [:smaug][[e-mail]]]

The hang in the child processes is fine, but having super slow shutdown isn't.

Comment 2

[Jon Coppeard (:jonco)]

(I wrote this before Olli's comment above)

It looks like the page is looping while allocating array objects, which is causing a ton of minor GCs. This is not unexpected. However normally we would break out of this with the slow script dialog or on shutdown, but that doesn't seem to happen here.

I don't see any evidence that it GC activity per se that is block the stopping the user killing the script or the content process from shutting down.

Having said that, the profile is spending most of its time clearing memory which is probably due to nursery poisoning which is only present on nightly. This can be disabled by setting the JSGC_DISABLE_POISONING environment variable.

Comment 3

[Olli Pettay [:smaug][[e-mail]]]

Yeah, I think this is more a process handling issue.

Comment 4

[Chris Peterson [:cpeterson]]

The profile shows JS:InterruptCallback is being called periodically, so we should have the opportunity to show the slow script dialog. But we disable the slow script dialog in automation. We need to figure how why the slow script dialog is not being shown.

Moving to XPConnect component.

Comment 5

[Chris Peterson [:cpeterson]]

kmag says this is probably related to the 20 second shutdown time limit for pending user input and the slow script dialog.

Comment 6

[Henrik Skupin [:whimboo][⌚️UTC+2]]

This is not related to Marionette. It's just that the website runs specific code when navigator.webdriver returns true. So nothing related to automation.