1900169 - 100% cpu use on boulanger.com site, thousands of errors logged, page stops painting

Status: VERIFIED FIXED

(Core :: Layout: Text and Fonts, defect, P2)

Description

[Pascal Chevrel:pascalc]

Mozilla/5.0 (X11; Linux x86_64; rv:128.0) Gecko/20100101 Firefox/128.0 ID:20240531213029

I noticed today that my browser was hanging after visiting https://www.boulanger.com/ref/1158772

Launching it from the terminal in a fresh profile and visiting this page, there is a constant flow of the same error logged:

[GFX1]: invalid offset -1 for gfxSkipChars length 0
[GFX1]: invalid offset 1 for gfxSkipChars length 0
[GFX1]: invalid offset 1 for gfxSkipChars length 0
[GFX1]: invalid offset -1 for gfxSkipChars length 0

The browser becomes unesponsive and I have to kill it.

This is a recent regression in 128 or a regression gated to nightly as I tested in 127.0b9 and it is not affected.

Comment 1

[Pascal Chevrel:pascalc]

8:33.66 INFO: Last good revision: 9f6888436fe874358b1d565f295ebbaefb280019
8:33.66 INFO: First bad revision: 36fc4e06713de8a11db3cd3180ad24733d6581cb
8:33.66 INFO: Pushlog:
https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=9f6888436fe874358b1d565f295ebbaefb280019&tochange=36fc4e06713de8a11db3cd3180ad24733d6581cb

Comment 2

[Jonathan Kew [:jfkthame]]

Ugh - thanks for reporting promptly, will try to investigate.

Comment 3

[BugBot [:suhaib / :marco/ :calixte]]

The bug is marked as tracked for firefox128 (nightly). We have limited time to fix this, the soft freeze is in 3 days. However, the bug still isn't assigned.

:fgriffith, could you please find an assignee for this tracked bug? Given that it is a regression and we know the cause, we could also simply backout the regressor. If you disagree with the tracking decision, please talk with the release managers.

For more information, please visit BugBot documentation.

Comment 4

[Jonathan Kew [:jfkthame]]

Assigning to myself for investigation. Tracking this is definitely the right call; we need to either fix it, or backout bug 385615 for FF128 if we can't fix in time.

Comment 5

[Paul Adenot (:padenot)]

Also seems to happen on the front page of https://france.tv, the main website of French public television. Profile: https://share.firefox.dev/4c6AKAL, 100% reproducible on various OSes, synchronously spinning on the main thread. This probably needs a timely fix or backout considering how widespread this is.

Happy to do a pernosco recording if needed.

Comment 6

[Jonathan Kew [:jfkthame]]

If you could post a pernosco link, that'd be great - thanks.

Yes, given we're seeing this multiple places, I'm thinking we should back out for now (sadly).

Comment 7

[Paul Adenot (:padenot)]

Here's a recording of this crashing in debug on https://france.tv: https://pernos.co/debug/eE4SQzx9bGBs5E0uF570jA/index.html

Comment 8

[Daniel Holbert [:dholbert]]

Given that this was a regression from bug 385615, I think we can call this fixed-by-backout of bug 385615 (merged to central a few hours ago in bug 385615 comment 75).

Comment 9

[Bogdan Maris, Desktop QA]

Reproduced the initial issue using an old Nightly build from 2024-06-01, verified that using latest Nightly 129.0a1 and latest beta build 128.0b9 the browser is still responsive after visiting the problematic websites mentioned in the comments and the CPU does not climb and stay at 100%. I verified across platforms (Windows 11, Ubuntu 22.04 and MacOS 13.6).