2046225 - The Atlantic page gets tab stuck preventing both view and browser restart

Status: VERIFIED FIXED

(Web Compatibility :: Site Reports, defect, P2)

Description

[mirh]

User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:153.0) Gecko/20100101 Firefox/153.0

Steps to reproduce:

I opened this.

Actual results:

Page gets stuck midway through its loading/rendering.
Firefox.exe process starts to hammer CPU and pile up memory +5MB/s
Restarting actually gets stuck forever, until I kill the affected process

Expected results:

Just work.

Comment 1

[mirh]

https://crash-stats.mozilla.org/report/index/53ba59f3-3a85-4d50-98ad-03aa50260609
FWIW this was me killing the thread (notably I never hit bug 1358898 even after a hour of waiting)

And this is the stack from the function that in my profiling took the most CPU

style::gecko_bindings::structs::root::__IncompleteArrayField<style::gecko_bindings::structs::root::AttrArray_InternalAttr>::as_ptr() [x86_64-pc-windows-msvc/release/build/style-014d227ef8c4bb8b/out/gecko/structs.rs]
style::gecko_bindings::structs::root::__IncompleteArrayField<style::gecko_bindings::structs::root::AttrArray_InternalAttr>::as_slice(unsigned long long) [x86_64-pc-windows-msvc/release/build/style-014d227ef8c4bb8b/out/gecko/structs.rs]
style::gecko::wrapper::GeckoElement::attrs() [servo/components/style/gecko/wrapper.rs]
style::gecko::wrapper::impl$18::has_attr_in_no_namespace(style::gecko::wrapper::GeckoElement*, style::values::AtomIdent*) [servo/components/style/gecko/wrapper.rs]
selectors::matching::matches_simple_selector(enum2$<selectors::parser::Component<style::gecko::selector_parser::SelectorImpl> >*, style::gecko::wrapper::GeckoElement*, selectors::matching::LocalMatchingContext<style::gecko::selector_parser::SelectorImpl>*) [servo/components/selectors/matching.rs]
selectors::matching::matches_compound_selector::closure$0(selectors::matching::matches_compound_selector::closure_env$0<style::gecko::wrapper::GeckoElement>*, enum2$<selectors::parser::Component<style::gecko::selector_parser::SelectorImpl> >*) [servo/components/selectors/matching.rs]
selectors::kleene_value::KleeneValue::any_value(selectors::parser::SelectorIter<style::gecko::selector_parser::SelectorImpl>*, selectors::kleene_value::KleeneValue, selectors::kleene_value::KleeneValue, selectors::kleene_value::impl$1::any_false::closure_env$0<ref$<enum2$<selectors::parser::Component<style::gecko::selector_parser::SelectorImpl> > >,ref_mut$<selectors::parser::SelectorIter<style::gecko::selector_parser::SelectorImpl> >,selectors::matching::matches_compound_selector::closure_env$0<style::gecko::wrapper::GeckoElement> >, selectors::matching::matches_compound_selector::closure_env$0<style::gecko::wrapper::GeckoElement>) [servo/components/selectors/kleene_value.rs]
selectors::kleene_value::KleeneValue::any_false(selectors::parser::SelectorIter<style::gecko::selector_parser::SelectorImpl>*, selectors::matching::matches_compound_selector::closure_env$0<style::gecko::wrapper::GeckoElement>) [servo/components/selectors/kleene_value.rs]
selectors::matching::matches_compound_selector(selectors::parser::SelectorIter<style::gecko::selector_parser::SelectorImpl>*, style::gecko::wrapper::GeckoElement*, selectors::context::MatchingContext<style::gecko::selector_parser::SelectorImpl>*, selectors::matching::SubjectOrPseudoElement) [servo/components/selectors/matching.rs]
selectors::matching::matches_complex_selector_internal<style::gecko::wrapper::GeckoElement>(selectors::parser::SelectorIter<style::gecko::selector_parser::SelectorImpl>, style::gecko::wrapper::GeckoElement*, selectors::context::MatchingContext<style::gecko::selector_parser::SelectorImpl>*, selectors::matching::SubjectOrPseudoElement, selectors::matching::SubjectOrPseudoElement) [servo/components/selectors/matching.rs]
selectors::matching::matches_complex_selector(selectors::parser::SelectorIter<style::gecko::selector_parser::SelectorImpl>, style::gecko::wrapper::GeckoElement*, selectors::context::MatchingContext<style::gecko::selector_parser::SelectorImpl>*, selectors::matching::SubjectOrPseudoElement) [servo/components/selectors/matching.rs]
selectors::matching::matches_selector_kleene(selectors::parser::Selector<style::gecko::selector_parser::SelectorImpl>*, unsigned long long, enum2$<core::option::Option<ref$<selectors::parser::AncestorHashes> > >, style::gecko::wrapper::GeckoElement*, selectors::context::MatchingContext<style::gecko::selector_parser::SelectorImpl>*) [servo/components/selectors/matching.rs]
selectors::matching::matches_selector(selectors::parser::Selector<style::gecko::selector_parser::SelectorImpl>*, unsigned long long, enum2$<core::option::Option<ref$<selectors::parser::AncestorHashes> > >, style::gecko::wrapper::GeckoElement*, selectors::context::MatchingContext<style::gecko::selector_parser::SelectorImpl>*) [servo/components/selectors/matching.rs]
selectors::matching::matches_selector_list(selectors::parser::SelectorList<style::gecko::selector_parser::SelectorImpl>*, style::gecko::wrapper::GeckoElement*, selectors::context::MatchingContext<style::gecko::selector_parser::SelectorImpl>*) [servo/components/selectors/matching.rs]
style::dom_apis::query_selector_fast::closure$2(style::dom_apis::query_selector_fast::closure_env$2<style::gecko::wrapper::GeckoElement,style::dom_apis::QueryFirst>*, style::gecko::wrapper::GeckoElement) [servo/components/style/dom_apis.rs]
style::dom_apis::collect_all_elements(style::gecko::wrapper::GeckoNode, enum2$<core::option::Option<style::gecko::wrapper::GeckoElement> >*, style::dom_apis::query_selector_fast::closure_env$2<style::gecko::wrapper::GeckoElement,style::dom_apis::QueryFirst>) [servo/components/style/dom_apis.rs]
style::dom_apis::query_selector_fast(style::gecko::wrapper::GeckoNode, selectors::parser::SelectorList<style::gecko::selector_parser::SelectorImpl>*, enum2$<core::option::Option<style::gecko::wrapper::GeckoElement> >*, selectors::context::MatchingContext<style::gecko::selector_parser::SelectorImpl>*) [servo/components/style/dom_apis.rs]
style::dom_apis::query_selector(style::gecko::wrapper::GeckoNode, selectors::parser::SelectorList<style::gecko::selector_parser::SelectorImpl>*, enum2$<core::option::Option<style::gecko::wrapper::GeckoElement> >*, style::dom_apis::MayUseInvalidation) [servo/components/style/dom_apis.rs]
geckoservo::glue::Servo_SelectorList_QueryFirst(style::gecko_bindings::structs::root::nsINode*, selectors::parser::SelectorList<style::gecko::selector_parser::SelectorImpl>*, bool) [servo/ports/geckolib/glue.rs]
nsINode::QuerySelector(nsTSubstring<char> const&, mozilla::ErrorResult&) [dom/base/nsINode.cpp]
querySelector script[nonce]
mozilla::dom::Document_Binding::querySelector(JSContext*, JS::Handle<JSObject *>, void*, JSJitMethodCallArgs const&) [dom/bindings/DocumentBinding.cpp]
mozilla::dom::binding_detail::GenericMethod<mozilla::dom::binding_detail::NormalThisPolicy,mozilla::dom::binding_detail::ThrowExceptions>(JSContext*, unsigned int, JS::Value*) [dom/bindings/BindingUtils.cpp]
0x39dcf0b5ee6
js::RunScript
js::RunScript
EventHandlerNonNull
EventDispatcher::Dispatch load
EventDispatcher::Dispatch
XRE_InitChildProcess
(root)

Comment 2

[BugBot [:suhaib / :marco]]

The Bugbug bot thinks this bug should belong to the 'Firefox::Tabbed Browser' component, but is not confident enough to move the bug to that component.

Comment 3

[Daniel Holbert [:dholbert]]

Unfortunately the link in comment 0 now loads a short preview of the article, with an overlay saying "This gift link is expired. subscribe OR sign in."

So: not directly testable without a subscription to The Atlantic.

Comment 4

[Daniel Holbert [:dholbert]]

Reporter: can you still reproduce the issue? (Maybe you can't test anymore -- you might get blocked by the same thing I'm hitting if you don't have a The Atlantic subscription)

A few anomalies I'm noticing here:
(1) Based just on the crash report (comment 1), I'm not entirely sure the The Atlantic website was the thing causing the issue here -- at last, the crash report that you linked in comment 1 shows about:profiles as the (hidden) URL-of-the-crashing-process. So if that crash report is to be trusted, you had about:profiles open and that tab is what you killed to generate that crash report, according to the crash report. Though it's possible that the URL got misreported -- e.g. maybe some of the work was happening in an iframe, which maybe started with about:blank, and maybe about:blank/about:profiles share the same process in some circumstances or get misreported in crash-stats for some reason.

(2) Looking at the profile link that you shared ( https://share.firefox.dev/4oitxEV ), it looks like the site might have just gotten stuck in an infinite loop, repeatedly appending a script, or something along those lines. The network track has an infinite series of network requests, and the events track shows a script being appended repeatedly (every 10ms). It looks like maybe every script load event is causing another script element to get appended, maybe? And I think this shows up as layout work because the load handler calls querySelector which uses the style system to find a matching element. I think none of those calls are too expensive (only on the order of 10ms - not free, but not a hang) -- but it's the infinite series of script-append/load-event/script-append/load-event/... that's responsible for this showing up as looking like a neverending stream of work here.

Comment 5

[Daniel Holbert [:dholbert]]

In any case it seems like the issue here was that infinite-series-of-script-appends/load-events in your performance profile -- i.e. the site managed to get itself into an infinite loop.

If that's still reproducible and is Firefox-specific for some reason, that would be interesting to look at. But if not, then this might be a case where the site just had a busted deployment and it's hard to reason about what went wrong without being able to poke directly...

Comment 6

[mirh]

(1) Chances are I might have killed the whole browser, not just the tab

(2) I probably do happen to bump into one of these cases at least once or twice a year. Is there anything else I can use to help reporting?

Comment 7

[Daniel Holbert [:dholbert]]

(In reply to mirh from comment #6)

(1) Chances are I might have killed the whole browser, not just the tab

Maybe! The crash report shows up as a content-process crash (i.e. just a tab's rendering process, rather than the parent process). But maybe there were several killed processes, who knows.

In any case though, your crash report does show that we were in querySelector which matches what your performance-profile shows (and doesn't match what about:profiles would typically be doing); so it's probably just a crash-reporting-infra bug that your crash report got marked as being for the URL about:profiles.

(2) I probably do happen to bump into one of these cases at least once or twice a year. Is there anything else I can use to help reporting?

Capturing a performance profile (as you did) is super handy. In general, I don't have suggestions beyond that; next-steps depend on what shows up in the profile.

Also, good news -- looking a bit deeper at your profile, I'm pretty confident this was the same root-cause as bug 2042605 -- the profile looks similar (hang in querySelector, with what looks like an infinite loop of script-load/execution). The timeline matches up, too (bug 2042605 was filed around the same time as this one). Different news site, but news sites use a lot of the same analytics resources etc.

Comment 8

[Daniel Holbert [:dholbert]]

Er, given that this was a WebCompat site-report, I'll call this fixed-by that bug instead of duplicate-of that bug.

Comment 9

[Raul Bucata]

Verified as FIXED using the RC Build

Tested with:

Browser / Version: Firefox 153.0-candidate build 1
Operating System: Windows 10 PRO x64