<html>
<head>
<base href="https://bugs.webkit.org/" />
</head>
<body><table border="1" cellspacing="0" cellpadding="8">
<tr>
<th>Bug ID</th>
<td><a class="bz_bug_link
bz_status_NEW "
title="NEW - Runaway WebContent process CPU & memory @ foxnews.com"
href="https://bugs.webkit.org/show_bug.cgi?id=158290">158290</a>
</td>
</tr>
<tr>
<th>Summary</th>
<td>Runaway WebContent process CPU & memory @ foxnews.com
</td>
</tr>
<tr>
<th>Classification</th>
<td>Unclassified
</td>
</tr>
<tr>
<th>Product</th>
<td>WebKit
</td>
</tr>
<tr>
<th>Version</th>
<td>WebKit Nightly Build
</td>
</tr>
<tr>
<th>Hardware</th>
<td>All
</td>
</tr>
<tr>
<th>OS</th>
<td>All
</td>
</tr>
<tr>
<th>Status</th>
<td>NEW
</td>
</tr>
<tr>
<th>Severity</th>
<td>Normal
</td>
</tr>
<tr>
<th>Priority</th>
<td>P2
</td>
</tr>
<tr>
<th>Component</th>
<td>JavaScriptCore
</td>
</tr>
<tr>
<th>Assignee</th>
<td>webkit-unassigned@lists.webkit.org
</td>
</tr>
<tr>
<th>Reporter</th>
<td>msaboff@apple.com
</td>
</tr></table>
<p>
<div>
<pre>Some foxnews.com pages with embedded videos have this code:
start : function() {
if (this.started === true) {
return;
}
try {
this.plugin.Media.open(this.getMediaName(), this.media.getDuration(), this.getPlayerName()); // <== Exception here
this.started = true;
} catch (error) {
this.error(error);
}
this.play(); // recursively call play()
}
play : function() {
if (this.started !== true) {
this.start(); // <== call here
return;
}
try {
this.plugin.Media.play(this.getMediaName(), this.getPlaybackCore().getCurrentTime() || 0);
} catch (error) {
this.error(error);
}
}
This can end up being a mutual recursive call chain that will eventually exceed the stack space. This happens when this.plugin.Media.open() in start() throws an exception. That exception is caught in the catch block, but start() then calls play(). At the top of play(), it will recursively call start() and we end up in a recursive loop. While the stack grows, the amount of memory used goes up dramatically. The memory use is due to the error objects that are created for each throw. The catch will be handled in baseline JIT'ed code as the higher tiers will ORS exit at the start of their catch blocks. The baseline JIT'ed code will allocate a local for the thrown value and the conservative scan of the stack during GC will include the thrown value. This means that the error objects for all start() frames further up the stack will not be collected.</pre>
</div>
</p>
<hr>
<span>You are receiving this mail because:</span>
<ul>
<li>You are the assignee for the bug.</li>
</ul>
</body>
</html>