Opened 2 years ago

Last modified 11 months ago

#17863 new bug

WebPositive crashes on overuse of Date.getMilliseconds()

Reported by: thebuck Owned by: pulkomandy
Priority: normal Milestone: Unscheduled
Component: Kits/Web Kit Version: R1/Development
Keywords: Cc:
Blocked By: Blocking:
Platform: x86-64

Description

To reproduce: Call the getMilliseconds method of Date regularly (JavaScript).

This will crash WebPositive reliably after a number of calls with the number heavily depending on the call frequency employed.

Attachments (2)

timetest.html (382 bytes ) - added by thebuck 2 years ago.
For me, on hrev56334 x86_64, this crashes it after about 60 calls. Feel free to adjust the for-loop iterations (10 by now).
timetest.c (416 bytes ) - added by thebuck 2 years ago.
Got nothing unusual when testing on hrev56334 and hrev56475.

Download all attachments as: .zip

Change History (9)

by thebuck, 2 years ago

Attachment: timetest.html added

For me, on hrev56334 x86_64, this crashes it after about 60 calls. Feel free to adjust the for-loop iterations (10 by now).

comment:1 by thebuck, 2 years ago

Besides, the maximum reachable frequency when using setInterval() callbacks was at roughly 30 per second for me, even for pure calculation tasks without drawing. Pretty slow.

comment:2 by thebuck, 2 years ago

Oops, just tried on Linux in a WebKit-based browser: same result, exactly 60! Generic WebKit bug!

comment:3 by pulkomandy, 2 years ago

The low precision is intentional on webkit side, to prevent javascript gode to perform spectre/meltdown type of attacks that rely on precise timing measurements.

If the crash is generic webkit, maybe report it in the webkit bugtracker instead?

in reply to:  3 comment:4 by thebuck, 2 years ago

If the crash is generic webkit, maybe report it in the webkit bugtracker instead?

Rather not. I now suspect it to be machine/CPU-dependant:

  • could not reproduce on any other machine
  • GLTeapot demo fires crash reporter up instantly, but continues to rotate... That app repeatedly measures time, right?

I will try to find out which time measurement function it calls and write a little while(1) get_the_time(); test.

Version 0, edited 2 years ago by thebuck (next)

comment:5 by waddlesplash, 2 years ago

GLTeapot is known to be unstable, that is almost certainly totally unrelated to timekeeping. Plenty of other applications fetch the time rapidly.

by thebuck, 2 years ago

Attachment: timetest.c added

Got nothing unusual when testing on hrev56334 and hrev56475.

in reply to:  5 comment:6 by thebuck, 2 years ago

GLTeapot is known to be unstable

GLTeapot is already stable in hrev56334, my comment:4 were older memories, sorry. Maybe the crashes occurred with an older radeon_hd or GLTeapot version...

comment:7 by nephele, 11 months ago

Component: Applications/WebPositiveKits/Web Kit
Priority: highnormal
Note: See TracTickets for help on using tickets.