Opened 9 years ago

Closed 5 years ago

#6738 closed bug (fixed)

app_server hangs?

Reported by: kirilla Owned by: stippi
Priority: normal Milestone: R1
Component: Servers/app_server Version: R1/Development
Keywords: Cc:
Blocked By: Blocking: #6929, #10258
Has a Patch: no Platform: All


App_server hangs, from what I can tell, occasionally, in Haiku hrev37150.

Mouse clicks stop doing anything meaningful. I can't raise or lower windows, can't shift focus to some other window or view. I -can- move the mouse around, on-screen, but after a while the pointer hangs too.

Volountarily entering KDL to have a look-see, reveals that on my quad core, three idle threads are running, and there's a w:offscreen something thread running, which belongs to app_server. A backtrace hints at Painter, agg and a chain of 10-20 calls on a recursive bezier function.

A locking issue in Painter, maybe? I think WebPositive is the app which triggers this. Will try to look out for a website that triggers it.

Sadly I have no means to provide serial output or snapshots right now.

Attachments (1)

syslog (14.1 KB) - added by jonas.kirilla 9 years ago.

Download all attachments as: .zip

Change History (17)

comment:1 Changed 9 years ago by jonas.kirilla

It happened again in hrev39121. WebPositive triggered it.

KDL showed a thread running somewhere in this code:

recursing, with the level argument increasing in steps of 1, from 0 to 32.

There's a curve_recursion_limit = 32.

Perhaps the

if (level > curve_recursion_limit)

was meant to be

if (level >= curve_recursion_limit)

comment:2 Changed 9 years ago by BMeow

I can reliable reproduce this issue on real hardware and on Qemu by trying to view or any other Gitorious project site in Web+. Tested on hrev39121 gcc4 anyboot nightly.

comment:3 Changed 9 years ago by axeld

Owner: changed from axeld to stippi
Status: newassigned

comment:4 Changed 9 years ago by jonas.kirilla

This could perhaps shed some light on the matter:

My stack traces show the eight arguments (of the four points) as all 0xff...ffe for maybe ten of the last runs of recursion.

comment:5 Changed 9 years ago by jonas.kirilla


Last edited 9 years ago by jonas.kirilla (previous) (diff)

comment:6 in reply to:  description Changed 9 years ago by bonefish

Replying to kirilla:

Sadly I have no means to provide serial output or snapshots right now.

When you leave KDL the session is written to the syslog after a few seconds (at least if the kernel is still working and the syslog daemon is still running). So the info should be available after reboot (or even in the same session via ssh, if that is still working).

No clue what double value that hex value represents (is it not shown?). I suppose a dump of the curve_div4 object would help, too, if anyone wants to try and understand what is happening exactly.

Changed 9 years ago by jonas.kirilla

Attachment: syslog added

comment:7 Changed 9 years ago by jonas.kirilla

Scratch that. As can be seen in the syslog excerpt, the hex value is 0xffffffe000000000. These are coordinates, in double format.

The webpage suggests that this hexadecimal representation of a floating-point number is -NaN, not a number.

comment:8 Changed 9 years ago by bonefish

What apparently happens:

  1. The client sends a drawing command (drawing a shape) with invalid parameters (e.g. NaN coordinates).
  2. The app server doesn't check for invalid values (or misses this case) and calls curve4_div() with invalid parameters.
  3. curve4_div::recursive_bezier() always recurses to the last level, causing 234 - 1 calls which should keep the CPU quite busy. I haven't checked, but possibly it also tries to add a few billion points to the object's point array, which would cause serious memory issues. But even if it doesn't, the CPU hogging alone (probably while holding some lock) could already make the app server appear to hang.

So the measures to be taken are:

  • Fix parameter checking in the app server.
  • Possibly add sanity limits to curve4_div::recursive_bezier().
  • Fix the client side (assuming that it is indeed the source of the bad values).

comment:9 Changed 9 years ago by jonas.kirilla

What if it's a math issue?

I had a quick look at our math_test, but couldn't get it to build.

Running (port attempt: seems to suggest there are issues with Haiku (or my hardware?).

Maybe this could be of interest:

comment:10 Changed 8 years ago by anevilyak

Blocking: 6929 added

(In #6929) Duplicate of #6738.

comment:11 Changed 8 years ago by anevilyak

If helpful, #6929 has some sites that reliably reproduce this issue.

comment:12 Changed 8 years ago by stippi

I have tried to reproduce the issue with some debugging added to the BShape iteration function in Painter, but neither with the Firefox add-on page from #6929, nor with the Gitorous page for Qt can I reproduce the problem in QEMU. I will check it out on real hardware next. The revision I am running is hrev40374 build as GCC4 based hybrid.

comment:13 Changed 8 years ago by diver

Can't reproduce #6929 either.

comment:14 Changed 5 years ago by pulkomandy

Currently reproducible by going to using NetSurf 3.2.

comment:15 Changed 5 years ago by pulkomandy

Blocking: 10258 added

(In #10258) The test case in WebKit does not trigger the issue anymore, but there are other ways to reproduce this in #6738.

comment:16 Changed 5 years ago by pulkomandy

Resolution: fixed
Status: assignedclosed

Fixed in hrev48056.

Note: See TracTickets for help on using tickets.