New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 771653 link

Starred by 2 users

Issue metadata

Status: Duplicate
Owner:
Closed: Oct 2017
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Windows
Pri: 2
Type: Bug-Regression

Blocked on:
issue v8:6964



Sign in to add a comment

Since Chrome 61, I receive a "Uncaught RangeError: Maximum call stack size exceeded" on our web app

Reported by martin.k...@cunio.de, Oct 4 2017

Issue description

UserAgent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36

Steps to reproduce the problem:
1. open https://pro.cunio.de

What is the expected behavior?
Load as in Chrome 60. It also works on other browsers or Chrome 61 on Mac

What went wrong?
styles.bundle.js isn't picked and instead, the console throws: "Uncaught RangeError: Maximum call stack size exceeded"

Did this work before? Yes 60

Chrome version: 61.0.3163.100  Channel: stable
OS Version: 10.0
Flash Version:
 
Cc: pbomm...@chromium.org
Components: -Blink Blink>JavaScript
Labels: M-63 M-61
Able to reproduce the issue on Windows 10 and 7 with latest Chrome Stable(61.0.3163.100) and dev(63.0.3230.0),the same works fine on Mac and Linux. 

Note : This works fine with Chrome Beta(62.0.3202.38), Tried to bisect and wasn't successful since very first build of M61 also exhibits the problem.
Cc: sc00335...@techmahindra.com
Labels: Triaged-ET Needs-Triage-M61
Status: Untriaged (was: Unconfirmed)
This issue shows inconsistent behaviour. 
In latest stable 61.0.3163.100 -- Page doesn't load and shows error in console
In latest beta 62.0.3202.45 -- Page loads without any error
In latest dev 63.0.3230.0 -- Page doesn't load and shows error in console
In latest canary 63.0.3233.0 -- Page loads without any error

Marking this as Untriaged for further Inputs.
Components: -Blink>JavaScript Blink>JavaScript>Interpreter
Owner: rmcilroy@chromium.org
Status: Assigned (was: Untriaged)
Sounds like the already known issue about the call stack size?
Not sure. There were two known ignition stack issues:

  1. Compilation of large expressions (https://bugs.chromium.org/p/chromium/issues/detail?id=731861), fix in 61
  2. Execution with heavy recursion (https://bugs.chromium.org/p/chromium/issues/detail?id=753705), fix merged in 62.0.3202.19 and 63.0.3207.0

So, neither of these really match what we're seeing, especially if 60 works. FWIW, running with --js-flags=--abort-on-stack-or-string-length-overflow, the error is somewhere in CompileTopLevel.

Anecdotally, locally I don't see the issue in 61.0.3163.100, but do see it in 63.0.3232.0.
Locally, I see the stack overflow when eagerly generating bytecode for the inner function whose raw_name is:

../../../../css-loader/index.js?{"sourceMap":false,"importLoaders":1}!../../../../postcss-loader/index.js?{"ident":"postcss"}!../../../../sass-loader/lib/loader.js?{"sourceMap":false,"precision":8,"includePaths":[]}!../../../../../src/styles.scss

The AST of said function doesn't seem particularly large, so I'm not sure what the issue is.
 Issue 773390  has been merged into this issue.
Cc: rmcilroy@chromium.org marja@chromium.org
Owner: leszeks@chromium.org
Assigning to Leszek for now since he's had a look, and adding Marja in case this is related to parser skipping lazy functions.
Mergedinto: 731861
Status: Duplicate (was: Assigned)
Taking another look, our ast printing wasn't right for inner functions. The AST for this function is indeed lots of deeply nested additions (a nesting level of about 3000). Marking as a dupe of 731861 (which is effectively WontFix, there's not much more we can do here).

I'm guessing the fluctuation in what version works is because this code is near the threshold of functionality, and what you're seeing is fluctuations in the size of the stack above the bytecode compiler.
Project Member

Comment 9 by bugdroid1@chromium.org, Oct 11 2017

The following revision refers to this bug:
  https://chromium.googlesource.com/v8/v8.git/+/6576495f3a7a07adece5f4689019c6f2f71dc439

commit 6576495f3a7a07adece5f4689019c6f2f71dc439
Author: Leszek Swirski <leszeks@chromium.org>
Date: Wed Oct 11 16:24:05 2017

[ignition] Fix AST printing to print eager inner literals

AST printing was printing the literal of the ParseInfo, which is the
current function being parsed. However, for eager compilation of inner
literals, this may not be the function being compiled, which is in the
CompilationInfo.

So, for --print-ast, we have to get the FunctionLiteral from
CompilationInfo.

Bug:  chromium:771653 
Change-Id: I2088e1f1f7b8a3d664aae65cab699a641e5fd302
Reviewed-on: https://chromium-review.googlesource.com/712354
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#48470}
[modify] https://crrev.com/6576495f3a7a07adece5f4689019c6f2f71dc439/src/interpreter/interpreter.cc

Blockedon: v8:6964
Project Member

Comment 11 by bugdroid1@chromium.org, Oct 25 2017

The following revision refers to this bug:
  https://chromium.googlesource.com/v8/v8.git/+/52ef2a1c270e612906936d64419c335d62fc5822

commit 52ef2a1c270e612906936d64419c335d62fc5822
Author: Leszek Swirski <leszeks@chromium.org>
Date: Wed Oct 25 11:28:55 2017

[parser] Add an n-ary node for large binop chains

Expressions of the form

    a_0 + a_1 + a_2 + a_3 + ... + a_n

seem to be reasonably common for cases such as building templates.
However, parsing these expressions results in a n-deep expression tree:

           ...
          /
         +
        / \
       +  a_2
      / \
    a_0 a_1

Traversing this tree during compilation can cause a stack overflow when n is
large.

Instead, for left-associate operations such as add, we now build up an
n-ary node in the parse tree, of the form

         n-ary +
       /  |      \
      /   |  ...  \
    a_0  a_1      a_n

The bytecode compiler can now iterate through the child expressions
rather than recursing.

This patch only supports arithmetic operations -- subsequent patches
will enable the same optimization for logical tests and comma
expressions.

Bug:  v8:6964 
Bug:  chromium:724961 
Bug: chromium:731861
Bug:  chromium:752081 
Bug:  chromium:771653 
Bug: chromium:777302
Change-Id: Ie97e4ce42506fe62a7bc4ffbdaa90a9f698352cb
Reviewed-on: https://chromium-review.googlesource.com/733120
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#48920}
[modify] https://crrev.com/52ef2a1c270e612906936d64419c335d62fc5822/src/ast/ast-expression-rewriter.cc
[modify] https://crrev.com/52ef2a1c270e612906936d64419c335d62fc5822/src/ast/ast-numbering.cc
[modify] https://crrev.com/52ef2a1c270e612906936d64419c335d62fc5822/src/ast/ast-traversal-visitor.h
[modify] https://crrev.com/52ef2a1c270e612906936d64419c335d62fc5822/src/ast/ast.h
[modify] https://crrev.com/52ef2a1c270e612906936d64419c335d62fc5822/src/ast/prettyprinter.cc
[modify] https://crrev.com/52ef2a1c270e612906936d64419c335d62fc5822/src/interpreter/bytecode-array-builder.h
[modify] https://crrev.com/52ef2a1c270e612906936d64419c335d62fc5822/src/interpreter/bytecode-generator.cc
[modify] https://crrev.com/52ef2a1c270e612906936d64419c335d62fc5822/src/interpreter/bytecode-generator.h
[modify] https://crrev.com/52ef2a1c270e612906936d64419c335d62fc5822/src/parsing/parser-base.h
[modify] https://crrev.com/52ef2a1c270e612906936d64419c335d62fc5822/src/parsing/parser.cc
[modify] https://crrev.com/52ef2a1c270e612906936d64419c335d62fc5822/src/parsing/parser.h
[modify] https://crrev.com/52ef2a1c270e612906936d64419c335d62fc5822/src/parsing/pattern-rewriter.cc
[modify] https://crrev.com/52ef2a1c270e612906936d64419c335d62fc5822/src/parsing/preparser.h
[modify] https://crrev.com/52ef2a1c270e612906936d64419c335d62fc5822/test/cctest/interpreter/bytecode_expectations/AssignmentsInBinaryExpression.golden
[modify] https://crrev.com/52ef2a1c270e612906936d64419c335d62fc5822/test/cctest/interpreter/bytecode_expectations/StringConcat.golden
[add] https://crrev.com/52ef2a1c270e612906936d64419c335d62fc5822/test/mjsunit/compiler/nary-binary-ops.js
[modify] https://crrev.com/52ef2a1c270e612906936d64419c335d62fc5822/test/unittests/compiler-dispatcher/compiler-dispatcher-unittest.cc
[modify] https://crrev.com/52ef2a1c270e612906936d64419c335d62fc5822/test/unittests/compiler-dispatcher/unoptimized-compile-job-unittest.cc

Sign in to add a comment