Avoid tail recursion to mitigate stack exhaustion

Avoid tail recursion to mitigate stack exhaustion

This converts tail recursion in findFocusableElementRecursively{Forward,Backward}
to loop.
These functions still use recursion for nested DOMs.

This avoids stack exhaustion in some cases such as a <select> has too many
<option>s (<select> and <option> combination is somewhat special because
they use user-agent shadow DOM and are handled specially).

BUG=445194
TEST=fast/dom/shadow/focus-controller-recursion-crash.html doesn't crash

Committed: https://src.chromium.org/viewvc/blink?view=rev&revision=197831

[kochi, 2015-06-25 07:11:14]

Patchset #1 (id:1) has been deleted

[kochi, 2015-06-25 07:12:05]

The CQ bit was checked by [email protected] to run a CQ dry run

[kochi, 2015-06-25 07:13:06]

[email protected] changed reviewers:
+ [email protected]

[kochi, 2015-06-25 07:13:07]

PTAL

[kochi, 2015-06-25 07:27:11]

The CQ bit was unchecked by [email protected]

[kochi, 2015-06-25 07:27:50]

The CQ bit was checked by [email protected] to run a CQ dry run

[hayato, 2015-06-25 07:31:02]

I think we can have a layout test for this.

https://codereview.chromium.org/1204213002/diff/20001/Source/core/page/FocusC...
File Source/core/page/FocusController.cpp (right):

https://codereview.chromium.org/1204213002/diff/20001/Source/core/page/FocusC...
Source/core/page/FocusController.cpp:382: Element*
findFocusableElementRecursivelyForward(const FocusNavigationScope& scope, Node*
start)
The function name should be changed?

https://codereview.chromium.org/1204213002/diff/20001/Source/core/page/FocusC...
Source/core/page/FocusController.cpp:409: return found;
return nullptr;

https://codereview.chromium.org/1204213002/diff/20001/Source/core/page/FocusC...
Source/core/page/FocusController.cpp:412: Element*
findFocusableElementRecursivelyBackward(const FocusNavigationScope& scope, Node*
start)
The same.

https://codereview.chromium.org/1204213002/diff/20001/Source/core/page/FocusC...
Source/core/page/FocusController.cpp:447: return found;
return nullptr;

[kochi, 2015-06-25 07:56:32]

I'm working on adding a layout test.

It seems *Backward() still causes stack exhaustion,
will take a deeper look.

https://codereview.chromium.org/1204213002/diff/20001/Source/core/page/FocusC...
File Source/core/page/FocusController.cpp (right):

https://codereview.chromium.org/1204213002/diff/20001/Source/core/page/FocusC...
Source/core/page/FocusController.cpp:382: Element*
findFocusableElementRecursivelyForward(const FocusNavigationScope& scope, Node*
start)
On 2015/06/25 07:31:02, hayato wrote:
> The function name should be changed?

No, this function is still recursive.
(line 391, 404)

The level of recursion is ~equal to DOM nesting level.

The previous code used recursion for sibling DOM nodes.

https://codereview.chromium.org/1204213002/diff/20001/Source/core/page/FocusC...
Source/core/page/FocusController.cpp:409: return found;
On 2015/06/25 07:31:02, hayato wrote:
> return nullptr;

No, if line 398 breaks, |found| can be non-null.

https://codereview.chromium.org/1204213002/diff/20001/Source/core/page/FocusC...
Source/core/page/FocusController.cpp:447: return found;
On 2015/06/25 07:31:02, hayato wrote:
> return nullptr;

No, if line 427 or 443 breaks, |found| is non-null.

[hayato, 2015-06-25 08:04:40]

https://codereview.chromium.org/1204213002/diff/20001/Source/core/page/FocusC...
File Source/core/page/FocusController.cpp (right):

https://codereview.chromium.org/1204213002/diff/20001/Source/core/page/FocusC...
Source/core/page/FocusController.cpp:382: Element*
findFocusableElementRecursivelyForward(const FocusNavigationScope& scope, Node*
start)
On 2015/06/25 07:56:32, Takayoshi Kochi wrote:
> On 2015/06/25 07:31:02, hayato wrote:
> > The function name should be changed?
> 
> No, this function is still recursive.
> (line 391, 404)
> 
> The level of recursion is ~equal to DOM nesting level.
> 
> The previous code used recursion for sibling DOM nodes. 

Acknowledged.

https://codereview.chromium.org/1204213002/diff/20001/Source/core/page/FocusC...
Source/core/page/FocusController.cpp:409: return found;
On 2015/06/25 07:56:32, Takayoshi Kochi wrote:
> On 2015/06/25 07:31:02, hayato wrote:
> > return nullptr;
> 
> No, if line 398 breaks, |found| can be non-null.

Ops. I didn't realize it.
line 398 should `return found`, instead of `break`.

https://codereview.chromium.org/1204213002/diff/20001/Source/core/page/FocusC...
Source/core/page/FocusController.cpp:447: return found;
On 2015/06/25 07:56:32, Takayoshi Kochi wrote:
> On 2015/06/25 07:31:02, hayato wrote:
> > return nullptr;
> 
> No, if line 427 or 443 breaks, |found| is non-null.

Instead of `break`, they should `return found`.

[kochi, 2015-06-25 08:23:38]

PTAL

Added a layout test.

https://codereview.chromium.org/1204213002/diff/20001/Source/core/page/FocusC...
File Source/core/page/FocusController.cpp (right):

https://codereview.chromium.org/1204213002/diff/20001/Source/core/page/FocusC...
Source/core/page/FocusController.cpp:409: return found;
On 2015/06/25 08:04:40, hayato wrote:
> On 2015/06/25 07:56:32, Takayoshi Kochi wrote:
> > On 2015/06/25 07:31:02, hayato wrote:
> > > return nullptr;
> > 
> > No, if line 398 breaks, |found| can be non-null.
> 
> Ops. I didn't realize it.
> line 398 should `return found`, instead of `break`.

Done.

If the code doesn't break there, line 409 should return nullptr, as the original
comment suggests.

https://codereview.chromium.org/1204213002/diff/20001/Source/core/page/FocusC...
Source/core/page/FocusController.cpp:447: return found;
On 2015/06/25 08:04:40, hayato wrote:
> On 2015/06/25 07:56:32, Takayoshi Kochi wrote:
> > On 2015/06/25 07:31:02, hayato wrote:
> > > return nullptr;
> > 
> > No, if line 427 or 443 breaks, |found| is non-null.
> 
> Instead of `break`, they should `return found`.

Done.

[kochi, 2015-06-25 08:44:05]

https://codereview.chromium.org/1204213002/diff/80001/LayoutTests/fast/dom/sh...
File LayoutTests/fast/dom/shadow/focus-controller-recursion-crash.html (right):

https://codereview.chromium.org/1204213002/diff/80001/LayoutTests/fast/dom/sh...
LayoutTests/fast/dom/shadow/focus-controller-recursion-crash.html:9: for (var i
= 0; i < 100000; ++i) {
I'm concerned that this is too much for layout test bots.

On my 64bit linux box it started to crash over ~90000, but could be
lower on other platforms.
I'll lower the value and see if other bots fail till I can find a
good threshold.

[kochi, 2015-06-25 09:06:33]

The CQ bit was checked by [email protected] to run a CQ dry run

[commit-bot: I haz the power, 2015-06-25 09:07:22]

Dry run: CQ is trying da patch. Follow status at
 https://chromium-cq-status.appspot.com/patch-status/1204213002/80001

[hayato, 2015-06-25 10:36:51]

lgtm

[commit-bot: I haz the power, 2015-06-25 11:28:37]

The CQ bit was unchecked by [email protected]

[commit-bot: I haz the power, 2015-06-25 11:28:38]

Dry run: This issue passed the CQ dry run.

[kochi, 2015-06-25 14:26:36]

On 2015/06/25 08:44:05, Takayoshi Kochi wrote:
>
https://codereview.chromium.org/1204213002/diff/80001/LayoutTests/fast/dom/sh...
> File LayoutTests/fast/dom/shadow/focus-controller-recursion-crash.html
(right):
> 
>
https://codereview.chromium.org/1204213002/diff/80001/LayoutTests/fast/dom/sh...
> LayoutTests/fast/dom/shadow/focus-controller-recursion-crash.html:9: for (var
i
> = 0; i < 100000; ++i) {
> I'm concerned that this is too much for layout test bots.
> 
> On my 64bit linux box it started to crash over ~90000, but could be
> lower on other platforms.
> I'll lower the value and see if other bots fail till I can find a
> good threshold.

According to trybots,
https://codereview.chromium.org/1199273003/
50000 looks a good threshold.

[kochi, 2015-06-25 15:28:45]

The CQ bit was checked by [email protected]

[kochi, 2015-06-25 15:28:46]

The patchset sent to the CQ was uploaded after l-g-t-m from [email protected]
Link to the patchset: https://codereview.chromium.org/1204213002/#ps100001
(title: "lower the loop threshold from 100000 to 50000")

[commit-bot: I haz the power, 2015-06-25 15:29:00]

CQ is trying da patch. Follow status at
 https://chromium-cq-status.appspot.com/patch-status/1204213002/100001

[commit-bot: I haz the power, 2015-06-25 16:40:39]

Committed patchset #5 (id:100001) as
https://src.chromium.org/viewvc/blink?view=rev&revision=197831

[eae, 2015-06-25 20:05:18]

The new test added by this change is really slow (10+ seconds) and is timing out
on debug bots.

[eae, 2015-06-25 20:08:11]

On 2015/06/25 20:05:18, eae wrote:
> The new test added by this change is really slow (10+ seconds) and is timing
out
> on debug bots.

Please fix the test or skip it on debug, marking as slow for debug builds for
now.