Bug 1151048. Disable speculative tokenization in the parser if it's failing too much. r=hsivonen

parser/html/nsHtml5StreamParser.cpp

@@ -1315,7 +1315,11 @@ nsHtml5StreamParser::ParseAvailableData()
   if (IsTerminatedOrInterrupted()) {
     return;
   }
-  
+
+  if (mSpeculating && !IsSpeculationEnabled()) {
+    return;
+  }
+
   for (;;) {
     if (!mFirstBuffer->hasMore()) {
       if (mFirstBuffer == mLastBuffer) {
@@ -1454,6 +1458,7 @@ nsHtml5StreamParser::ContinueAfterScripts(nsHtml5Tokenizer* aTokenizer,
         !aTreeBuilder->snapshotMatches(speculation->GetSnapshot())) {
       speculationFailed = true;
       // We've got a failed speculation :-(
+      MaybeDisableFutureSpeculation();
       Interrupt(); // Make the parser thread release the tokenizer mutex sooner
       // now fall out of the speculationAutoLock into the tokenizerAutoLock block
     } else {

parser/html/nsHtml5StreamParser.h

@@ -363,6 +363,25 @@ class nsHtml5StreamParser : public nsICharsetDetectionObserver {
      */
     void TimerFlush();
 
+    /**
+     * Called when speculation fails.
+     */
+    void MaybeDisableFutureSpeculation()
+    {
+        mSpeculationFailureCount++;
+    }
+
+    /**
+     * Used to check whether we're getting too many speculation failures and
+     * should just stop trying.  The 100 is picked pretty randomly to be not too
+     * small (so most pages are not affected) but small enough that we don't end
+     * up with failed speculations over and over in pathological cases.
+     */
+    bool IsSpeculationEnabled()
+    {
+        return mSpeculationFailureCount < 100;
+    }
+
     nsCOMPtr<nsIRequest>          mRequest;
     nsCOMPtr<nsIRequestObserver>  mObserver;
 
@@ -484,6 +503,11 @@ class nsHtml5StreamParser : public nsICharsetDetectionObserver {
     nsTArray<nsAutoPtr<nsHtml5Speculation> >  mSpeculations;
     mozilla::Mutex                            mSpeculationMutex;
 
+    /**
+     * Number of times speculation has failed for this parser.
+     */
+    uint32_t                      mSpeculationFailureCount;
+
     /**
      * True to terminate early; protected by mTerminatedMutex
      */