Bugzilla

After looking through a few of the Linux assertion failures here, I find it somewhat suspicious that so many of them also contain this crash in a content process:

```
INFO - out of memory: 0x0000000028700000 bytes requested
INFO - Hit MOZ_CRASH() at /builds/worker/checkouts/gecko/memory/mozalloc/mozalloc_abort.cpp:33
INFO - #01: mozalloc_abort [memory/mozalloc/mozalloc_abort.cpp:33]
INFO - #02: mozalloc_handle_oom(unsigned long) [memory/mozalloc/mozalloc_oom.cpp:51]
INFO - #03: moz_xrealloc [memory/mozalloc/mozalloc.cpp:72]
INFO - #04: nsTArrayInfallibleAllocator::ResultTypeProxy nsTArray_base<nsTArrayInfallibleAllocator, nsTArray_RelocateUsingMemutils>::EnsureCapacity<nsTArrayInfallibleAllocator>(unsigned long, unsigned long) [xpcom/ds/nsTArray-inl.h:210]
INFO - #05: mozilla::net::ChannelEventQueue::RunOrEnqueue(mozilla::net::ChannelEvent*, bool) [netwerk/ipc/ChannelEventQueue.h:218]
INFO - #06: mozilla::net::HttpChannelChild::DoNotifyListener() [netwerk/protocol/http/HttpChannelChild.cpp:1245]
INFO - #07: mozilla::detail::RunnableMethodImpl<RefPtr<mozilla::net::HttpChannelChild>, void (mozilla::net::HttpChannelChild::*)(), true, (mozilla::RunnableKind)0, >::Run() [xpcom/threads/nsThreadUtils.h:1204]
```

This appears to be crashing in the runnable dispatched from https://searchfox.org/mozilla-central/rev/9f76a47f4aa935b49754c5608a1c8e72ee358c46/netwerk/protocol/http/HttpChannelChild.cpp#242-244 due to an OOM. The `RunOrEnqueue` call appears to be OOM-ing here: https://searchfox.org/mozilla-central/rev/9f76a47f4aa935b49754c5608a1c8e72ee358c46/netwerk/ipc/ChannelEventQueue.h#218

The size of the allocation here is especially suspect, as `mEventQueue` is a `nsTArray<UniquePtr<...>>`, meaning that the allocation is trying to reserve enough space for ~84,803,583 events. Based on my understanding of our growth algorithm, this implies that we're trying to add our ~75,366,400th event, which is an absurd number of events to have queued.

ni? :jstutte to find someone from the networking team who might know what's going on here :-)

After looking through a few of the Linux assertion failures here, I find it somewhat suspicious that so many of them also contain this crash in a content process:

```
INFO - out of memory: 0x0000000028700000 bytes requested
INFO - Hit MOZ_CRASH() at /builds/worker/checkouts/gecko/memory/mozalloc/mozalloc_abort.cpp:33
INFO - #01: mozalloc_abort [memory/mozalloc/mozalloc_abort.cpp:33]
INFO - #02: mozalloc_handle_oom(unsigned long) [memory/mozalloc/mozalloc_oom.cpp:51]
INFO - #03: moz_xrealloc [memory/mozalloc/mozalloc.cpp:72]
INFO - #04: nsTArrayInfallibleAllocator::ResultTypeProxy nsTArray_base<nsTArrayInfallibleAllocator, nsTArray_RelocateUsingMemutils>::EnsureCapacity<nsTArrayInfallibleAllocator>(unsigned long, unsigned long) [xpcom/ds/nsTArray-inl.h:210]
INFO - #05: mozilla::net::ChannelEventQueue::RunOrEnqueue(mozilla::net::ChannelEvent*, bool) [netwerk/ipc/ChannelEventQueue.h:218]
INFO - #06: mozilla::net::HttpChannelChild::DoNotifyListener() [netwerk/protocol/http/HttpChannelChild.cpp:1245]
INFO - #07: mozilla::detail::RunnableMethodImpl<RefPtr<mozilla::net::HttpChannelChild>, void (mozilla::net::HttpChannelChild::*)(), true, (mozilla::RunnableKind)0, >::Run() [xpcom/threads/nsThreadUtils.h:1204]
```

This appears to be crashing in the runnable dispatched from https://searchfox.org/mozilla-central/rev/9f76a47f4aa935b49754c5608a1c8e72ee358c46/netwerk/protocol/http/HttpChannelChild.cpp#242-244 due to an OOM. The `RunOrEnqueue` call appears to be OOM-ing here: https://searchfox.org/mozilla-central/rev/9f76a47f4aa935b49754c5608a1c8e72ee358c46/netwerk/ipc/ChannelEventQueue.h#218

The size of the allocation here is especially suspect, as `mEventQueue` is a `nsTArray<UniquePtr<...>>`, meaning that the allocation is trying to reserve enough space for ~84,803,583 events. Based on my understanding of our growth algorithm, this implies that we're trying to add our ~75,366,400th event, which is an absurd number of events to have queued.

ni? :jstutte to find someone from the networking team who might know what's going on here :-)

EDIT: I noticed immediately after submitting that the ones I noticed seem to be crashing in a specific crashtest (https://searchfox.org/mozilla-central/rev/9f76a47f4aa935b49754c5608a1c8e72ee358c46/xpcom/string/crashtests/1113005.html). Some examples:
* https://treeherder.mozilla.org/logviewer?job_id=337621909&repo=mozilla-central&lineNumber=81770
* https://treeherder.mozilla.org/logviewer?job_id=337556888&repo=try&lineNumber=81603