702869 - crash in gfxTextRun::Create

Status: RESOLVED WORKSFORME

(Core :: Graphics, defect)

Description

[Wayne Mery (:wsmwk)]

topcrash for version 8.  

for some reason, firefox crashes with this at a far low rate (50x?)

examined about 6 stacks

============================================================= 
about 1/4 are startup 

(1) line 3096 version 7   line 3106 version 8

bp-2575cd01-79d6-4cf3-926b-7ce2d2111027 (jkkwoo) v8
bp-2cf6f190-609a-4b5b-bf26-312052111015 (kybunnies) v7
bp-2cf6f190-609a-4b5b-bf26-312052111015 (caldwell8) v7
0 	mozalloc.dll 	mozalloc_abort 	memory/mozalloc/mozalloc_abort.cpp:78
1 	mozalloc.dll 	mozalloc_handle_oom 	memory/mozalloc/mozalloc_oom.cpp:54
2 	mozalloc.dll 	moz_xmalloc 	memory/mozalloc/mozalloc.cpp:103
3 	xul.dll 	gfxTextRun::Create 	gfx/thebes/gfxFont.cpp:3096
4 	xul.dll 	gfxFontGroup::MakeTextRun 	gfx/thebes/gfxFont.cpp:2398
5 	xul.dll 	TextRunWordCache::MakeTextRun 	gfx/thebes/gfxTextRunWordCache.cpp:850
6 	xul.dll 	gfxTextRunWordCache::MakeTextRun 	gfx/thebes/gfxTextRunWordCache.cpp:1046
7 	xul.dll 	MakeTextRun 	layout/generic/nsTextFrameThebes.cpp:580
8 	xul.dll 	BuildTextRunsScanner::BuildTextRunForFrames 	layout/generic/nsTextFrameThebes.cpp:1979
9 	xul.dll 	BuildTextRunsScanner::FlushFrames 	layout/generic/nsTextFrameThebes.cpp:1394

(2) 

bp-de08346e-ebb7-463b-8a26-3ded92111113 (unique) v8

0 	mozalloc.dll 	mozalloc_abort 	memory/mozalloc/mozalloc_abort.cpp:77
1 	mozalloc.dll 	mozalloc_handle_oom 	memory/mozalloc/mozalloc_oom.cpp:54
2 	mozalloc.dll 	moz_xmalloc 	memory/mozalloc/mozalloc.cpp:112
3 	xul.dll 	gfxTextRun::Create 	gfx/thebes/gfxFont.cpp:3106
4 	xul.dll 	TextRunWordCache::MakeTextRun 	gfx/thebes/gfxTextRunWordCache.cpp:597
5 	xul.dll 	gfxTextRunWordCache::MakeTextRun 	gfx/thebes/gfxTextRunWordCache.cpp:1035
6 	xul.dll 	gfxTextRunCache::MakeTextRun 	gfx/thebes/gfxTextRunCache.cpp:93
7 	xul.dll 	`anonymous namespace'::AutoTextRun::AutoTextRun 	gfx/src/nsFontMetrics.cpp:66
8 	xul.dll 	nsFontMetrics::GetWidth 	gfx/src/nsFontMetrics.cpp:311
9 	xul.dll 	nsRenderingContext::GetWidth 	gfx/src/nsRenderingContext.cpp:520

============================================================= 

bp-50ecf8e2-8c8d-4ec8-9192-e13ed2111113 looks to be an example of the same crash not going OOM

gfxTextRun::Create(gfxTextRunFactory::Parameters const*, void const*, unsigned int, gfxFontGroup*, unsigned int)

Comment 1

[Joe Drew (not getting mail)]

There are two OOMs here; one on the same line as bp-50ecf8e2-8c8d-4ec8-9192-e13ed2111113, and one on a different line. I don't know if we should consider them the same.

It's not clear to me why the OOM is definitely a bug, though.

Comment 2

[Robert Kaiser]

Crash URLs for 2011-11-07 through 2011-11-22 for all signatures containing "gfxTextRun::Create":

 3 about:blank
 2 \N
 1 http://www.nuvid.com/adx_iframe_bottom_4.html
 1 http://www.nipponanime.net/forum/forumdisplay.php?fid=391
 1 http://www.linkbucks.com/link/49349442
 1 http://www.kaixin001.com/home/?l=a
 1 http://www.google.it/
 1 http://www.google.com/
 1 http://www.facebook.com/?ref=tn_tinyman
 1 http://www.facebook.com/profile.php?id=100001252095596
 1 http://www.facebook.com/pages/Ksiaznica-Pomorska/136772876386629
 1 http://www.facebook.com/berrak.armutlu?...
 1 http://www.facebook.com/ajax/pagelet/generic.php/PhotoViewerPagelet?...
 1 http://www.facebook.com/ajax/pagelet/generic.php/pagelet/home/morestories.php...
 1 http://www.facebook.com/ajax/pagelet/generic.php/pagelet/home/morestories.php?...
 1 http://www.facebook.com/ai.php?...
 1 http://www.erepublik.com/en
 1 http://www.ebay.de/itm/PLAYMOBIL-4819-4820-4821-4822-4823-4824-4825-FEUERWEHR-/360341114664?pt=DE_Allesf%C3%BCrKind_Spielzeug_Playmobil&hash=item53e6010f28
 1 http://www.dioxxy.com.br/home/
 1 http://www.darbyandliffenea.co.uk/
 1 http://www.csfd.cz/film/257725-machete/
 1 http://www.blogger.com/blog-options-basic.g?blogID=8654162280395399057
 1 http://www.9evitka.cz/restaurant/daymenu
 1 http://windupurnomo.wordpress.com/tag/mysql/
 1 http://vkontakte.ru/al_profile.php?...
 1 http://tr.wikipedia.org/wiki/Ludwig_van_Beethoven
 1 http://torrentsmd.eu//details.php?id=1092704&filelist=1#filelist
 1 https://www.hvfcu.org/
 1 https://www.facebook.com/dialog/oauth?...&redirect_uri=http%3A%2F%2Fdata.sidebardisabler.net%2Fflfix.htm%23origin%3Dhttps%253A%252F%252Fwww.facebook.com%26frame%3Dxd112552328939
 1 https://www.facebook.com/ajax/pagelet/generic.php/MoreStoriesPagelet?...
 1 http://sports.williamhill.com/bet
 1 http://search.babylon.com/?s=web&babsrc=HP_ss&q=RAPpEr+%27Ducati
 1 https://bugzilla.mozilla.org/show_bug.cgi?id=695421
 1 http://paulmadonna.com/all_over_coffee/
 1 http://otdyh-ua.net/items/712-patkovski-hotel
 1 http://lauxanh.us/diendan/showthread.php?t=546719
 1 http://il-tumen.sakha.ru/?id=18121
 1 http://earthlink.net/
 1 http://au.mc1214.mail.yahoo.com/mc/showMessage?...
 1 http://apps.facebook.com/ai.php?...
 1 http://adult-sex-games.com/page6.html
 1 file:///C:/Documents%20and%20Settings/Admin/%D0%A0%D0%B0%D0%B1%D0%BE%D1%87%D0%B8%D0%B9%20%D1%81%D1%82%D0%BE%D0%BB/play-kingdom-rush.php.htm
 1 

Affected signatures:
mozalloc_abort(char const* const) | mozalloc_handle_oom() | gfxTextRun::Create(gfxTextRunFactory::Parameters const*, void const*, unsigned int, gfxFontGroup*, unsigned int)
mozalloc_abort(char const* const) | mozalloc_handle_oom() | moz_xmalloc | gfxTextRun::Create(gfxTextRunFactory::Parameters const*, void const*, unsigned int, gfxFontGroup*, unsigned int)
mozalloc_abort | mozalloc_handle_oom | moz_xmalloc | gfxTextRun::Create
operator new(unsigned int) | gfxTextRun::Create(gfxTextRunFactory::Parameters const*, void const*, unsigned int, gfxFontGroup*, unsigned int)
gfxTextRun::Create(gfxTextRunFactory::Parameters const*, void const*, unsigned int, gfxFontGroup*, unsigned int)

Comment 3

[John Daggett (:jtd)]

Just to be clear, text run creation and destruction is done constantly and typically doesn't require gobs of memory.  But if other code is using memory, then there's a much higher chance of hitting an OOM in textrun code.  The fact that we're hitting this on pages like 'google.com', which cause a very minimal amount of textrun creation, indicates that we probably need to look elsewhere to figure out where the memory hog lies.

Comment 4

[Joe Drew (not getting mail)]

This isn't *only* an OOM, though. There are crashes like the breakpad URL mentioned at the end of comment 0 that are just crashes at some random address.

Comment 5

[Wayne Mery (:wsmwk)]

(In reply to Robert Kaiser (:[e-mail]) from comment #2)
> Crash URLs for 2011-11-07 through 2011-11-22 for all signatures containing
> "gfxTextRun::Create":

kairo, are those from thunderbird crashes ?

I'm not sure what is seen in TB can be correlated to what is seen in firefox ... the crash is almost nonexistent in firefox

Comment 6

[Robert Kaiser]

(In reply to Wayne Mery (:wsmwk) from comment #5)
> (In reply to Robert Kaiser (:[e-mail]) from comment #2)
> > Crash URLs for 2011-11-07 through 2011-11-22 for all signatures containing
> > "gfxTextRun::Create":
> 
> kairo, are those from thunderbird crashes ?

No, those are Firefox crashes.

> I'm not sure what is seen in TB can be correlated to what is seen in firefox
> ... the crash is almost nonexistent in firefox

I'm not sure if Thunderbird would even set URLs in the crash reports, and then the CSV files we are using to fetch URL data (intentionally AFAIK) only contain Firefox and Fennec crashes.

Comment 7

[Wayne Mery (:wsmwk)]

nothing on crash-stats after TB11.0.1 
like bp-8922783a-ce9a-41ae-aaf6-815012120624