1116837 - startup crash in OOM | large | NS_ABORT_OOM | nsACString_internal::Replace. News?

Status: RESOLVED WORKSFORME

(MailNews Core :: Networking: NNTP, defect)

Description

[Wayne Mery (:wsmwk)]

This signature is new in version 31.x. I have not been able to link it via socorro or user reports to a previous existing crash, so far.  

most crashes are via nsMsgNewsFolder::LoadNewsrcFileAndCreateNewsgroups which typically cites allocation request size of 300MB-500MB, which should be easily available during startup, but nevertheless still fails.  Bad stack?

bp-bfb51a02-9241-4737-a246-7718b2141230. (7654) "total crash during start withaout add ons"
=============================================================
 0 	xul.dll	NS_ABORT_OOM(unsigned int)	xpcom/base/nsDebugImpl.cpp
1 	xul.dll	nsACString_internal::Replace(unsigned int, unsigned int, char const*, unsigned int)	xpcom/string/src/nsTSubstring.cpp
2 	xul.dll	NS_ReadLine<char, nsFileInputStream, nsACString_internal>(nsFileInputStream*, nsLineBuffer<char>*, nsACString_internal&, bool*)	objdir-tb/mozilla/dist/include/nsReadLine.h
3 	xul.dll	nsFileInputStream::ReadLine(nsACString_internal&, bool*)	netwerk/base/src/nsFileStreams.cpp
4 	xul.dll	nsMsgNewsFolder::LoadNewsrcFileAndCreateNewsgroups()	mailnews/news/src/nsNewsFolder.cpp
5 	xul.dll	nsMsgNewsFolder::CreateSubFolders(nsIFile*)	mailnews/news/src/nsNewsFolder.cpp
6 	xul.dll	nsMsgNewsFolder::GetSubFolders(nsISimpleEnumerator**)	mailnews/news/src/nsNewsFolder.cpp
7 	xul.dll	NS_InvokeByIndex	xpcom/reflect/xptcall/src/md/win32/xptcinvoke.cpp
8 	xul.dll	XPCWrappedNative::CallMethod(XPCCallContext&, XPCWrappedNative::CallMode)	js/xpconnect/src/XPCWrappedNative.cpp
9 	xul.dll	XPC_WN_GetterSetter(JSContext*, unsigned int, JS::Value*)	js/xpconnect/src/XPCWrappedNativeJSOps.cpp
10 	mozjs.dll	js::Invoke(JSContext*, JS::CallArgs, js::MaybeConstruct)	js/src/vm/Interpreter.cpp
11 	mozjs.dll	js::Invoke(JSContext*, JS::Value const&, JS::Value const&, unsigned int, JS::Value const*, JS::MutableHandle<JS::Value>)	js/src/vm/Interpreter.cpp
12 	mozjs.dll	js::InvokeGetterOrSetter(JSContext*, JSObject*, JS::Value, unsigned int, JS::Value*, JS::MutableHandle<JS::Value>)	js/src/vm/Interpreter.cpp
13 	mozjs.dll	js::Shape::get(JSContext*, JS::Handle<JSObject*>, JSObject*, JSObject*, JS::MutableHandle<JS::Value>)	js/src/vm/Shape-inl.h
14 	mozjs.dll	js::baseops::GetProperty(JSContext*, JS::Handle<JSObject*>, JS::Handle<JSObject*>, JS::Handle<jsid>, JS::MutableHandle<JS::Value>)	js/src/jsobj.cpp
15 	mozjs.dll	JSObject::getGeneric(JSContext*, JS::Handle<JSObject*>, JS::Handle<JSObject*>, JS::Handle<jsid>, JS::MutableHandle<JS::Value>)	js/src/jsobj.h
16 	mozjs.dll	js::jit::DoGetPropFallback	js/src/jit/BaselineIC.cpp
17 		@0x7056b8	

bp-56fa98db-85c9-4349-a5a0-f347e2141224 (jrde)
bp-c6d6cf45-d42e-4f05-823d-afded2141223 (edweirdo frequent crashes)
bp-2a9816f1-13aa-47c4-a5e0-6a65f2141223 (edweirdo)

Comment 1

[Wayne Mery (:wsmwk)]

https://support.mozilla.org/en-US/questions/1039778#answer-714074 = https://crash-stats.mozilla.com/report/index/ff96d306-a327-43a8-b004-ddf582141229

Comment 2

[Wayne Mery (:wsmwk)]

(In reply to Wayne Mery (:wsmwk, use Needinfo for questions) from comment #0)
> This signature is new in version 31.x. ...
> most crashes are via nsMsgNewsFolder::LoadNewsrcFileAndCreateNewsgroups
> which typically cites allocation request size of 300MB-500MB, which should
> be easily available during startup, but nevertheless still fails.  Bad stack?
> 
> bp-bfb51a02-9241-4737-a246-7718b2141230. (7654) "total crash during start
> withaout add ons"
> =============================================================
>  0 	xul.dll	NS_ABORT_OOM(unsigned int)	xpcom/base/nsDebugImpl.cpp
> 1 	xul.dll	nsACString_internal::Replace(unsigned int, unsigned int, char
> const*, unsigned int)	xpcom/string/src/nsTSubstring.cpp
> 2 	xul.dll	NS_ReadLine<char, nsFileInputStream,
> nsACString_internal>(nsFileInputStream*, nsLineBuffer<char>*,
> nsACString_internal&, bool*)	objdir-tb/mozilla/dist/include/nsReadLine.h
> 3 	xul.dll	nsFileInputStream::ReadLine(nsACString_internal&, bool*)
> netwerk/base/src/nsFileStreams.cpp
> 4 	xul.dll	nsMsgNewsFolder::LoadNewsrcFileAndCreateNewsgroups()
> mailnews/news/src/nsNewsFolder.cpp
> 5 	xul.dll	nsMsgNewsFolder::CreateSubFolders(nsIFile*)
> mailnews/news/src/nsNewsFolder.cpp
> 6 	xul.dll	nsMsgNewsFolder::GetSubFolders(nsISimpleEnumerator**)
> mailnews/news/src/nsNewsFolder.cpp
> ...
> bp-56fa98db-85c9-4349-a5a0-f347e2141224 (jrde)
> bp-c6d6cf45-d42e-4f05-823d-afded2141223 (edweirdo frequent crashes)
> bp-2a9816f1-13aa-47c4-a5e0-6a65f2141223 (edweirdo)
 

https://support.mozilla.org/en-US/questions/1039778#answer-714638
" I solve the problem deleting all entries in the news Folder - there was many old stuff"

Some users who crash with OOM | large also crash OOM | small. For example Roger (these may all be news related)
bp-f6f34d3-c5c7-41d2-876d-2a7662150408    2015-04-08 16:00:24     OOM | large | NS_ABORT_OOM(unsigned int) | nsACString_internal::Replace(unsigned int, unsigned int, char const*, unsigned int)   Signature report
bp-2f08ab76-a21e-4912-a34c-ba1442150408    2015-04-08 16:00:10     OOM | large | NS_ABORT_OOM(unsigned int) | nsACString_internal::Replace(unsigned int, unsigned int, char const*, unsigned int)   Signature report
bp-83bd15aa-0429-4592-bebc-74ffd2150408    2015-04-08 16:00:03     OOM | small Signature report
bp-6bbdc1ce-54ce-4155-94fd-395a72150327    2015-03-27 15:25:58     OOM | small Signature report
bp-71c50a4e-2b87-40ca-8b46-6fdfc2150327    2015-03-27 15:25:39     OOM | small Signature report
bp-1b0905f8-7a5d-4036-b493-47b7c2150225    2015-02-25 23:06:53     OOM | large | NS_ABORT_OOM(unsigned int) | nsACString_internal::Replace(unsigned int, unsigned int, char const*, unsigned int)   Signature report

Comment 3

[Wayne Mery (:wsmwk)]

Signature doesn't exist for version 60. Who knows what it morphed to, if the crash even still exists