1121206 - crash in [@ OOM | large | NS_ABORT_OOM | nsTextFragment::AppendTo]

Reporter

Description

•

9 years ago

This bug was filed from the Socorro interface and is 
report bp-1dfb9129-2f31-4a8f-8dd6-85ae02150113.
=============================================================

Mozilla/5.0 (Windows NT 6.1; WOW64; rv:38.0) Gecko/20100101 Firefox/38.0 ID:20150113030205 CSet: 3d846527576f

Mats Palmgren (inactive)

Updated

•

9 years ago

Component: General → Layout

Product: Firefox → Core

:Gijs (he/him)

Updated

•

9 years ago

Blocks: 950076

Mats Palmgren (inactive)

Comment 1

•

9 years ago

I think intentionally crashing on OOM in this situation is the desired behavior.
I don't think we want to present a page with potentially missing content.

Simon, do you agree?

Flags: needinfo?(smontagu)

BMO Automation

Updated

•

9 years ago

BugBot [:suhaib / :marco/ :calixte]

Comment 2

•

8 years ago

Crash volume for signature 'OOM | large | NS_ABORT_OOM | nsTextFragment::AppendTo':
 - nightly(version 50):0 crashes from 2016-06-06.
 - aurora (version 49):17 crashes from 2016-06-07.
 - beta   (version 48):294 crashes from 2016-06-06.
 - release(version 47):860 crashes from 2016-05-31.
 - esr    (version 45):155 crashes from 2016-04-07.

Crash volume on the last weeks:
            W. N-1  W. N-2  W. N-3  W. N-4  W. N-5  W. N-6  W. N-7
 - nightly       0       0       0       0       0       0       0
 - aurora        4       0       3       2       4       0       4
 - beta         56      56      57      31      40      28      19
 - release     113     100     128     107     109     123     139
 - esr          15      21      21      22      17      11      14

Affected platform: Windows

status-firefox47: --- → affected

status-firefox48: --- → affected

status-firefox49: --- → affected

status-firefox-esr45: --- → affected

BugBot [:suhaib / :marco/ :calixte]

Comment 3

•

8 years ago

Crash volume for signature 'OOM | large | NS_ABORT_OOM | nsTextFragment::AppendTo':
 - nightly (version 51): 0 crashes from 2016-08-01.
 - aurora  (version 50): 4 crashes from 2016-08-01.
 - beta    (version 49): 140 crashes from 2016-08-02.
 - release (version 48): 92 crashes from 2016-07-25.
 - esr     (version 45): 202 crashes from 2016-05-02.

Crash volume on the last weeks (Week N is from 08-22 to 08-28):
            W. N-1  W. N-2  W. N-3
 - nightly       0       0       0
 - aurora        3       1       0
 - beta         49      46      15
 - release      27      29      18
 - esr          16      21      16

Affected platform: Windows

Crash rank on the last 7 days:
           Browser   Content     Plugin
 - nightly
 - aurora            #508
 - beta    #344      #307
 - release #657
 - esr     #385

status-firefox50: --- → affected

alex_mayorga

Reporter

Comment 4

•

8 years ago

FWIW from https://crash-stats.mozilla.com/signature/?signature=OOM%20%7C%20large%20%7C%20NS_ABORT_OOM%20%7C%20nsTextFragment%3A%3AAppendTo#comments

Loaded page with >100 animated GIFs.

https://crash-stats.mozilla.com/report/index/6c45bdca-45ea-4481-b252-fe1e42160909

Crashing Thread (0)
Frame 	Module 	Signature 	Source
0 	xul.dll 	NS_ABORT_OOM(unsigned int) 	xpcom/base/nsDebugImpl.cpp:604
1 	xul.dll 	nsTextFragment::AppendTo(nsAString_internal&) 	dom/base/nsTextFragment.h:130
2 	xul.dll 	txNodeSet::stringValue(nsString&) 	dom/xslt/xpath/txNodeSet.cpp:482
3 	xul.dll 	Expr::evaluateToString(txIEvalContext*, nsString&) 	dom/xslt/xpath/txExpr.cpp:27
4 	xul.dll 	txCoreFunctionCall::evaluate(txIEvalContext*, txAExprResult**) 	dom/xslt/xpath/txCoreFunctionCall.cpp:250
5 	xul.dll 	txPredicatedNodeTest::matches(txXPathNode const&, txIMatchContext*) 	dom/xslt/xpath/txPredicatedNodeTest.cpp:29
6 	xul.dll 	txPredicatedNodeTest::matches(txXPathNode const&, txIMatchContext*) 	dom/xslt/xpath/txPredicatedNodeTest.cpp:23
7 	xul.dll 	LocationStep::fromDescendants(txXPathNode const&, txIMatchContext*, txNodeSet*) 	dom/xslt/xpath/txLocationStep.cpp:220
8 	xul.dll 	LocationStep::fromDescendants(txXPathNode const&, txIMatchContext*, txNodeSet*) 	dom/xslt/xpath/txLocationStep.cpp:223
9 	xul.dll 	LocationStep::fromDescendants(txXPathNode const&, txIMatchContext*, txNodeSet*) 	dom/xslt/xpath/txLocationStep.cpp:223
10 	xul.dll 	LocationStep::fromDescendants(txXPathNode const&, txIMatchContext*, txNodeSet*) 	dom/xslt/xpath/txLocationStep.cpp:223
11 	xul.dll 	LocationStep::evaluate(txIEvalContext*, txAExprResult**) 	dom/xslt/xpath/txLocationStep.cpp:81
12 	xul.dll 	PathExpr::evaluate(txIEvalContext*, txAExprResult**) 	dom/xslt/xpath/txPathExpr.cpp:92
13 	xul.dll 	mozilla::dom::XPathExpression::EvaluateWithContext(nsINode&, unsigned int, unsigned int, unsigned short, mozilla::dom::XPathResult*, mozilla::ErrorResult&) 	dom/xslt/xpath/XPathExpression.cpp:158
14 	xul.dll 	mozilla::dom::XPathExpression::EvaluateWithContext(JSContext*, nsINode&, unsigned int, unsigned int, unsigned short, JS::Handle<JSObject*>, mozilla::ErrorResult&) 	dom/xslt/xpath/XPathExpression.cpp:88
15 	xul.dll 	mozilla::dom::XPathExpression::Evaluate(JSContext*, nsINode&, unsigned short, JS::Handle<JSObject*>, mozilla::ErrorResult&) 	obj-firefox/dist/include/mozilla/dom/XPathExpression.h:46
16 	xul.dll 	mozilla::dom::XPathEvaluator::Evaluate(JSContext*, nsAString_internal const&, nsINode&, mozilla::dom::XPathNSResolver*, unsigned short, JS::Handle<JSObject*>, mozilla::ErrorResult&) 	dom/xslt/xpath/XPathEvaluator.cpp:192
17 	xul.dll 	mozilla::dom::DocumentBinding::evaluate 	obj-firefox/dom/bindings/DocumentBinding.cpp:10448
18 	xul.dll 	js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct) 	js/src/vm/Interpreter.cpp:480
19 	xul.dll 	InternalCall 	js/src/vm/Interpreter.cpp:525
20 	xul.dll 	XPCWrappedNative::CallMethod(XPCCallContext&, XPCWrappedNative::CallMode) 	js/xpconnect/src/XPCWrappedNative.cpp:1368
21 	xul.dll 	js::RunScript(JSContext*, js::RunState&) 	js/src/vm/Interpreter.cpp:426
22 	xul.dll 	js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct) 	js/src/vm/Interpreter.cpp:498
23 	xul.dll 	js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>) 	js/src/vm/Interpreter.cpp:544
24 	xul.dll 	js::CrossCompartmentWrapper::call(JSContext*, JS::Handle<JSObject*>, JS::CallArgs const&) 	js/src/proxy/CrossCompartmentWrapper.cpp:291
25 	xul.dll 	xpc::JSXrayTraits::call(JSContext*, JS::Handle<JSObject*>, JS::CallArgs const&, js::Wrapper const&) 	js/xpconnect/wrappers/XrayWrapper.h:246
26 	xul.dll 	xpc::XrayWrapper<js::CrossCompartmentWrapper, xpc::JSXrayTraits>::call(JSContext*, JS::Handle<JSObject*>, JS::CallArgs const&) 	js/xpconnect/wrappers/XrayWrapper.cpp:2271
27 	xul.dll 	js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct) 	js/src/vm/Interpreter.cpp:468
28 	xul.dll 	js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>) 	js/src/vm/Interpreter.cpp:544
29 	xul.dll 	js::fun_apply(JSContext*, unsigned int, JS::Value*) 	js/src/jsfun.cpp:1248
30 	xul.dll 	js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct) 	js/src/vm/Interpreter.cpp:480
31 	xul.dll 	js::fun_call(JSContext*, unsigned int, JS::Value*) 	js/src/jsfun.cpp:1179
32 		@0x1768ef8 	
33 		@0x3a45b637 	
34 		@0x6068e23 	
35 		@0x3a4560ef 	
36 		@0x1ca418fd 	
37 		@0x3a40ee1f 	
38 		@0x6068e23 	
39 		@0x3a407297 	
40 		@0x6068e23 	
41 		@0x3a4f8fb7 	
42 		@0x89c3935 	
43 		@0x3a4b4dff 	
44 		@0x3f1e0793 	
45 		@0x6068e23 	
46 		@0x3a4953ef 	
47 		@0x3f1e0793 	
48 		@0x6068e23 	
49 		@0x3a45b6b7 	
50 		@0x6068e23 	
51 		@0x3a4560ef 	
52 		@0x1ca418fd 	
53 		@0x3a40ee1f 	
54 		@0x6068e23 	
55 		@0x3a407297 	
56 		@0x6068e23 	
57 		@0x3a4f8fb7 	
58 		@0x89c3935 	
59 		@0x3a4b4dff 	
60 		@0x3f1e0793 	
61 		@0x6068e23 	
62 		@0x3a4953ef 	
63 		@0x3f1e0793 	
64 		@0x6068e23 	
65 		@0x3a45b6b7 	
66 		@0x6068e23 	
67 		@0x3a4560ef 	
68 		@0x1ca418fd 	
69 		@0x3a40ee1f 	
70 		@0x6068e23 	
71 		@0x3a407297 	
72 		@0x6068e23 	
73 		@0x32bbcb7f 	
74 		@0x3f1e0954 	
75 	xul.dll 	js::jit::EnterBaselineMethod(JSContext*, js::RunState&) 	js/src/jit/BaselineJIT.cpp:194
76 	xul.dll 	Interpret 	js/src/vm/Interpreter.cpp:2876
77 	xul.dll 	js::RunScript(JSContext*, js::RunState&) 	js/src/vm/Interpreter.cpp:426
78 	xul.dll 	js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct) 	js/src/vm/Interpreter.cpp:498
79 	xul.dll 	js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>) 	js/src/vm/Interpreter.cpp:544
80 	xul.dll 	js::jit::InvokeFunction(JSContext*, JS::Handle<JSObject*>, bool, unsigned int, JS::Value*, JS::MutableHandle<JS::Value>) 	js/src/jit/VMFunctions.cpp:111
81 	xul.dll 	js::jit::SetEnterJitData(JSContext*, js::jit::EnterJitData&, js::RunState&, JS::AutoVectorRooter<JS::Value>&) 	js/src/jit/Ion.cpp:2848
82 	xul.dll 	js::jit::CanEnter(JSContext*, js::RunState&) 	js/src/jit/Ion.cpp:2500
83 	xul.dll 	js::irregexp::RegExpStack::init() 	js/src/irregexp/RegExpStack.cpp:67
84 	xul.dll 	js::InterpreterActivation::~InterpreterActivation() 	js/src/vm/Stack-inl.h:949
85 	xul.dll 	Interpret 	js/src/vm/Interpreter.cpp:4047
86 	xul.dll 	xul.dll@0x1e8159b 	

o wetransfer.net sempre está travando meu firefox. 

https://crash-stats.mozilla.com/report/index/32da82c3-93fb-46be-9f84-804d62160909

Crashing Thread (0)
Frame 	Module 	Signature 	Source
0 	xul.dll 	NS_ABORT_OOM(unsigned int) 	xpcom/base/nsDebugImpl.cpp:604
1 	xul.dll 	nsTextFragment::AppendTo(nsAString_internal&) 	dom/base/nsTextFragment.h:130
2 	xul.dll 	nsGenericDOMDataNode::SetText(wchar_t const*, unsigned int, bool) 	dom/base/nsGenericDOMDataNode.cpp:993
3 	xul.dll 	nsGenericDOMDataNode::SetText(nsAString_internal const&, bool) 	dom/base/nsGenericDOMDataNode.h:134
4 	xul.dll 	nsContentUtils::SetNodeTextContent(nsIContent*, nsAString_internal const&, bool) 	dom/base/nsContentUtils.cpp:4595
5 	xul.dll 	mozilla::dom::HTMLStyleElement::SetInnerHTML(nsAString_internal const&, mozilla::ErrorResult&) 	dom/html/HTMLStyleElement.cpp:207
6 	xul.dll 	mozilla::dom::ElementBinding::set_innerHTML 	obj-firefox/dom/bindings/ElementBinding.cpp:2940
7 	xul.dll 	mozilla::dom::GenericBindingSetter(JSContext*, unsigned int, JS::Value*) 	dom/bindings/BindingUtils.cpp:2749
8 	xul.dll 	js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct) 	js/src/vm/Interpreter.cpp:480
9 	xul.dll 	js::NativeSetProperty(JSContext*, JS::Handle<js::NativeObject*>, JS::Handle<jsid>, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::QualifiedBool, JS::ObjectOpResult&) 	js/src/vm/NativeObject.cpp:2388
10 		@0x39360b

Component: Layout → DOM

OS: Windows NT → Windows

Mats Palmgren (inactive)

Comment 5

•

8 years ago

The first crash in comment 4 seems like it's related to an add-on using XPath?

Severity: critical → normal

Flags: needinfo?(smontagu)

BugBot [:suhaib / :marco/ :calixte]

Comment 6

•

8 years ago

Crash volume for signature 'OOM | large | NS_ABORT_OOM | nsTextFragment::AppendTo':
 - nightly (version 52): 0 crashes from 2016-09-19.
 - aurora  (version 51): 2 crashes from 2016-09-19.
 - beta    (version 50): 46 crashes from 2016-09-20.
 - release (version 49): 109 crashes from 2016-09-05.
 - esr     (version 45): 249 crashes from 2016-06-01.

Crash volume on the last weeks (Week N is from 10-03 to 10-09):
            W. N-1  W. N-2
 - nightly       0       0
 - aurora        2       0
 - beta         40       6
 - release      81      28
 - esr          12      22

Affected platform: Windows

Crash rank on the last 7 days:
           Browser   Content     Plugin
 - nightly
 - aurora  #550
 - beta    #374      #575
 - release #635      #668
 - esr     #621

status-firefox51: --- → affected

BugBot [:suhaib / :marco/ :calixte]

Comment 7

•

7 years ago

Crash volume for signature 'OOM | large | NS_ABORT_OOM | nsTextFragment::AppendTo':
 - nightly (version 54): 0 crashes from 2017-01-23.
 - aurora  (version 53): 0 crashes from 2017-01-23.
 - beta    (version 52): 18 crashes from 2017-01-23.
 - release (version 51): 39 crashes from 2017-01-16.
 - esr     (version 45): 547 crashes from 2016-08-03.

Crash volume on the last weeks (Week N is from 01-30 to 02-05):
            W. N-1  W. N-2  W. N-3  W. N-4  W. N-5  W. N-6  W. N-7
 - nightly       0
 - aurora        0
 - beta          9
 - release      20       0
 - esr          35      24      29      28       8      29      27

Affected platform: Windows

Crash rank on the last 7 days:
           Browser   Content   Plugin
 - nightly
 - aurora
 - beta    #967      #266
 - release #749      #689
 - esr     #430

status-firefox52: --- → affected

Julien Cristau [:jcristau] (back April 22)

Comment 8

•

7 years ago

Mass wontfix for bugs affecting firefox 52.

status-firefox52: affected → wontfix

Marion Daly [:mdaly]

Updated

•

6 years ago

Priority: -- → P5

Nobody; OK to take it and work on it

Assignee

Updated

•

5 years ago

Component: DOM → DOM: Core & HTML

Wayne Mery (:wsmwk)

Comment 9

•

3 years ago

All crashes of the last 3 months are version 68 or older

Status: NEW → RESOLVED

Closed: 3 years ago

Resolution: --- → INCOMPLETE

Ryan VanderMeulen [:RyanVM]

Updated

•

2 years ago

status-firefox47: affected → wontfix

status-firefox48: affected → wontfix

status-firefox49: affected → wontfix

status-firefox50: affected → wontfix

status-firefox51: affected → wontfix

status-firefox-esr45: affected → wontfix

Bugzilla

Quick Search

crash in [@ OOM | large | NS_ABORT_OOM | nsTextFragment::AppendTo]

Categories

(Core :: DOM: Core & HTML, defect, P5)

Tracking

()

People

(Reporter: alex_mayorga, Unassigned)

References

Details

(Keywords: crash)

Crash Data

Security

(public)

User Story

Description

Updated

Updated

Comment 1

Updated

Comment 2

Comment 3

Comment 4

Comment 5

Comment 6

Comment 7

Comment 8

Updated

Updated

Comment 9

Updated