1156255 - crash in OOM | large | NS_ABORT_OOM(unsigned int) | nsSimpleURI::SetPath(nsACString_internal const&)

Status: RESOLVED FIXED

(Firefox for Android Graveyard :: General, defect)

Description

[Catalin Suciu [:csuciu]]

This bug was filed from the Socorro interface and is 
report bp-9bc0feef-27c4-4028-95af-74b122150420.
=============================================================

This crash occurs every time the desktop version of this page is loading: 
http://www.bbc.com/earth/story/20150320-weird-and-wonderful-photo-quiz-2

Tested on Note 3 (4.4.2), Xperia Z2 10" (4.4.4), Nexus 7 (5.1) ant it is reproducible on all three devices. All branches are affected.

Crashing Thread
Frame 	Module 	Signature 	Source
0 	libxul.so 	NS_ABORT_OOM(unsigned int) 	xpcom/base/nsDebugImpl.cpp
1 	libxul.so 	nsSimpleURI::SetPath(nsACString_internal const&) 	xpcom/string/nsTString.h
2 	libxul.so 	nsSimpleURI::SetSpec(nsACString_internal const&) 	netwerk/base/nsSimpleURI.cpp
3 	libxul.so 	nsDataHandler::NewURI(nsACString_internal const&, char const*, nsIURI*, nsIURI**) 	netwerk/protocol/data/nsDataHandler.cpp
4 	libxul.so 	nsIOService::NewURI(nsACString_internal const&, char const*, nsIURI*, nsIURI**) 	netwerk/base/nsIOService.cpp
5 	libxul.so 	imgRequestProxy::GetURI(nsIURI**) 	netwerk/base/nsNetUtil.h
6 	libxul.so 	nsSecureBrowserUIImpl::OnStateChange(nsIWebProgress*, nsIRequest*, unsigned int, nsresult) 	security/manager/boot/src/nsSecureBrowserUIImpl.cpp
7 	libxul.so 	nsDocLoader::DoFireOnStateChange(nsIWebProgress*, nsIRequest*, int&, nsresult) 	uriloader/base/nsDocLoader.cpp
8 	libxul.so 	nsDocLoader::FireOnStateChange(nsIWebProgress*, nsIRequest*, int, nsresult) 	uriloader/base/nsDocLoader.cpp
9 	libxul.so 	nsDocLoader::doStartURLLoad(nsIRequest*) 	uriloader/base/nsDocLoader.cpp

Comment 1

[Nicholas Nethercote [inactive]]

Attachment: Make fallible a potentially large allocation in nsSimpleURI::SetPath

It is surprising at first that a string assignment would cause allocation.
AIUI, it's because the caller passes in a substring, which means the assignment
triggers a copy.

I tried and failed to come up with a way to avoid this allocation. Making it
infallible is still better than the current situation.

Comment 2

[Daniel Holbert [:dholbert]]

Comment on attachment 8775860 [details] [diff] [review]
Make fallible a potentially large allocation in nsSimpleURI::SetPath

Seems fine (and trivial enough that I'm happy r+ing, particularly given valentin's sign-off on similar bug 1290350).

Comment 3

[Nicholas Nethercote [inactive]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/fc636e1c960864300a847b3eaadf0143e0a7f628
Bug 1156255 - Make fallible a potentially large allocation in nsSimpleURI::SetPath. r=dholbert.

Comment 4

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/fc636e1c9608