1199490 - crash in OOM | large | NS_ABORT_OOM(unsigned int) | IPC::ParamTraits<T>::Read(IPC::Message const*, void**, nsACString_internal*)

Status: RESOLVED WORKSFORME

(Core :: IPC, defect)

Description

[Stephen Donner [:stephend] Not actively reading bugmail]

This bug was filed from the Socorro interface and is 
report bp-bea153a0-35e3-42d3-9f42-0fffb2150827.
=============================================================

Build identifier: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:43.0) Gecko/20100101 Firefox/43.0

Built from revision: https://hg.mozilla.org/mozilla-central/rev/f8086bd3c84fc1a42c3625cf3cc2253f0a5e8cfd


Steps to Reproduce:

1. Load http://www.dslreports.com/speedtest
2. Click on the "Gigabit/Fiber" option
3. Wait a bit

Actual Results:

We crash with this stacktrace:

Frame 	Module 	Signature 	Source
0 	xul.dll 	NS_ABORT_OOM(unsigned int) 	xpcom/base/nsDebugImpl.cpp
1 	xul.dll 	IPC::ParamTraits<nsACString_internal>::Read(IPC::Message const*, void**, nsACString_internal*) 	ipc/glue/IPCMessageUtils.h
2 	xul.dll 	mozilla::net::PNeckoParent::Read(mozilla::ipc::StringInputStreamParams*, IPC::Message const*, void**) 	obj-firefox/ipc/ipdl/PNeckoParent.cpp
3 	xul.dll 	mozilla::net::PNeckoParent::Read(mozilla::ipc::InputStreamParams*, IPC::Message const*, void**) 	obj-firefox/ipc/ipdl/PNeckoParent.cpp
4 	xul.dll 	mozilla::net::PNeckoParent::Read(nsTArray<mozilla::ipc::InputStreamParams>*, IPC::Message const*, void**) 	obj-firefox/ipc/ipdl/PNeckoParent.cpp
5 	xul.dll 	mozilla::net::PNeckoParent::Read(mozilla::ipc::MultiplexInputStreamParams*, IPC::Message const*, void**) 	obj-firefox/ipc/ipdl/PNeckoParent.cpp
6 	xul.dll 	mozilla::net::PNeckoParent::Read(mozilla::ipc::InputStreamParams*, IPC::Message const*, void**) 	obj-firefox/ipc/ipdl/PNeckoParent.cpp
7 	xul.dll 	mozilla::net::PNeckoParent::Read(nsTArray<mozilla::ipc::InputStreamParams>*, IPC::Message const*, void**) 	obj-firefox/ipc/ipdl/PNeckoParent.cpp
8 	xul.dll 	mozilla::net::PNeckoParent::Read(mozilla::ipc::MultiplexInputStreamParams*, IPC::Message const*, void**) 	obj-firefox/ipc/ipdl/PNeckoParent.cpp
9 	xul.dll 	mozilla::net::PNeckoParent::Read(mozilla::ipc::InputStreamParams*, IPC::Message const*, void**) 	obj-firefox/ipc/ipdl/PNeckoParent.cpp
10 	xul.dll 	mozilla::net::PNeckoParent::Read(nsTArray<mozilla::ipc::InputStreamParams>*, IPC::Message const*, void**) 	obj-firefox/ipc/ipdl/PNeckoParent.cpp
11 	xul.dll 	mozilla::net::PNeckoParent::Read(mozilla::ipc::MultiplexInputStreamParams*, IPC::Message const*, void**) 	obj-firefox/ipc/ipdl/PNeckoParent.cpp
12 	xul.dll 	mozilla::net::PNeckoParent::Read(mozilla::ipc::InputStreamParams*, IPC::Message const*, void**) 	obj-firefox/ipc/ipdl/PNeckoParent.cpp
13 	xul.dll 	mozilla::net::PNeckoParent::Read(nsTArray<mozilla::ipc::InputStreamParams>*, IPC::Message const*, void**) 	obj-firefox/ipc/ipdl/PNeckoParent.cpp
14 	xul.dll 	mozilla::net::PNeckoParent::Read(mozilla::ipc::MultiplexInputStreamParams*, IPC::Message const*, void**) 	obj-firefox/ipc/ipdl/PNeckoParent.cpp
15 	xul.dll 	mozilla::net::PNeckoParent::Read(mozilla::ipc::InputStreamParams*, IPC::Message const*, void**) 	obj-firefox/ipc/ipdl/PNeckoParent.cpp
16 	xul.dll 	mozilla::net::PNeckoParent::Read(nsTArray<mozilla::ipc::InputStreamParams>*, IPC::Message const*, void**) 	obj-firefox/ipc/ipdl/PNeckoParent.cpp
17 	xul.dll 	mozilla::net::PNeckoParent::Read(mozilla::ipc::MultiplexInputStreamParams*, IPC::Message const*, void**) 	obj-firefox/ipc/ipdl/PNeckoParent.cpp
18 	xul.dll 	mozilla::net::PNeckoParent::Read(mozilla::ipc::InputStreamParams*, IPC::Message const*, void**) 	obj-firefox/ipc/ipdl/PNeckoParent.cpp
19 	xul.dll 	mozilla::net::PNeckoParent::Read(mozilla::ipc::OptionalInputStreamParams*, IPC::Message const*, void**) 	obj-firefox/ipc/ipdl/PNeckoParent.cpp
20 	xul.dll 	mozilla::net::PNeckoParent::Read(mozilla::net::HttpChannelOpenArgs*, IPC::Message const*, void**) 	obj-firefox/ipc/ipdl/PNeckoParent.cpp
21 	xul.dll 	mozilla::net::PNeckoParent::Read(mozilla::net::HttpChannelCreationArgs*, IPC::Message const*, void**) 	obj-firefox/ipc/ipdl/PNeckoParent.cpp
22 	xul.dll 	mozilla::net::PNeckoParent::OnMessageReceived(IPC::Message const&) 	obj-firefox/ipc/ipdl/PNeckoParent.cpp
23 	xul.dll 	mozilla::dom::PContentParent::OnMessageReceived(IPC::Message const&) 	obj-firefox/ipc/ipdl/PContentParent.cpp
24 	xul.dll 	mozilla::ipc::MessageChannel::DispatchMessageW(IPC::Message const&) 	ipc/glue/MessageChannel.cpp
25 	xul.dll 	mozilla::ipc::MessageChannel::OnMaybeDequeueOne() 	ipc/glue/MessageChannel.cpp
26 	xul.dll 	MessageLoop::DoWork() 	ipc/chromium/src/base/message_loop.cc
27 	xul.dll 	mozilla::ipc::DoWorkRunnable::Run() 	ipc/glue/MessagePump.cpp
28 	xul.dll 	nsThread::ProcessNextEvent(bool, bool*) 	xpcom/threads/nsThread.cpp
29 	xul.dll 	mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) 	ipc/glue/MessagePump.cpp
30 	xul.dll 	MessageLoop::RunHandler() 	ipc/chromium/src/base/message_loop.cc
31 	xul.dll 	MessageLoop::Run() 	ipc/chromium/src/base/message_loop.cc
32 	xul.dll 	nsBaseAppShell::Run() 	widget/nsBaseAppShell.cpp
33 	xul.dll 	nsAppShell::Run() 	widget/windows/nsAppShell.cpp
34 	xul.dll 	nsAppStartup::Run() 	toolkit/components/startup/nsAppStartup.cpp
35 	xul.dll 	XREMain::XRE_mainRun() 	toolkit/xre/nsAppRunner.cpp
36 	xul.dll 	XREMain::XRE_main(int, char** const, nsXREAppData const*) 	toolkit/xre/nsAppRunner.cpp
37 	xul.dll 	XRE_main 	toolkit/xre/nsAppRunner.cpp
38 	firefox.exe 	do_main 	browser/app/nsBrowserApp.cpp
39 	firefox.exe 	NS_internal_main(int, char**) 	browser/app/nsBrowserApp.cpp
40 	firefox.exe 	wmain 	toolkit/xre/nsWindowsWMain.cpp
41 	firefox.exe 	__tmainCRTStartup 	f:/dd/vctools/crt/crtw32/startup/crt0.c:255
42 	kernel32.dll 	BaseThreadInitThunk 	
43 	ntdll.dll 	__RtlUserThreadStart 	
44 	ntdll.dll 	_RtlUserThreadStart

Comment 1

[Stephen Donner [:stephend] Not actively reading bugmail]

Jason, :billm says I should need-info? you, so here you are; sorry in advance :-)

Comment 2

[Chris Peterson [:cpeterson]]

I wasn't able to reproduce this OOM with a release build. I wasn't able test a debug build because ftp.mozilla.org seems to be offline.

Comment 3

[Andrew McCreight [:mccr8]]

I haven't looked at this in great detail, but I think this is just the parent side equivalent of bug 1156484: we're trying to send a 10MB message to the child, and we run out of address space. I saw a stack like this in a DMD report I got while running your test case.

Comment 4

[Jason Duell]

I was also unable to crash on OSX.  Perhaps it's windows-only, or maybe it's intermittent.

I agree with :mccr8 that this seems similar to bug 1156484. Is there's something necko should do here to avoid large IPC messages? (we could chop up larger messages into smaller ones if you give me a max size that we should abide by: would that help?)

Comment 5

[Stephen Donner [:stephend] Not actively reading bugmail]

BTW, got an "all tabs" crash on the same site, same scenario, but different stack: https://crash-stats.mozilla.com/report/index/eee038e6-b8e1-4d3e-8fd9-7d4eb2150902

Comment 6

[Stephen Donner [:stephend] Not actively reading bugmail]

(In reply to Stephen Donner [:stephend] from comment #5)
> BTW, got an "all tabs" crash on the same site, same scenario, but different
> stack:
> https://crash-stats.mozilla.com/report/index/eee038e6-b8e1-4d3e-8fd9-
> 7d4eb2150902

Oops, sorry; I meant that comment for bug 1156484!

Comment 7

[Andrew McCreight [:mccr8]]

(In reply to Jason Duell [:jduell] (needinfo? me) from comment #4)
> I agree with :mccr8 that this seems similar to bug 1156484. Is there's
> something necko should do here to avoid large IPC messages? (we could chop
> up larger messages into smaller ones if you give me a max size that we
> should abide by: would that help?)

Yes, breaking up the message a bit would fix the issue here, thanks. Of course, ideally that would be handled at the IPC layer, but if this can be done in Necko without too much trouble that would be a good stopgap measure.

As for what the size should be, maybe dmajor could provide some input.

Comment 8

[(Away)]

I'd recommend that you limit individual allocations to one megabyte or less.