1241522 - crash in OOM | large | NS_ABORT_OOM | Driver_HandleCharacterData

Status: RESOLVED FIXED

(Core :: DOM: HTML Parser, defect)

Description

[Nathan Froyd [:froydnj]]

This bug was filed from the Socorro interface and is 
report bp-ef315cba-e55d-405e-9bea-3d1282160120.
=============================================================

I ran into this earlier in the week, and I can see ~200 crashes or so in the last week.

The stack here is a little botched; I believe the real call responsible is:

http://hg.mozilla.org/releases/mozilla-release/annotate/146f494b6a79/parser/htmlparser/nsExpatDriver.cpp#l416

where we are doing an infallible append to mCDataText.  We ought to be doing a fallible allocation here, which I think should Just Work, since everything above this point should be setup to handle failure of the appending (?).

Comment 1

[Nathan Froyd [:froydnj]]

Attachment: handle OOM in nsExpatDriver::HandleCharacterData

This seems like the obvious way to handle OOM at this point, but as it's very
different from anything else in the parser, I wonder if I'm missing anything...

Comment 2

[Nathan Froyd [:froydnj]]

Comment on attachment 8710510 [details] [diff] [review]
handle OOM in nsExpatDriver::HandleCharacterData

I guess I could interpret the f+ as an r+ on the unchanged patch, but just to formalize it...

Comment 3

[Pulsebot]

https://hg.mozilla.org/integration/mozilla-inbound/rev/77937735dd00

Comment 4

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/77937735dd00

Comment 5

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/77937735dd00