1248788 - crash in mozilla::ipc::FatalError | mozilla::dom::indexedDB::PBackgroundIDBTransactionParent::FatalError | mozilla::dom::indexedDB::PBackgroundIDBTransactionParent::Read

Status: RESOLVED DUPLICATE of bug 1258312

(Core :: Storage: IndexedDB, defect)

Description

[Jukka Jylänki]

This bug was filed from the Socorro interface and is 
report bp-39c4a19a-c32a-4f1a-91ce-3ce3a2160216.
=============================================================

STR:

1. Run full emunittest 0.5 suite with vsync disabled.

Observed: Crashes when loading the fifth test. The crash seems to only occur on 32-bit Firefox, and not on 64-bit.

Comment 1

[Andrew Overholt [:overholt]]

Kyle or Jan, do you have any thoughts here?

Comment 2

[Kyle Huey (Exited; not receiving bugmail, old account, do not use)]

An error reading the serialized data is surprising.  Reproducing would help.

Comment 3

[Andrew Overholt [:overholt]]

Jan, this seems to be reproducible. Please investigate.

Comment 4

[Andrew Overholt [:overholt]]

Jukka, can you provide Jan with the emunittest suite?

Comment 5

[Jukka Jylänki]

Hey, sorry for the delay. Checked this again, still occurs (https://crash-stats.mozilla.com/report/index/3df6ff6d-db6e-4688-b51b-93e792160323). Providing Jan with access to the test suite in a separate email now.

Comment 6

[Jukka Jylänki]

Got one of these again today in Firefox 45.0.2 32-bit release channel: https://crash-stats.mozilla.com/report/index/d11f76c1-43c6-45ae-a736-f30642160426

Comment 7

[(not currently active) Ted Mielczarek]

From the crash report in comment 0, FWIW (in the 'Metadata' tab):
IPCFatalErrorMsg Error deserializing 'offsetToKeyProp' (uint64_t) member of 'SerializedStructuredCloneWriteInfo'
IPCFatalErrorProtocol PBackgroundIDBTransactionParent

Comment 8

[Andrew McCreight [:mccr8]]

This is almost certainly the same issue as bug 1258312. Before the patch in that bug, if a sending process tried and failed to grow an IPC::Message then it would send the truncated message, causing the receiving process to crash in deserialization. Now, that will cause the sending process to OOM crash. The new crash signature will have Pickle() in it. File a new bug when you see those crashes, or reopen this one and edit it if you like.