bugzilla.mozilla.org has resumed normal operation. Attachments prior to 2014 will be unavailable for a few days. This is tracked in Bug 1475801.
Please report any other irregularities here.

High memory usage decoding wav file [@mozilla::MediaRawDataWriter::SetSize]

RESOLVED FIXED in Firefox 49

Status

()

Core
Audio/Video: Playback
P2
normal
RESOLVED FIXED
2 years ago
2 years ago

People

(Reporter: tsmith, Assigned: jya)

Tracking

({csectype-dos, testcase})

unspecified
mozilla49
csectype-dos, testcase
Points:
---

Firefox Tracking Flags

(firefox49 fixed)

Details

MozReview Requests

()

Submitter Diff Changes Open Issues Last Updated
Loading...
Error loading review requests:

Attachments

(3 attachments)

(Reporter)

Description

2 years ago
Created attachment 8747137 [details]
test_case.html

Christoph came across this with his wav fuzzer. test_case.html should reproduce the issue quickly. test_case.wav is included for reference.

#0  0x000000000041ac95 in huge_palloc ()
#1  0x000000000041ad42 in imalloc ()
#2  0x000000000041ad78 in je_malloc ()
#3  0x00007f79076fcba2 in mozilla::AlignedBuffer<unsigned char, 32>::EnsureCapacity(unsigned long) () from /home/user/Desktop/browsers/firefox_dbg_clean/libxul.so
#4  0x00007f79077278f9 in mozilla::MediaRawDataWriter::SetSize(unsigned long) ()
   from /home/user/Desktop/browsers/firefox_dbg_clean/libxul.so
#5  0x00007f7907841bbe in mozilla::WAVTrackDemuxer::GetFileHeader(mozilla::media::Interval<long> const&) () from /home/user/Desktop/browsers/firefox_dbg_clean/libxul.so
#6  0x00007f7907841de1 in mozilla::WAVTrackDemuxer::FmtChunkParserInit() ()
   from /home/user/Desktop/browsers/firefox_dbg_clean/libxul.so
#7  0x00007f7907842351 in mozilla::WAVTrackDemuxer::Init() ()
   from /home/user/Desktop/browsers/firefox_dbg_clean/libxul.so
#8  0x00007f7907842776 in mozilla::WAVDemuxer::InitInternal() ()
   from /home/user/Desktop/browsers/firefox_dbg_clean/libxul.so
#9  0x00007f7907843488 in mozilla::WAVDemuxer::Init() ()
   from /home/user/Desktop/browsers/firefox_dbg_clean/libxul.so
#10 0x00007f790779a5cf in mozilla::MediaFormatReader::AsyncReadMetadata() ()
   from /home/user/Desktop/browsers/firefox_dbg_clean/libxul.so
#11 0x00007f790775f6d7 in mozilla::detail::ProxyRunnable<mozilla::MozPromise<RefPtr<mozilla::MetadataHolder>, mozilla::ReadMetadataFailureReason, true>, mozilla::MediaDecoderReader>::Run() () from /home/user/Desktop/browsers/firefox_dbg_clean/libxul.so
#12 0x00007f79061f2562 in mozilla::AutoTaskDispatcher::TaskGroupRunnable::Run() ()
   from /home/user/Desktop/browsers/firefox_dbg_clean/libxul.so
#13 0x00007f79061fce99 in mozilla::TaskQueue::Runner::Run() ()
   from /home/user/Desktop/browsers/firefox_dbg_clean/libxul.so
#14 0x00007f79061fb74a in nsThreadPool::Run() ()
   from /home/user/Desktop/browsers/firefox_dbg_clean/libxul.so
#15 0x00007f79061f9bde in nsThread::ProcessNextEvent(bool, bool*) ()
   from /home/user/Desktop/browsers/firefox_dbg_clean/libxul.so
#16 0x00007f790621f9be in NS_ProcessNextEvent(nsIThread*, bool) ()
   from /home/user/Desktop/browsers/firefox_dbg_clean/libxul.so
#17 0x00007f790658c29f in mozilla::ipc::MessagePumpForNonMainThreads::Run(base::MessagePump::Delegate*) () from /home/user/Desktop/browsers/firefox_dbg_clean/libxul.so
#18 0x00007f790656b5ff in MessageLoop::RunInternal() ()
   from /home/user/Desktop/browsers/firefox_dbg_clean/libxul.so
#19 0x00007f790656b626 in MessageLoop::Run() ()
   from /home/user/Desktop/browsers/firefox_dbg_clean/libxul.so
#20 0x00007f79061fa478 in nsThread::ThreadFunc(void*) ()
   from /home/user/Desktop/browsers/firefox_dbg_clean/libxul.so
#21 0x00007f79135eafbf in _pt_root ()
   from /home/user/Desktop/browsers/firefox_dbg_clean/libnspr4.so
#22 0x00007f7914a71182 in start_thread (arg=0x7f78f098d700) at pthread_create.c:312
#23 0x00007f7913b7247d in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:111
(Reporter)

Comment 1

2 years ago
Created attachment 8747138 [details]
test_case.wav
(Assignee)

Comment 2

2 years ago
what is there to fix?

Memory allocation in AlignedBuffer are fallible. The OOM will be handled gracefully in a normal build and playback will stop.

https://dxr.mozilla.org/mozilla-central/source/dom/media/MediaData.h#232

reported all the way back to the wave demuxer:
https://dxr.mozilla.org/mozilla-central/source/dom/media/wave/WaveDemuxer.cpp#515

That crash will not happen in a "normal" build.
Sure there's a OOM, but no crash nor ill-effect will result from it.
(Assignee)

Comment 3

2 years ago
if I misread, and it is crashing if this wave is loaded in a audio element with a normal build. Then the issue is in jemalloc itself and it should gracefully returns null when it can't allocate memory
Flags: needinfo?(n.nethercote)
I tried this and I didn't get a crash, though it did bring my Linux desktop machine (which has 32 GiB of RAM) to its knees.

I don't have anything to add here, other than, yes, it looks like jemalloc itself is crashing or aborting.
Flags: needinfo?(n.nethercote)
(Assignee)

Comment 5

2 years ago
We could add a safety threshold in the amount of memory we should attempt to alloc.

2GiB like nsTArray sound like a reasonable upper number. Especially as AlignedBuffer is used in many places as a replacement to nsTArray.
(Reporter)

Updated

2 years ago
Summary: OOM decoding wav file [@mozilla::MediaRawDataWriter::SetSize] → High memory usage decoding wav file [@mozilla::MediaRawDataWriter::SetSize]
(Reporter)

Comment 6

2 years ago
jya, you are correct this is not an OOM. I have updated the title to be more accurate. What we were actually seeing was the system (linux) detecting low memory and killing off the processes using a lot memory, in this case Firefox. 

You and njn seem to be on the right track here. Depending on the OS this could DOS the browser and also the machine itself (as njn experienced) I think having a sane memory limit is a good idea.
Keywords: crash, csectype-oom → csectype-dos
> You and njn seem to be on the right track here. Depending on the OS this
> could DOS the browser and also the machine itself (as njn experienced)

My mouse cursor wasn't even responsive for a while, which is unusual for this machine.
(Assignee)

Comment 8

2 years ago
Created attachment 8748017 [details]
MozReview Request: Bug 1268929: Limit memory allocated for media to 2GiB max. r?gerald

Review commit: https://reviewboard.mozilla.org/r/50101/diff/#index_header
See other reviews: https://reviewboard.mozilla.org/r/50101/
Attachment #8748017 - Flags: review?(gsquelart)
Comment on attachment 8748017 [details]
MozReview Request: Bug 1268929: Limit memory allocated for media to 2GiB max. r?gerald

https://reviewboard.mozilla.org/r/50101/#review46873
Attachment #8748017 - Flags: review?(gsquelart) → review+
Priority: -- → P2

Comment 11

2 years ago
bugherder
https://hg.mozilla.org/mozilla-central/rev/b844f8c5b192
Status: NEW → RESOLVED
Last Resolved: 2 years ago
status-firefox49: --- → fixed
Resolution: --- → FIXED
Target Milestone: --- → mozilla49
You need to log in before you can comment on or make changes to this bug.