1307416 - Crash in OOM | large | mozalloc_abort | mozalloc_handle_oom | moz_xmalloc | nsTArray_base<T>::EnsureCapacity<T> | nsTArray_Impl<T>::AppendElements<T> | nsTArray_Impl<T>::AppendElements<T> | mozilla::dom::BlobData::BlobData

Status: RESOLVED DUPLICATE of bug 1288997

(Core :: DOM: Core & HTML, defect)

Description

[[:philipp]]

This bug was filed from the Socorro interface and is 
report bp-1630478d-c86f-4f5e-937d-7aadf2161004.
=============================================================
Crashing Thread (0)
Frame 	Module 	Signature 	Source
0 	mozglue.dll 	mozalloc_abort(char const* const) 	memory/mozalloc/mozalloc_abort.cpp:33
1 	mozglue.dll 	mozalloc_handle_oom(unsigned int) 	memory/mozalloc/mozalloc_oom.cpp:46
2 	mozglue.dll 	moz_xmalloc 	memory/mozalloc/mozalloc.cpp:85
3 	xul.dll 	nsTArray_base<nsTArrayInfallibleAllocator, nsTArray_CopyWithMemutils>::EnsureCapacity<nsTArrayInfallibleAllocator>(unsigned int, unsigned int) 	obj-firefox/dist/include/nsTArray-inl.h:136
4 	xul.dll 	nsTArray_Impl<bool, nsTArrayInfallibleAllocator>::AppendElements<bool, nsTArrayInfallibleAllocator>(bool const*, unsigned int) 	obj-firefox/dist/include/nsTArray.h:1994
5 	xul.dll 	nsTArray_Impl<unsigned char, nsTArrayInfallibleAllocator>::AppendElements<unsigned char, nsTArrayInfallibleAllocator, nsTArrayInfallibleAllocator>(nsTArray_Impl<unsigned char, nsTArrayInfallibleAllocator> const&) 	obj-firefox/dist/include/nsTArray.h:1502
6 	xul.dll 	mozilla::dom::BlobData::BlobData(mozilla::dom::BlobData const&) 	obj-firefox/ipc/ipdl/DOMTypes.cpp:351
7 	xul.dll 	nsTArray_Impl<mozilla::dom::BlobData, nsTArrayInfallibleAllocator>::AssignRange<mozilla::dom::BlobData>(unsigned int, unsigned int, mozilla::dom::BlobData const*) 	obj-firefox/dist/include/nsTArray.h:1874
8 	xul.dll 	nsTArray_Impl<mozilla::dom::BlobData, nsTArrayInfallibleAllocator>::ReplaceElementsAt<mozilla::dom::BlobData, nsTArrayInfallibleAllocator>(unsigned int, unsigned int, mozilla::dom::BlobData const*, unsigned int) 	obj-firefox/dist/include/nsTArray.h:1893
9 	xul.dll 	mozilla::dom::BlobData::operator=(mozilla::dom::BlobData const&) 	obj-firefox/ipc/ipdl/DOMTypes.cpp:433
10 	xul.dll 	mozilla::dom::OptionalBlobData::operator=(mozilla::dom::OptionalBlobData const&) 	obj-firefox/ipc/ipdl/DOMTypes.cpp:603
11 	xul.dll 	mozilla::dom::NormalBlobConstructorParams::Assign(nsString const&, unsigned __int64 const&, mozilla::dom::OptionalBlobData const&) 	obj-firefox/ipc/ipdl/DOMTypes.cpp:706
12 	xul.dll 	mozilla::dom::NormalBlobConstructorParams::operator=(mozilla::dom::NormalBlobConstructorParams const&) 	obj-firefox/ipc/ipdl/_ipdlheaders/mozilla/dom/DOMTypes.h:785
13 	xul.dll 	mozilla::dom::AnyBlobConstructorParams::operator=(mozilla::dom::NormalBlobConstructorParams const&) 	obj-firefox/ipc/ipdl/DOMTypes.cpp:1090
14 	xul.dll 	mozilla::dom::BlobChild::GetOrCreateFromImpl<mozilla::dom::nsIContentChild>(mozilla::dom::nsIContentChild*, mozilla::dom::BlobImpl*) 	dom/ipc/Blob.cpp:3405
15 	mozglue.dll 	je_malloc 	memory/mozjemalloc/jemalloc.c:6184
16 	xul.dll 	nsACString_internal::ReplacePrepInternal(unsigned int, unsigned int, unsigned int, unsigned int) 	xpcom/string/nsTSubstring.cpp:195
17 	mozglue.dll 	je_malloc 	memory/mozjemalloc/jemalloc.c:6184
18 	xul.dll 	nsACString_internal::Replace(unsigned int, unsigned int, char const*, unsigned int, mozilla::fallible_t const&) 	xpcom/string/nsTSubstring.cpp:568
19 	xul.dll 	mozilla::BlobURLsReporter::GetJSStackForBlob(DataInfo*) 	dom/base/nsHostObjectProtocolHandler.cpp:315
20 	xul.dll 	nsHostObjectProtocolHandler::AddDataEntry(mozilla::dom::BlobImpl*, nsIPrincipal*, nsACString_internal&) 	dom/base/nsHostObjectProtocolHandler.cpp:465
21 	xul.dll 	mozilla::dom::`anonymous namespace'::CreateObjectURLInternal<mozilla::dom::BlobImpl*> 	dom/url/URL.cpp:52
22 	xul.dll 	mozilla::dom::URLBinding::createObjectURL 	obj-firefox/dom/bindings/URLBinding.cpp:938

oom crashes with this signature are on the rise since firefox 50 builds.

Comment 1

[[:philipp]]

forgot to add that these are crashes in the content process only.

Comment 2

[[:philipp]]

this started to occur on 50.0a1 build 20160718081125 first:
https://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=711963e8daa312ae06409f8ab5c06612cb0b8f7b&tochange=cde56ead650fd302be1d440507485b9abf7c163a

so maybe related to bug 1279186 which landed in that timeframe?

Comment 3

[Andrea Marchesini [:baku]]

Could be already fixed by bug 1288997 ?

Comment 4

[[:philipp]]

indeed, it seems to stop with 52.0a1 build 20160921030221 and https://bugzilla.mozilla.org/show_bug.cgi?id=1288997#c44 landed on nightly the day after.

Comment 6

[Gerry Chang [:gchang]]

Mark 50/51 fixed as bug 1288997 was fixed in 50/51.