1310134 - Crash in OOM | small called from [@ ShadowLayerForwarder::EndTransaction]

Status: RESOLVED WORKSFORME

(Core :: Graphics: Layers, defect, P3)

Description

[Carsten Book [:Tomcat]]

Attachment: bughunter stack

found via bughunter and reproduced on aurora opt builds on windows.

Steps to reproduce:
-> Load https://blackboard.paine.edu/webapps/assessment/take/take.jsp?course_assessment_id=_22018_1&course_id=_50079_1&content_id=_335946_1&question_num_16.x=0&toggle_state=qShow&step=null
-> Wait some time
--> Crash 

Breakpad id: https://crash-stats.mozilla.com/report/index/0ff07dca-8481-448c-bc67-1b8c02161014

Comment 1

[(not currently active) Ted Mielczarek]

This crash report doesn't seem to have the "largest free vm block" calculation. I haven't downloaded the minidump to see if it's because the dump is missing the memory mapping info. I also note that we don't submit memory reports with content process OOM crashes, so that's something we could possibly improve on.

Comment 2

[Bob Clary [:bc] (inactive)]

ted, one thing I ran into when redeploying the minidump_stackwalk on Windows was I had to use an older build I had created a while back since it appears breakpad no longer builds on cygwin. The linux versions are up to date I think.

Comment 3

[(not currently active) Ted Mielczarek]

Yeah, that's not your fault, this is on crash-stats where it's using its own stackwalker.

FYI there's an up-to-date Win32 binary available in tooltool that we use for CI:
https://dxr.mozilla.org/mozilla-central/source/testing/config/tooltool-manifests/win32/releng.manifest

Comment 4

[BugBot [:suhaib / :marco/ :calixte]]

Crash volume for signature 'OOM | small':
 - nightly (version 52): 454 crashes from 2016-09-19.
 - aurora  (version 51): 2667 crashes from 2016-09-19.
 - beta    (version 50): 36215 crashes from 2016-09-20.
 - release (version 49): 142229 crashes from 2016-09-05.
 - esr     (version 45): 50441 crashes from 2016-07-25.

Crash volume on the last weeks (Week N is from 10-17 to 10-23):
            W. N-1  W. N-2  W. N-3  W. N-4
 - nightly     113     126     110      72
 - aurora      855     831     624      87
 - beta      10598   10413    9504    2196
 - release   42427   40232   36866    9112
 - esr        5984    5454    5378    5426

Affected platforms: Windows, Mac OS X, Linux

Crash rank on the last 7 days:
           Browser   Content   Plugin
 - nightly #27       #17
 - aurora  #6        #1
 - beta    #1        #1
 - release #1        #1        #1511
 - esr     #1

Comment 5

[Edwin Flores [inactive from 2016-12-01] [:eflores] [:edwin]]

(In reply to Carsten Book [:Tomcat] from comment #0)
> Steps to reproduce:
> -> Load
> https://blackboard.paine.edu/webapps/assessment/take/take.
> jsp?course_assessment_id=_22018_1&course_id=_50079_1&content_id=_335946_1&que
> stion_num_16.x=0&toggle_state=qShow&step=null

This particular one doesn't look graphics-related to me.

The page appears to run some JS which inserts a bit of HTML for an error dialog, including a bunch of <link> statements to import CSS. It tries to do this every 100ms. That seems to be what tips us over.

This is the stack I tend to get:

>	mozglue.dll!mozalloc_abort(const char * const msg) Line 33	C++
 	mozglue.dll!mozalloc_handle_oom(unsigned int size) Line 46	C++
 	mozglue.dll!moz_xrealloc(void * ptr, unsigned int size) Line 107	C++
 	xul.dll!nsTArray_base<nsTArrayInfallibleAllocator,nsTArray_CopyWithMemutils>::EnsureCapacity<nsTArrayInfallibleAllocator>(unsigned int aCapacity, unsigned int aElemSize) Line 183	C++
 	xul.dll!nsTArray_Impl<RuleValue,nsTArrayInfallibleAllocator>::AppendElement<RuleValue const &,nsTArrayInfallibleAllocator>(const RuleValue & aItem) Line 2077	C++
 	xul.dll!AppendRuleToTagTable(PLDHashTable * aTable, nsIAtom * aKey, const RuleValue & aRuleInfo) Line 555	C++
 	xul.dll!RuleHash::AppendRule(const RuleSelectorPair & aRuleInfo) Line 580	C++
 	xul.dll!AddRule(RuleSelectorPair * aRuleInfo, RuleCascadeData * aCascade) Line 3366	C++
 	xul.dll!nsCSSRuleProcessor::RefreshRuleCascade(nsPresContext * aPresContext) Line 3819	C++
 	xul.dll!nsCSSRuleProcessor::GetRuleCascade(nsPresContext * aPresContext) Line 3750	C++
 	xul.dll!nsCSSRuleProcessor::HasAttributeDependentStyle(AttributeRuleProcessorData * aData, mozilla::RestyleHintData & aRestyleHintDataResult) Line 2926	C++
 	xul.dll!SheetHasAttributeStyle(nsIStyleRuleProcessor * aProcessor, void * aData) Line 2408	C++
 	xul.dll!nsStyleSet::WalkRuleProcessors(bool(*)(nsIStyleRuleProcessor *, void *) aFunc, ElementDependentRuleProcessorData * aData, bool aWalkAllXBLStylesheets) Line 1321	C++
 	xul.dll!nsStyleSet::HasAttributeDependentStyle(mozilla::dom::Element * aElement, int aNameSpaceID, nsIAtom * aAttribute, int aModType, bool aAttrHasChanged, const nsAttrValue * aOtherValue, mozilla::RestyleHintData & aRestyleHintDataResult) Line 2429	C++
 	xul.dll!mozilla::RestyleManager::AttributeWillChange(mozilla::dom::Element * aElement, int aNameSpaceID, nsIAtom * aAttribute, int aModType, const nsAttrValue * aNewValue) Line 286	C++
 	xul.dll!mozilla::RestyleManagerHandle::Ptr::AttributeWillChange(mozilla::dom::Element * aElement, int aNameSpaceID, nsIAtom * aAttribute, int aModType, const nsAttrValue * aNewValue) Line 139	C++
 	xul.dll!PresShell::AttributeWillChange(nsIDocument * aDocument, mozilla::dom::Element * aElement, int aNameSpaceID, nsIAtom * aAttribute, int aModType, const nsAttrValue * aNewValue) Line 4246	C++
 	xul.dll!nsNodeUtils::AttributeWillChange(mozilla::dom::Element * aElement, int aNameSpaceID, nsIAtom * aAttribute, int aModType, const nsAttrValue * aNewValue) Line 132	C++
 	xul.dll!nsDOMCSSAttributeDeclaration::GetCSSDeclaration(nsDOMCSSDeclaration::Operation aOperation) Line 115	C++
 	xul.dll!nsDOMCSSDeclaration::ParsePropertyValue(const nsCSSPropertyID aPropID, const nsAString_internal & aPropValue, bool aIsImportant) Line 334	C++
 	xul.dll!nsDOMCSSDeclaration::SetPropertyValue(const nsCSSPropertyID aPropID, const nsAString_internal & aValue) Line 111	C++
 	xul.dll!nsDOMCSSAttributeDeclaration::SetPropertyValue(const nsCSSPropertyID aPropID, const nsAString_internal & aValue) Line 196	C++
 	xul.dll!mozilla::dom::CSS2PropertiesBinding::set_overflow(JSContext * cx, JS::Handle<JSObject *> obj, nsDOMCSSDeclaration * self, JSJitSetterCallArgs args) Line 31598	C++
 	xul.dll!mozilla::dom::GenericBindingSetter(JSContext * cx, unsigned int argc, JS::Value * vp) Line 2780	C++
 	xul.dll!js::CallJSNative(JSContext * cx, bool(*)(JSContext *, unsigned int, JS::Value *) native, const JS::CallArgs & args) Line 235	C++
 	xul.dll!js::InternalCallOrConstruct(JSContext * cx, const JS::CallArgs & args, js::MaybeConstruct construct) Line 458	C++
 	xul.dll!InternalCall(JSContext * cx, const js::AnyInvokeArgs & args) Line 503	C++
 	xul.dll!js::CallSetter(JSContext * cx, JS::Handle<JS::Value> thisv, JS::Handle<JS::Value> setter, JS::Handle<JS::Value> v) Line 649	C++
 	xul.dll!SetExistingProperty(JSContext * cx, JS::Handle<js::NativeObject *> obj, JS::Handle<jsid> id, JS::Handle<JS::Value> v, JS::Handle<JS::Value> receiver, JS::Handle<js::NativeObject *> pobj, JS::Handle<js::Shape *> shape, JS::ObjectOpResult & result) Line 2383	C++
 	xul.dll!js::NativeSetProperty(JSContext * cx, JS::Handle<js::NativeObject *> obj, JS::Handle<jsid> id, JS::Handle<JS::Value> value, JS::Handle<JS::Value> receiver, js::QualifiedBool qualified, JS::ObjectOpResult & result) Line 2418	C++
 	xul.dll!js::SetProperty(JSContext * cx, JS::Handle<JSObject *> obj, JS::Handle<jsid> id, JS::Handle<JS::Value> v, JS::Handle<JS::Value> receiver, JS::ObjectOpResult & result) Line 1514	C++
 	xul.dll!js::SetPropertyIgnoringNamedGetter(JSContext * cx, JS::Handle<JSObject *> obj, JS::Handle<jsid> id, JS::Handle<JS::Value> v, JS::Handle<JS::Value> receiver, JS::Handle<JS::PropertyDescriptor> ownDesc_, JS::ObjectOpResult & result) Line 182	C++
 	xul.dll!mozilla::dom::DOMProxyHandler::set(JSContext * cx, JS::Handle<JSObject *> proxy, JS::Handle<jsid> id, JS::Handle<JS::Value> v, JS::Handle<JS::Value> receiver, JS::ObjectOpResult & result) Line 258	C++
 	xul.dll!js::Proxy::set(JSContext * cx, JS::Handle<JSObject *> proxy, JS::Handle<jsid> id, JS::Handle<JS::Value> v, JS::Handle<JS::Value> receiver_, JS::ObjectOpResult & result) Line 334	C++
 	xul.dll!js::proxy_SetProperty(JSContext * cx, JS::Handle<JSObject *> obj, JS::Handle<jsid> id, JS::Handle<JS::Value> v, JS::Handle<JS::Value> receiver, JS::ObjectOpResult & result) Line 590	C++
 	xul.dll!JSObject::nonNativeSetProperty(JSContext * cx, JS::Handle<JSObject *> obj, JS::Handle<jsid> id, JS::Handle<JS::Value> v, JS::Handle<JS::Value> receiver, JS::ObjectOpResult & result) Line 1038	C++
 	xul.dll!SetObjectElementOperation(JSContext * cx, JS::Handle<JSObject *> obj, JS::Handle<jsid> id, JS::Handle<JS::Value> value, JS::Handle<JS::Value> receiver, bool strict, JSScript * script, unsigned char * pc) Line 1495	C++
 	xul.dll!js::SetObjectElement(JSContext * cx, JS::Handle<JSObject *> obj, JS::Handle<JS::Value> index, JS::Handle<JS::Value> value, JS::Handle<JS::Value> receiver, bool strict, JS::Handle<JSScript *> script, unsigned char * pc) Line 4545	C++
 	xul.dll!js::jit::DoSetElemFallback(JSContext * cx, js::jit::BaselineFrame * frame, js::jit::ICSetElem_Fallback * stub_, JS::Value * stack, JS::Handle<JS::Value> objv, JS::Handle<JS::Value> index, JS::Handle<JS::Value> rhs) Line 2546	C++

Comment 6

[Julien Cristau [:jcristau]]

Too late for firefox 52, mass-wontfix.

Comment 7

[sviter33]

I can't reproduce this bug on current Nightly. It leads to high CPU usage but not crash.

Comment 8

[Pablo]

I was unable to reproduce this bug.
tested it on :
Windows 10 64bit
MacOs 10.14
Windows7 64bit
Ubuntu 20.

Using Firefox Release 85, Firefox ESR 78.7.0 and there were no crashes nor high memory.
unable to check if there were more crashes in the last 6months since crash report is not available anymore

marking this bug as Resolved, works for me.