Crash in OOM | small called from [@ ShadowLayerForwarder::EndTransaction]

NEW
Unassigned

Status

()

Core
Graphics: Layers
P3
critical
2 years ago
4 months ago

People

(Reporter: Tomcat, Unassigned)

Tracking

(Blocks: 1 bug, {crash})

unspecified
x86
Windows 7
crash
Points:
---

Firefox Tracking Flags

(firefox49 affected, firefox-esr45 affected, firefox50 affected, firefox51 affected, firefox52 wontfix)

Details

(Whiteboard: [gfx-noted], crash signature, URL)

Attachments

(1 attachment)

This crash report doesn't seem to have the "largest free vm block" calculation. I haven't downloaded the minidump to see if it's because the dump is missing the memory mapping info. I also note that we don't submit memory reports with content process OOM crashes, so that's something we could possibly improve on.

Comment 2

2 years ago
ted, one thing I ran into when redeploying the minidump_stackwalk on Windows was I had to use an older build I had created a while back since it appears breakpad no longer builds on cygwin. The linux versions are up to date I think.
Yeah, that's not your fault, this is on crash-stats where it's using its own stackwalker.

FYI there's an up-to-date Win32 binary available in tooltool that we use for CI:
https://dxr.mozilla.org/mozilla-central/source/testing/config/tooltool-manifests/win32/releng.manifest

Updated

2 years ago
Has STR: --- → yes
Component: Layout → Graphics: Layers
Summary: Crash in OOM | small → Crash in OOM | small called from [@ ShadowLayerForwarder::EndTransaction]
Crash volume for signature 'OOM | small':
 - nightly (version 52): 454 crashes from 2016-09-19.
 - aurora  (version 51): 2667 crashes from 2016-09-19.
 - beta    (version 50): 36215 crashes from 2016-09-20.
 - release (version 49): 142229 crashes from 2016-09-05.
 - esr     (version 45): 50441 crashes from 2016-07-25.

Crash volume on the last weeks (Week N is from 10-17 to 10-23):
            W. N-1  W. N-2  W. N-3  W. N-4
 - nightly     113     126     110      72
 - aurora      855     831     624      87
 - beta      10598   10413    9504    2196
 - release   42427   40232   36866    9112
 - esr        5984    5454    5378    5426

Affected platforms: Windows, Mac OS X, Linux

Crash rank on the last 7 days:
           Browser   Content   Plugin
 - nightly #27       #17
 - aurora  #6        #1
 - beta    #1        #1
 - release #1        #1        #1511
 - esr     #1
status-firefox49: --- → affected
status-firefox50: --- → affected
status-firefox51: --- → affected
status-firefox52: --- → affected
status-firefox-esr45: --- → affected
Whiteboard: [gfx-noted]
(In reply to Carsten Book [:Tomcat] from comment #0)
> Steps to reproduce:
> -> Load
> https://blackboard.paine.edu/webapps/assessment/take/take.
> jsp?course_assessment_id=_22018_1&course_id=_50079_1&content_id=_335946_1&que
> stion_num_16.x=0&toggle_state=qShow&step=null

This particular one doesn't look graphics-related to me.

The page appears to run some JS which inserts a bit of HTML for an error dialog, including a bunch of <link> statements to import CSS. It tries to do this every 100ms. That seems to be what tips us over.

This is the stack I tend to get:

>	mozglue.dll!mozalloc_abort(const char * const msg) Line 33	C++
 	mozglue.dll!mozalloc_handle_oom(unsigned int size) Line 46	C++
 	mozglue.dll!moz_xrealloc(void * ptr, unsigned int size) Line 107	C++
 	xul.dll!nsTArray_base<nsTArrayInfallibleAllocator,nsTArray_CopyWithMemutils>::EnsureCapacity<nsTArrayInfallibleAllocator>(unsigned int aCapacity, unsigned int aElemSize) Line 183	C++
 	xul.dll!nsTArray_Impl<RuleValue,nsTArrayInfallibleAllocator>::AppendElement<RuleValue const &,nsTArrayInfallibleAllocator>(const RuleValue & aItem) Line 2077	C++
 	xul.dll!AppendRuleToTagTable(PLDHashTable * aTable, nsIAtom * aKey, const RuleValue & aRuleInfo) Line 555	C++
 	xul.dll!RuleHash::AppendRule(const RuleSelectorPair & aRuleInfo) Line 580	C++
 	xul.dll!AddRule(RuleSelectorPair * aRuleInfo, RuleCascadeData * aCascade) Line 3366	C++
 	xul.dll!nsCSSRuleProcessor::RefreshRuleCascade(nsPresContext * aPresContext) Line 3819	C++
 	xul.dll!nsCSSRuleProcessor::GetRuleCascade(nsPresContext * aPresContext) Line 3750	C++
 	xul.dll!nsCSSRuleProcessor::HasAttributeDependentStyle(AttributeRuleProcessorData * aData, mozilla::RestyleHintData & aRestyleHintDataResult) Line 2926	C++
 	xul.dll!SheetHasAttributeStyle(nsIStyleRuleProcessor * aProcessor, void * aData) Line 2408	C++
 	xul.dll!nsStyleSet::WalkRuleProcessors(bool(*)(nsIStyleRuleProcessor *, void *) aFunc, ElementDependentRuleProcessorData * aData, bool aWalkAllXBLStylesheets) Line 1321	C++
 	xul.dll!nsStyleSet::HasAttributeDependentStyle(mozilla::dom::Element * aElement, int aNameSpaceID, nsIAtom * aAttribute, int aModType, bool aAttrHasChanged, const nsAttrValue * aOtherValue, mozilla::RestyleHintData & aRestyleHintDataResult) Line 2429	C++
 	xul.dll!mozilla::RestyleManager::AttributeWillChange(mozilla::dom::Element * aElement, int aNameSpaceID, nsIAtom * aAttribute, int aModType, const nsAttrValue * aNewValue) Line 286	C++
 	xul.dll!mozilla::RestyleManagerHandle::Ptr::AttributeWillChange(mozilla::dom::Element * aElement, int aNameSpaceID, nsIAtom * aAttribute, int aModType, const nsAttrValue * aNewValue) Line 139	C++
 	xul.dll!PresShell::AttributeWillChange(nsIDocument * aDocument, mozilla::dom::Element * aElement, int aNameSpaceID, nsIAtom * aAttribute, int aModType, const nsAttrValue * aNewValue) Line 4246	C++
 	xul.dll!nsNodeUtils::AttributeWillChange(mozilla::dom::Element * aElement, int aNameSpaceID, nsIAtom * aAttribute, int aModType, const nsAttrValue * aNewValue) Line 132	C++
 	xul.dll!nsDOMCSSAttributeDeclaration::GetCSSDeclaration(nsDOMCSSDeclaration::Operation aOperation) Line 115	C++
 	xul.dll!nsDOMCSSDeclaration::ParsePropertyValue(const nsCSSPropertyID aPropID, const nsAString_internal & aPropValue, bool aIsImportant) Line 334	C++
 	xul.dll!nsDOMCSSDeclaration::SetPropertyValue(const nsCSSPropertyID aPropID, const nsAString_internal & aValue) Line 111	C++
 	xul.dll!nsDOMCSSAttributeDeclaration::SetPropertyValue(const nsCSSPropertyID aPropID, const nsAString_internal & aValue) Line 196	C++
 	xul.dll!mozilla::dom::CSS2PropertiesBinding::set_overflow(JSContext * cx, JS::Handle<JSObject *> obj, nsDOMCSSDeclaration * self, JSJitSetterCallArgs args) Line 31598	C++
 	xul.dll!mozilla::dom::GenericBindingSetter(JSContext * cx, unsigned int argc, JS::Value * vp) Line 2780	C++
 	xul.dll!js::CallJSNative(JSContext * cx, bool(*)(JSContext *, unsigned int, JS::Value *) native, const JS::CallArgs & args) Line 235	C++
 	xul.dll!js::InternalCallOrConstruct(JSContext * cx, const JS::CallArgs & args, js::MaybeConstruct construct) Line 458	C++
 	xul.dll!InternalCall(JSContext * cx, const js::AnyInvokeArgs & args) Line 503	C++
 	xul.dll!js::CallSetter(JSContext * cx, JS::Handle<JS::Value> thisv, JS::Handle<JS::Value> setter, JS::Handle<JS::Value> v) Line 649	C++
 	xul.dll!SetExistingProperty(JSContext * cx, JS::Handle<js::NativeObject *> obj, JS::Handle<jsid> id, JS::Handle<JS::Value> v, JS::Handle<JS::Value> receiver, JS::Handle<js::NativeObject *> pobj, JS::Handle<js::Shape *> shape, JS::ObjectOpResult & result) Line 2383	C++
 	xul.dll!js::NativeSetProperty(JSContext * cx, JS::Handle<js::NativeObject *> obj, JS::Handle<jsid> id, JS::Handle<JS::Value> value, JS::Handle<JS::Value> receiver, js::QualifiedBool qualified, JS::ObjectOpResult & result) Line 2418	C++
 	xul.dll!js::SetProperty(JSContext * cx, JS::Handle<JSObject *> obj, JS::Handle<jsid> id, JS::Handle<JS::Value> v, JS::Handle<JS::Value> receiver, JS::ObjectOpResult & result) Line 1514	C++
 	xul.dll!js::SetPropertyIgnoringNamedGetter(JSContext * cx, JS::Handle<JSObject *> obj, JS::Handle<jsid> id, JS::Handle<JS::Value> v, JS::Handle<JS::Value> receiver, JS::Handle<JS::PropertyDescriptor> ownDesc_, JS::ObjectOpResult & result) Line 182	C++
 	xul.dll!mozilla::dom::DOMProxyHandler::set(JSContext * cx, JS::Handle<JSObject *> proxy, JS::Handle<jsid> id, JS::Handle<JS::Value> v, JS::Handle<JS::Value> receiver, JS::ObjectOpResult & result) Line 258	C++
 	xul.dll!js::Proxy::set(JSContext * cx, JS::Handle<JSObject *> proxy, JS::Handle<jsid> id, JS::Handle<JS::Value> v, JS::Handle<JS::Value> receiver_, JS::ObjectOpResult & result) Line 334	C++
 	xul.dll!js::proxy_SetProperty(JSContext * cx, JS::Handle<JSObject *> obj, JS::Handle<jsid> id, JS::Handle<JS::Value> v, JS::Handle<JS::Value> receiver, JS::ObjectOpResult & result) Line 590	C++
 	xul.dll!JSObject::nonNativeSetProperty(JSContext * cx, JS::Handle<JSObject *> obj, JS::Handle<jsid> id, JS::Handle<JS::Value> v, JS::Handle<JS::Value> receiver, JS::ObjectOpResult & result) Line 1038	C++
 	xul.dll!SetObjectElementOperation(JSContext * cx, JS::Handle<JSObject *> obj, JS::Handle<jsid> id, JS::Handle<JS::Value> value, JS::Handle<JS::Value> receiver, bool strict, JSScript * script, unsigned char * pc) Line 1495	C++
 	xul.dll!js::SetObjectElement(JSContext * cx, JS::Handle<JSObject *> obj, JS::Handle<JS::Value> index, JS::Handle<JS::Value> value, JS::Handle<JS::Value> receiver, bool strict, JS::Handle<JSScript *> script, unsigned char * pc) Line 4545	C++
 	xul.dll!js::jit::DoSetElemFallback(JSContext * cx, js::jit::BaselineFrame * frame, js::jit::ICSetElem_Fallback * stub_, JS::Value * stack, JS::Handle<JS::Value> objv, JS::Handle<JS::Value> index, JS::Handle<JS::Value> rhs) Line 2546	C++
Too late for firefox 52, mass-wontfix.
status-firefox52: affected → wontfix

Comment 7

11 months ago
I can't reproduce this bug on current Nightly. It leads to high CPU usage but not crash.
Priority: -- → P3
You need to log in before you can comment on or make changes to this bug.