1344558 - Crash in OOM | large | NS_ABORT_OOM | nsAutoCString::nsAutoCString

Status: RESOLVED FIXED

(Core :: Networking, defect)

Description

[[:philipp]]

This bug was filed from the Socorro interface and is 
report bp-f657bbf6-8f39-47d9-b6b1-eeb852170304.
=============================================================
Crashing Thread (0)
Frame 	Module 	Signature 	Source
0 	xul.dll 	NS_ABORT_OOM(unsigned int) 	xpcom/base/nsDebugImpl.cpp:606
1 	xul.dll 	nsAutoCString::nsAutoCString(nsACString_internal const&) 	obj-firefox/dist/include/nsTString.h:612
2 	xul.dll 	mozilla::net::nsSimpleURI::SetPath(nsACString_internal const&) 	netwerk/base/nsSimpleURI.cpp:427
3 	xul.dll 	mozilla::net::nsSimpleURI::SetSpec(nsACString_internal const&) 	netwerk/base/nsSimpleURI.cpp:278
4 	xul.dll 	nsDataHandler::NewURI(nsACString_internal const&, char const*, nsIURI*, nsIURI**) 	netwerk/protocol/data/nsDataHandler.cpp:98
5 	xul.dll 	mozilla::net::nsIOService::NewURI(nsACString_internal const&, char const*, nsIURI*, nsIURI**) 	netwerk/base/nsIOService.cpp:648
6 	xul.dll 	NS_NewURI(nsIURI**, nsACString_internal const&, char const*, nsIURI*, nsIIOService*) 	netwerk/base/nsNetUtilInlines.h:115
7 	xul.dll 	mozilla::css::URLValueData::GetURI() 	layout/style/nsCSSValue.cpp:2795
8 	xul.dll 	nsCSSValue::StartImageLoad(nsIDocument*) 	layout/style/nsCSSValue.cpp:839
9 	xul.dll 	TryToStartImageLoadOnValue 	layout/style/nsCSSDataBlock.cpp:98
10 	xul.dll 	TryToStartImageLoad 	layout/style/nsCSSDataBlock.cpp:143
11 	xul.dll 	TryToStartImageLoad 	layout/style/nsCSSDataBlock.cpp:133
12 	xul.dll 	nsCSSCompressedDataBlock::MapRuleInfoInto(nsRuleData*) 	layout/style/nsCSSDataBlock.cpp:333
13 	xul.dll 	nsRuleNode::WalkRuleTree(nsStyleStructID, nsStyleContext*) 	layout/style/nsRuleNode.cpp:2478
14 	xul.dll 	nsStyleContext::DoGetStyleBackground<1>() 	obj-firefox/dist/include/nsStyleStructList.h:81
15 	xul.dll 	nsStyleContext::CalcStyleDifferenceInternal<nsStyleContext>(nsStyleContext*, nsChangeHint, unsigned int*, unsigned int*) 	layout/style/nsStyleContext.cpp:1108
16 	xul.dll 	mozilla::ElementRestyler::CaptureChange(nsStyleContext*, nsStyleContext*, nsChangeHint, unsigned int*, unsigned int*) 	layout/base/RestyleManager.cpp:1595
17 	xul.dll 	mozilla::ElementRestyler::RestyleSelf(nsIFrame*, nsRestyleHint, unsigned int*, nsTArray<mozilla::ElementRestyler::SwapInstruction>&) 	layout/base/RestyleManager.cpp:2973
18 	xul.dll 	mozilla::ElementRestyler::Restyle(nsRestyleHint) 	layout/base/RestyleManager.cpp:2136
19 	xul.dll 	mozilla::ElementRestyler::ComputeStyleChangeFor(nsIFrame*, nsStyleChangeList*, nsChangeHint, mozilla::RestyleTracker&, nsRestyleHint, mozilla::RestyleHintData const&, nsTArray<mozilla::ElementRestyler::ContextToClear>&, nsTArray<RefPtr<nsStyleContext> >&) 	layout/base/RestyleManager.cpp:3390
20 	xul.dll 	mozilla::RestyleManager::ComputeAndProcessStyleChange(nsIFrame*, nsChangeHint, mozilla::RestyleTracker&, nsRestyleHint, mozilla::RestyleHintData const&) 	layout/base/RestyleManager.cpp:3800
21 	mozglue.dll 	je_free 	memory/mozjemalloc/jemalloc.c:6485
22 	xul.dll 	nsTArray_Impl<RefPtr<nsISupports>, nsTArrayInfallibleAllocator>::RemoveElementsAt(unsigned int, unsigned int) 	obj-firefox/dist/include/nsTArray.h:1944
23 	xul.dll 	xul.dll@0x259a393 	
24 	mozglue.dll 	arena_bin_nonfull_run_get 	memory/mozjemalloc/jemalloc.c:3978
25 		@0x29e94f 	
26 		@0xce4a01f 	
27 	xul.dll 	nsCycleCollector::CollectWhite() 	xpcom/base/nsCycleCollector.cpp:3346
28 	mozglue.dll 	moz_xrealloc 	memory/mozalloc/mozalloc.cpp:105
29 	xul.dll 	nsTArray_Impl<nsCOMPtr<nsIStyleRuleProcessor>, nsTArrayInfallibleAllocator>::RemoveElementsAt(unsigned int, unsigned int) 	obj-firefox/dist/include/nsTArray.h:1944
30 	xul.dll 	nsViewManager::FlushDelayedResize(bool) 	view/nsViewManager.cpp:243
31 	xul.dll 	mozilla::RestyleManager::ProcessPendingRestyles() 	layout/base/RestyleManager.cpp:834
32 	xul.dll 	PresShell::FlushPendingNotifications(mozilla::ChangesToFlush) 	layout/base/nsPresShell.cpp:4139
33 	xul.dll 	nsRefreshDriver::Tick(__int64, mozilla::TimeStamp) 	layout/base/nsRefreshDriver.cpp:1836
34 	xul.dll 	mozilla::RefreshDriverTimer::TickDriver(nsRefreshDriver*, __int64, mozilla::TimeStamp) 	layout/base/nsRefreshDriver.cpp:326
35 	xul.dll 	mozilla::RefreshDriverTimer::TickRefreshDrivers(__int64, mozilla::TimeStamp, nsTArray<RefPtr<nsRefreshDriver> >&) 	layout/base/nsRefreshDriver.cpp:295
36 	xul.dll 	mozilla::RefreshDriverTimer::Tick(__int64, mozilla::TimeStamp) 	layout/base/nsRefreshDriver.cpp:316
37 	xul.dll 	mozilla::VsyncRefreshDriverTimer::RunRefreshDrivers(mozilla::TimeStamp) 	layout/base/nsRefreshDriver.cpp:663
38 	xul.dll 	mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::TickRefreshDriver(mozilla::TimeStamp) 	layout/base/nsRefreshDriver.cpp:583
39 	xul.dll 	mozilla::detail::RunnableMethodImpl<void ( mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::*)(mozilla::TimeStamp), 1, 0, mozilla::TimeStamp>::Run() 	obj-firefox/dist/include/nsThreadUtils.h:810
40 	xul.dll 	nsThread::ProcessNextEvent(bool, bool*) 	xpcom/threads/nsThread.cpp:1216
41 	xul.dll 	mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) 	ipc/glue/MessagePump.cpp:96
42 	xul.dll 	MessageLoop::RunHandler() 	ipc/chromium/src/base/message_loop.cc:225
43 	xul.dll 	MessageLoop::Run() 	ipc/chromium/src/base/message_loop.cc:205
44 	xul.dll 	nsBaseAppShell::Run() 	widget/nsBaseAppShell.cpp:156
45 	xul.dll 	nsAppShell::Run() 	widget/windows/nsAppShell.cpp:262
46 	xul.dll 	nsAppStartup::Run() 	toolkit/components/startup/nsAppStartup.cpp:283
47 	xul.dll 	XREMain::XRE_mainRun() 	toolkit/xre/nsAppRunner.cpp:4472
48 	xul.dll 	XREMain::XRE_main(int, char** const, nsXREAppData const*) 	toolkit/xre/nsAppRunner.cpp:4605
49 	xul.dll 	XRE_main 	toolkit/xre/nsAppRunner.cpp:4696
50 	firefox.exe 	do_main 	browser/app/nsBrowserApp.cpp:282
51 	firefox.exe 	wmain 	toolkit/xre/nsWindowsWMain.cpp:115
52 	firefox.exe 	__scrt_common_main_seh 	f:/dd/vctools/crt/vcstartup/src/startup/exe_common.inl:253
53 	kernel32.dll 	BaseThreadInitThunk 	
54 	ntdll.dll 	__RtlUserThreadStart 	
55 	ntdll.dll 	_RtlUserThreadStart

this crash signature is regressing in volume in 52, which seems to be related to the uplift of bug 1310483 timing wise. 
the signature amounts to around 0.1% of all crashes on 52.0b last week.

Comment 1

[Valentin Gosu [:valentin] (he/him)]

Attachment: Bug 1344558 - Avoid OOM in nsSimpleURI::SetPath

Review commit: https://reviewboard.mozilla.org/r/117318/diff/#index_header
See other reviews: https://reviewboard.mozilla.org/r/117318/

Comment 2

[Patrick McManus [:mcmanus]]

Comment on attachment 8843756 [details]
Bug 1344558 - Avoid OOM in nsSimpleURI::SetPath

https://reviewboard.mozilla.org/r/117318/#review119028

Comment 3

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/5433c0e88720
Avoid OOM in nsSimpleURI::SetPath r=mcmanus

Comment 4

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/5433c0e88720

Comment 5

[Valentin Gosu [:valentin] (he/him)]

Comment on attachment 8843756 [details]
Bug 1344558 - Avoid OOM in nsSimpleURI::SetPath

Approval Request Comment
[Feature/Bug causing the regression]: bug 1310483
[User impact if declined]: OOM crashes
[Is this code covered by automated tests?]: yes, but none covering the OOM case
[Has the fix been verified in Nightly?]: waiting for crash-stats results
[Needs manual test from QE? If yes, steps to reproduce]: no
[List of other uplifts needed for the feature/fix]: none
[Is the change risky?]: no
[Why is the change risky/not risky?]: very small code change.
[String changes made/needed]: none

Comment 6

[Gerry Chang [:gchang]]

Comment on attachment 8843756 [details]
Bug 1344558 - Avoid OOM in nsSimpleURI::SetPath

Fix an OOM crash issue. Aurora54+.

Comment 7

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/releases/mozilla-aurora/rev/35c1e647aaee

Comment 8

[Ryan VanderMeulen [:RyanVM]]

Not sure if the volume is high enough to warrant ride-along consideration in the event of an Fx52 dot release.

Comment 9

[Ritu Kothari (:ritu) (Inactive, please n-i to RyanVM, jcristau, or pascal)]

Comment on attachment 8843756 [details]
Bug 1344558 - Avoid OOM in nsSimpleURI::SetPath

Crash fix, Beta53+

Comment 10

[Ritu Kothari (:ritu) (Inactive, please n-i to RyanVM, jcristau, or pascal)]

Comment on attachment 8843756 [details]
Bug 1344558 - Avoid OOM in nsSimpleURI::SetPath

Crash fix, ESR52.1+

Comment 11

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/releases/mozilla-beta/rev/725b9ae87b49

Comment 12

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/releases/mozilla-esr52/rev/4147826407e8

Comment 13

[Andrei Vaida [:avaida]]

Setting qe-verify- based on Valentin's assessment on manual testing needs (see Comment 5).

Comment 14

[Julien Cristau [:jcristau]]

This is ranked #142 for 52.0 on soccoro, not worth taking in a dot release.