Closed Bug 1373836 Opened 6 years ago Closed 6 years ago

Crash in OOM | large | NS_ABORT_OOM | nsBaseHashtable<T>::Put | mozilla::layers::CompositorAnimationStorage::SetAnimatedValue


(Core :: Graphics, defect)

55 Branch
Not set



Tracking Status
firefox-esr52 --- unaffected
firefox54 --- unaffected
firefox55 --- fixed
firefox56 --- fixed


(Reporter: philipp, Assigned: pchang)



(Keywords: crash, regression)

Crash Data


(1 file)

This bug was filed from the Socorro interface and is 
report bp-d3e9a7c3-f844-429b-a8f1-8ad8e0170616.

Crashing Thread (25), Name: Compositor
Frame 	Module 	Signature 	Source
0 	xul.dll 	NS_ABORT_OOM(unsigned int) 	xpcom/base/nsDebugImpl.cpp:610
1 	xul.dll 	nsBaseHashtable<nsUint64HashKey, nsAutoPtr<mozilla::layers::AnimatedValue>, mozilla::layers::AnimatedValue*>::Put(unsigned __int64 const&, mozilla::layers::AnimatedValue* const&) 	obj-firefox/dist/include/nsBaseHashtable.h:139
2 	xul.dll 	mozilla::layers::CompositorAnimationStorage::SetAnimatedValue(unsigned __int64, float const&) 	gfx/layers/AnimationHelper.cpp:81
3 	xul.dll 	mozilla::layers::ApplyAnimatedValue 	gfx/layers/composite/AsyncCompositionManager.cpp:598
4 	xul.dll 	<lambda_f7495f0d0b221bd0a3a66b28ca0eff19>::operator() 	gfx/layers/composite/AsyncCompositionManager.cpp:685
5 	xul.dll 	mozilla::layers::ForEachNode<mozilla::layers::ForwardIterator, mozilla::layers::Layer*, <lambda_f7495f0d0b221bd0a3a66b28ca0eff19>, <lambda_8cacc904cbe36b7ec82f7aea5f3f70f4> > 	gfx/layers/TreeTraversal.h:137
6 	xul.dll 	mozilla::layers::ForEachNode<mozilla::layers::ForwardIterator, mozilla::layers::Layer*, <lambda_f7495f0d0b221bd0a3a66b28ca0eff19>, <lambda_8cacc904cbe36b7ec82f7aea5f3f70f4> > 	gfx/layers/TreeTraversal.h:142
7 	xul.dll 	mozilla::layers::ForEachNode<mozilla::layers::ForwardIterator, mozilla::layers::Layer*, <lambda_f7495f0d0b221bd0a3a66b28ca0eff19>, <lambda_8cacc904cbe36b7ec82f7aea5f3f70f4> > 	gfx/layers/TreeTraversal.h:142
8 	xul.dll 	mozilla::layers::AsyncCompositionManager::TransformShadowTree(mozilla::TimeStamp, mozilla::BaseTimeDuration<mozilla::TimeDurationValueCalculator>, mozilla::layers::AsyncCompositionManager::TransformsToSkip) 	gfx/layers/composite/AsyncCompositionManager.cpp:1390
9 	xul.dll 	mozilla::layers::CompositorBridgeParent::CompositeToTarget(mozilla::gfx::DrawTarget*, mozilla::gfx::IntRectTyped<mozilla::gfx::UnknownUnits> const*) 	gfx/layers/ipc/CompositorBridgeParent.cpp:992
10 	xul.dll 	mozilla::layers::CompositorVsyncScheduler::Composite(mozilla::TimeStamp) 	gfx/layers/ipc/CompositorVsyncScheduler.cpp:258
11 	xul.dll 	mozilla::detail::RunnableMethodImpl<SoftwareDisplay* const, void ( SoftwareDisplay::*)(mozilla::TimeStamp), 1, 1, mozilla::TimeStamp>::Run() 	obj-firefox/dist/include/nsThreadUtils.h:1133
12 	xul.dll 	MessageLoop::RunTask(already_AddRefed<mozilla::Runnable>) 	ipc/chromium/src/base/
13 	xul.dll 	MessageLoop::DeferOrRunPendingTask(MessageLoop::PendingTask&&) 	ipc/chromium/src/base/
14 	xul.dll 	MessageLoop::DoWork() 	ipc/chromium/src/base/
15 	xul.dll 	base::MessagePumpForUI::DoRunLoop() 	ipc/chromium/src/base/
16 	xul.dll 	base::MessagePumpWin::RunWithDispatcher(base::MessagePump::Delegate*, base::MessagePumpWin::Dispatcher*) 	ipc/chromium/src/base/
17 	xul.dll 	base::MessagePumpWin::Run(base::MessagePump::Delegate*) 	ipc/chromium/src/base/message_pump_win.h:80
18 	xul.dll 	MessageLoop::RunHandler() 	ipc/chromium/src/base/
19 	xul.dll 	MessageLoop::Run() 	ipc/chromium/src/base/
20 	xul.dll 	base::Thread::ThreadMain() 	ipc/chromium/src/base/
21 	xul.dll 	`anonymous namespace'::ThreadFunc 	ipc/chromium/src/base/
22 	kernel32.dll 	BaseThreadInitThunk 	
23 	mozglue.dll 	patched_BaseThreadInitThunk 	mozglue/build/WindowsDllBlocklist.cpp:809
24 	ntdll.dll 	__RtlUserThreadStart 	
25 	ntdll.dll 	_RtlUserThreadStart 	

crash reports with this signature are first showing up in firefox 55.0a1 20170316030211 and subsequent builds. so far they come from 32bit & 64bit versions of firefox on windows and occur in the gpu process 75% of the time. 
parts of the crashing codepath have last been touched with bug 1337889, so i'll tentatively mark this bug here as blocking it.
I will take a look this issue.
Assignee: nobody → howareyou322
For memory usage, assign one fixed id per layer and query entries before insertion should help the memory usage. I just submit a try to see how 'fixed id per layer' works or not.
Copying my question from IRC in case you missed it there:

Are we currently clearing the CompositorAnimationStorage for the non-WR case at all? I was looking for where we do it and I don't see anything.
Comment on attachment 8882202 [details]
Bug 1373836 - Generate fixed animation id per layer if animations exist,

r=me with typos fixed

::: gfx/layers/ipc/LayerTransactionParent.cpp:534
(Diff revision 1)
> +  // Clean up the Animations by id in the CompositorAnimationSotrage
> +  // if there is no active aniamtions on the layer

Attachment #8882202 - Flags: review?(bugmail) → review+
See Also: → 1376896
Pushed by
Generate fixed animation id per layer if animations exist, r=kats
Closed: 6 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla56
This bug could easily cause oom with omta like Bug 1376896 comment 0.
I will wait for awhile and ask for uplift.
Flags: needinfo?(howareyou322)
Blocks: 1376896
Comment on attachment 8882202 [details]
Bug 1373836 - Generate fixed animation id per layer if animations exist,

Approval Request Comment
[Feature/Bug causing the regression]: Bug 1337889
[User impact if declined]: might cause OOM when users browser pages with animations
[Is this code covered by automated tests?]: passed try and land in central for a while
[Has the fix been verified in Nightly?]: Yes
[Needs manual test from QE? If yes, steps to reproduce]: No
[List of other uplifts needed for the feature/fix]: None
[Is the change risky?]: None
[Why is the change risky/not risky?]: It just reduced the chance to consume memory for animation pages
[String changes made/needed]: None
Flags: needinfo?(howareyou322)
Attachment #8882202 - Flags: approval-mozilla-beta?
Comment on attachment 8882202 [details]
Bug 1373836 - Generate fixed animation id per layer if animations exist,

avoid oom crashes from animations, beta55+
Attachment #8882202 - Flags: approval-mozilla-beta? → approval-mozilla-beta+
You need to log in before you can comment on or make changes to this bug.