1497149 - Crash in OOM | large | NS_ABORT_OOM | nsTArray_base<T>::EnsureCapacity<T> | mozilla::dom::HTMLMediaElement::DispatchAsyncEvent

Status: RESOLVED FIXED

(Core :: Audio/Video, defect, P2)

Description

[Gabriele Svelto [:gsvelto]]

This bug was filed from the Socorro interface and is
report bp-cba09fcf-5436-4aee-952e-5d2ec0181008.
=============================================================

Top 10 frames of crashing thread:

0 xul.dll NS_ABORT_OOM xpcom/base/nsDebugImpl.cpp:628
1 xul.dll nsTArray_base<nsTArrayInfallibleAllocator, nsTArray_CopyWithMemutils>::EnsureCapacity<nsTArrayInfallibleAllocator> xpcom/ds/nsTArray-inl.h
2 xul.dll mozilla::dom::HTMLMediaElement::DispatchAsyncEvent dom/html/HTMLMediaElement.cpp:6478
3 xul.dll void mozilla::dom::HTMLMediaElement::ChangeReadyState dom/html/HTMLMediaElement.cpp:6199
4 xul.dll mozilla::dom::HTMLMediaElement::UpdateReadyStateInternal dom/html/HTMLMediaElement.cpp:6046
5 xul.dll void mozilla::MediaDecoder::OnNextFrameStatus dom/media/MediaDecoder.cpp:449
6 xul.dll nsresult mozilla::detail::RunnableMethodImpl<RefPtr<mozilla::AudioTrackEncoder>, void  xpcom/threads/nsThreadUtils.h:1242
7 xul.dll mozilla::AutoTaskDispatcher::TaskGroupRunnable::Run xpcom/threads/TaskDispatcher.h:214
8 xul.dll mozilla::EventTargetWrapper::Runner::Run xpcom/threads/AbstractThread.cpp:150
9 xul.dll mozilla::SchedulerGroup::Runnable::Run xpcom/threads/SchedulerGroup.cpp:337

=============================================================

Comment 1

[Jean-Yves Avenard [:jya]]

If we have an OOM there, it's likely because of an issue somewhere else.
That array will never contain more than 4-5 items at a time...

I would classify this unique crash as an odd one, unlikely to ever reproduce (cosmic rays, bit flips etc)

Comment 2

[Jean-Yves Avenard [:jya]]

Actually, a few, all with build id >= 20181006100304

So this started with bug 1495904 , don't see how it could cause that however.
We attempt to set the message queue size > 2GiB (2,208,301,056 bytes)

Comment 3

[Calixte Denizet (:calixte)]

The pushlog for build 20181006100304:
https://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=54cb6a2f028b&tochange=6f233fd06aac

Comment 4

[Gabriele Svelto [:gsvelto]]

Yeah, I filed it because it looked like a potential spike on new nightly versions.

Comment 5

[Gabriele Svelto [:gsvelto]]

I seem to have found another signature.

Comment 6

[Jean-Yves Avenard [:jya]]

The only thing in this push touching the media code is bug 1495871. Looks unlikely to be the culprit too.

Comment 7

[Jean-Yves Avenard [:jya]]

This is definitely related to a change in the seeking code as modified in bug 1495904 

In one of the dump, the array of events contains 138018815 elements.

And the events in there are:
do { seeking, timeupdate, waiting, timeupdate, seeking, canplay, playing, canplaythrough } while(true)

Comment 8

[Jan-Ivar Bruaroey [:jib] (needinfo? me)]

The only thing I see wrong in the new code in bug 1495904 is that it forgets to check aRV in the case where creating a promise fails:

https://searchfox.org/mozilla-central/rev/29aea2a2a3bd0f5e25ce0b60a76053fb25ba5149/dom/html/HTMLMediaElement.cpp#2893

I could see this affect the symptom of an already present OOM situation.

We could try moving the creation of the promise back to where it was earlier, and check aRV like we used to.

Comment 9

[Jan-Ivar Bruaroey [:jib] (needinfo? me)]

Attachment: Bug 1497149 - Avoid nulling mSeekDOMPromise on OOM, and use IgnoreErrors(). r?jya

Comment 10

[Jan-Ivar Bruaroey [:jib] (needinfo? me)]

Attachment: Bug 1497149 - Don't refcount runnables unnecessarily in Async[Resolve|Reject]SeekDOMPromiseIfExists. r?jya

Comment 11

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/3ded0ccdc4a5
Avoid nulling mSeekDOMPromise on OOM, and use IgnoreErrors(). r=jya

Comment 12

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/b59cdee37257
Don't refcount runnables unnecessarily in Async[Resolve|Reject]SeekDOMPromiseIfExists. r=jya

Comment 13

[Noemi Erli[:noemi_erli]]

https://hg.mozilla.org/mozilla-central/rev/3ded0ccdc4a5
https://hg.mozilla.org/mozilla-central/rev/b59cdee37257