1499166 - Uncaught crash in IndexedDB

Status: RESOLVED INVALID

(Core :: Storage: IndexedDB, defect)

Description

[Jason Kratzer [:jkratzer]]

Attachment: testcase.html

The attached testcase appears to crash the tab under m-c rev 4a230b07f0cb however, no crash information is generated.  I've tested this with both asan and debug builds and nothing is returned.

Please note that the testcase must be served via a local webserver in order to reproduce.

Comment 1

[Jason Kratzer [:jkratzer]]

Attachment: fuzzer.js

Comment 2

[Jesse Schwartzentruber (:truber)]

Looks like it's oom-killer:

Oct 15 15:59:29 glenda kernel: JS Helper invoked oom-killer: gfp_mask=0x6280ca(GFP_HIGHUSER_MOVABLE|__GFP_ZERO), nodemask=(null), order=0, oom_score_adj=0
Oct 15 15:59:29 glenda kernel: JS Helper cpuset=/ mems_allowed=0
...
Oct 15 15:59:29 glenda kernel: Out of memory: Kill process 28580 (file:// Content) score 466 or sacrifice child
Oct 15 15:59:29 glenda kernel: Killed process 28580 (file:// Content) total-vm:21710904208kB, anon-rss:8490628kB, file-rss:0kB, shmem-rss:260kB
Oct 15 15:59:29 glenda kernel: oom_reaper: reaped process 28580 (file:// Content), now anon-rss:0kB, file-rss:0kB, shmem-rss:4kB

Comment 3

[Jason Kratzer [:jkratzer]]

(In reply to Jesse Schwartzentruber (:truber) from comment #2)
> Looks like it's oom-killer:
> 
> Oct 15 15:59:29 glenda kernel: JS Helper invoked oom-killer:
> gfp_mask=0x6280ca(GFP_HIGHUSER_MOVABLE|__GFP_ZERO), nodemask=(null),
> order=0, oom_score_adj=0
> Oct 15 15:59:29 glenda kernel: JS Helper cpuset=/ mems_allowed=0
> ...
> Oct 15 15:59:29 glenda kernel: Out of memory: Kill process 28580 (file://
> Content) score 466 or sacrifice child
> Oct 15 15:59:29 glenda kernel: Killed process 28580 (file:// Content)
> total-vm:21710904208kB, anon-rss:8490628kB, file-rss:0kB, shmem-rss:260kB
> Oct 15 15:59:29 glenda kernel: oom_reaper: reaped process 28580 (file://
> Content), now anon-rss:0kB, file-rss:0kB, shmem-rss:4kB

Good catch.  Appears to be due to the massive images created via ImageData constructor.  I'll have to tune these down.  Closing.