1648572 - Hit MOZ_CRASH(OOM) at /builds/worker/checkouts/gecko/xpcom/base/nsDebugImpl.cpp:611

Status: RESOLVED FIXED

(Core :: DOM: Device Interfaces, defect, P2)

Description

[Jason Kratzer [:jkratzer]]

Attachment: testcase.html

Testcase found while fuzzing mozilla-central db74cdf9afe7 (built with --enable-debug).

rax = 0x00007fbcecf91b53   rdx = 0x0000000000000000
rcx = 0x000055cc99901a58   rbx = 0x000055cc9be7d2a8
rsi = 0x00007fbcff37b8b0   rdi = 0x00007fbcff37a680
rbp = 0x00007ffcaf2234c0   rsp = 0x00007ffcaf2234c0
r8 = 0x00007fbcff37b8b0    r9 = 0x00007fbd004e1780
r10 = 0x0000000000000002   r11 = 0x0000000000000000
r12 = 0x00000000fffffffd   r13 = 0x000055cc9be7d240
r14 = 0x000055cc9be7d2a8   r15 = 0x0000000000000008
rip = 0x00007fbce54428b5
OS|Linux|0.0.0 Linux 5.3.0-51-generic #44~18.04.2-Ubuntu SMP Thu Apr 23 14:27:18 UTC 2020 x86_64
CPU|amd64|family 6 model 94 stepping 3|8
GPU|||
Crash|SIGSEGV|0x0|0
0|0|libxul.so|NS_ABORT_OOM(unsigned long)|hg:hg.mozilla.org/mozilla-central:xpcom/base/nsDebugImpl.cpp:db74cdf9afe797ced554aaf7e79b9bdc3e86f719|611|0x16
0|1|libxul.so|nsTArrayInfallibleAllocator::ResultTypeProxy nsTArray_base<nsTArrayInfallibleAllocator, nsTArray_RelocateUsingMemutils>::EnsureCapacity<nsTArrayInfallibleAllocator>(unsigned long, unsigned long)|hg:hg.mozilla.org/mozilla-central:xpcom/ds/nsTArray-inl.h:db74cdf9afe797ced554aaf7e79b9bdc3e86f719|154|0x8
0|2|libxul.so|mozilla::dom::Gamepad::Gamepad(nsISupports*, nsTSubstring<char16_t> const&, int, unsigned int, mozilla::dom::GamepadMappingType, mozilla::dom::GamepadHand, unsigned int, unsigned int, unsigned int, unsigned int, unsigned int, unsigned int)|hg:hg.mozilla.org/mozilla-central:dom/gamepad/Gamepad.cpp:db74cdf9afe797ced554aaf7e79b9bdc3e86f719|54|0x37
0|3|libxul.so|mozilla::dom::GamepadManager::AddGamepad(unsigned int, nsTSubstring<char16_t> const&, mozilla::dom::GamepadMappingType, mozilla::dom::GamepadHand, mozilla::dom::GamepadServiceType, unsigned int, unsigned int, unsigned int, unsigned int, unsigned int, unsigned int)|hg:hg.mozilla.org/mozilla-central:dom/gamepad/GamepadManager.cpp:db74cdf9afe797ced554aaf7e79b9bdc3e86f719|230|0x41
0|4|libxul.so|mozilla::dom::GamepadManager::Update(mozilla::dom::GamepadChangeEvent const&)|hg:hg.mozilla.org/mozilla-central:dom/gamepad/GamepadManager.cpp:db74cdf9afe797ced554aaf7e79b9bdc3e86f719|465|0x25
0|5|libxul.so|mozilla::dom::(anonymous namespace)::GamepadUpdateRunnable::Run()|hg:hg.mozilla.org/mozilla-central:dom/gamepad/ipc/GamepadEventChannelChild.cpp:db74cdf9afe797ced554aaf7e79b9bdc3e86f719|21|0x17
0|6|libxul.so|nsThread::ProcessNextEvent(bool, bool*)|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThread.cpp:db74cdf9afe797ced554aaf7e79b9bdc3e86f719|1234|0xe
0|7|libxul.so|NS_ProcessNextEvent(nsIThread*, bool)|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThreadUtils.cpp:db74cdf9afe797ced554aaf7e79b9bdc3e86f719|501|0xc
0|8|libxul.so|mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*)|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessagePump.cpp:db74cdf9afe797ced554aaf7e79b9bdc3e86f719|87|0x7
0|9|libxul.so|MessageLoop::RunInternal()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:db74cdf9afe797ced554aaf7e79b9bdc3e86f719|315|0x17
0|10|libxul.so|MessageLoop::Run()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:db74cdf9afe797ced554aaf7e79b9bdc3e86f719|290|0x8
0|11|libxul.so|nsBaseAppShell::Run()|hg:hg.mozilla.org/mozilla-central:widget/nsBaseAppShell.cpp:db74cdf9afe797ced554aaf7e79b9bdc3e86f719|137|0xd
0|12|libxul.so|XRE_RunAppShell()|hg:hg.mozilla.org/mozilla-central:toolkit/xre/nsEmbedFunctions.cpp:db74cdf9afe797ced554aaf7e79b9bdc3e86f719|913|0xe
0|13|libxul.so|mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*)|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessagePump.cpp:db74cdf9afe797ced554aaf7e79b9bdc3e86f719|237|0x5
0|14|libxul.so|MessageLoop::RunInternal()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:db74cdf9afe797ced554aaf7e79b9bdc3e86f719|315|0x17
0|15|libxul.so|MessageLoop::Run()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:db74cdf9afe797ced554aaf7e79b9bdc3e86f719|290|0x8
0|16|libxul.so|XRE_InitChildProcess(int, char**, XREChildData const*)|hg:hg.mozilla.org/mozilla-central:toolkit/xre/nsEmbedFunctions.cpp:db74cdf9afe797ced554aaf7e79b9bdc3e86f719|744|0x5
0|17|firefox-bin|content_process_main(mozilla::Bootstrap*, int, char**)|hg:hg.mozilla.org/mozilla-central:ipc/contentproc/plugin-container.cpp:db74cdf9afe797ced554aaf7e79b9bdc3e86f719|56|0x11
0|18|firefox-bin|main|hg:hg.mozilla.org/mozilla-central:browser/app/nsBrowserApp.cpp:db74cdf9afe797ced554aaf7e79b9bdc3e86f719|303|0x20
0|19|libc.so.6||||0x21b97
0|20|firefox-bin|<name omitted>|hg:hg.mozilla.org/mozilla-central:mfbt/UniquePtr.h:db74cdf9afe797ced554aaf7e79b9bdc3e86f719|253|0x17

Comment 1

[Jason Kratzer [:jkratzer]]

Attachment: prefs.js

Comment 2

[Jason Kratzer [:jkratzer]]

Bugmon Analysis:
Verified bug as reproducible on mozilla-central 20200625161839-324d5257f6f7.
Failed to bisect testcase (Start build crashes!):
> Start: 70e7c3ef6cae2266147c38ad250692ffe84aec26 (20190627093448)
> End: 52994209c733bb661741233c0d7fb7f91bfa4880 (20200625032232)
> BuildFlags: BuildFlags(asan=False, tsan=False, debug=True, fuzzing=False, coverage=False, valgrind=False)

Comment 3

[Daosheng Mu[:daoshengmu]]

I can work on that in 2020 Q3.

Comment 4

[Daosheng Mu[:daoshengmu]]

It indeed will cause OOM because 103029415, 4294967293, 206161005, 4294967293, 1082616057 are not the numbers that making sense to set when creating a gamepad. We will not set this kinds of amounts to our button, axis, and so on. I would prefer to do some check in our GamepadServiceTest.

Comment 5

[Daosheng Mu[:daoshengmu]]

Attachment: Bug 1648572 - Giving constraints on GamepadTestService parameters to avoid OOM.

Comment 6

[BugBot [:suhaib / :marco/ :calixte]]

There's a r+ patch which didn't land and no activity in this bug for 2 weeks.
:cmartin, could you have a look please?
For more information, please visit auto_nag documentation.

Comment 7

[Chris Martin [:cmartin] - OOO sick]

This patch needs to be slightly revised. Will likely have time to get to it in the next couple of weeks.

Comment 8

[Intermittent Failures Robot]

10 failures in 3065 pushes (0.003 failures/push) were associated with this bug in the last 7 days.

Repository breakdown:

• autoland: 10

Platform and build breakdown:

• linux1804-64-qr: 5
  • debug: 5
• linux1804-64: 4
  • debug: 4
• macosx1015-64-qr: 1
  • debug: 1

For more details, see:
https://treeherder.mozilla.org/intermittent-failures/bugdetails?bug=1648572&startday=2021-05-31&endday=2021-06-06&tree=all

Comment 9

[Intermittent Failures Robot]

3 failures in 3502 pushes (0.001 failures/push) were associated with this bug in the last 7 days.

Repository breakdown:

• autoland: 3

Platform and build breakdown:

• linux1804-64-qr: 2
  • debug: 2
• macosx1015-64-qr: 1
  • debug: 1

For more details, see:
https://treeherder.mozilla.org/intermittent-failures/bugdetails?bug=1648572&startday=2021-06-07&endday=2021-06-13&tree=all

Comment 10

[Intermittent Failures Robot]

5 failures in 2888 pushes (0.002 failures/push) were associated with this bug in the last 7 days.

Repository breakdown:

• autoland: 2
• mozilla-central: 3

Platform and build breakdown:

• macosx1015-64-qr: 1
  • debug: 1
• linux1804-64-qr: 1
  • debug: 1
• linux1804-64: 3
  • debug: 3

For more details, see:
https://treeherder.mozilla.org/intermittent-failures/bugdetails?bug=1648572&startday=2021-06-14&endday=2021-06-20&tree=all

Comment 11

[Intermittent Failures Robot]

2 failures in 3115 pushes (0.001 failures/push) were associated with this bug in the last 7 days.

Repository breakdown:

• mozilla-beta: 1
• try: 1

Platform and build breakdown:

• linux1804-64: 2
  • debug: 2

For more details, see:
https://treeherder.mozilla.org/intermittent-failures/bugdetails?bug=1648572&startday=2021-06-21&endday=2021-06-27&tree=all

Comment 12

[Intermittent Failures Robot]

1 failures in 2224 pushes (0.0 failures/push) were associated with this bug in the last 7 days.

Repository breakdown:

• autoland: 1

Platform and build breakdown:

• macosx1015-64-qr: 1
  • debug: 1

For more details, see:
https://treeherder.mozilla.org/intermittent-failures/bugdetails?bug=1648572&startday=2021-07-12&endday=2021-07-18&tree=all

Comment 13

[Intermittent Failures Robot]

5 failures in 3266 pushes (0.002 failures/push) were associated with this bug in the last 7 days.

Repository breakdown:

• autoland: 4
• mozilla-central: 1

Platform and build breakdown:

• windows10-32-2004-qr: 1
  • debug: 1
• macosx1015-64-qr: 4
  • debug: 4

For more details, see:
https://treeherder.mozilla.org/intermittent-failures/bugdetails?bug=1648572&startday=2021-09-06&endday=2021-09-12&tree=all

Comment 14

[Intermittent Failures Robot]

1 failures in 3376 pushes (0.0 failures/push) were associated with this bug in the last 7 days.

Repository breakdown:

• autoland: 1

Platform and build breakdown:

• linux1804-64-qr: 1
  • debug: 1

For more details, see:
https://treeherder.mozilla.org/intermittent-failures/bugdetails?bug=1648572&startday=2021-09-27&endday=2021-10-03&tree=all

Comment 15

[Intermittent Failures Robot]

2 failures in 2845 pushes (0.001 failures/push) were associated with this bug in the last 7 days.

Repository breakdown:

• mozilla-central: 2

Platform and build breakdown:

• linux1804-64-qr: 1
  • debug: 1
• macosx1015-64-qr: 1
  • debug: 1

For more details, see:
https://treeherder.mozilla.org/intermittent-failures/bugdetails?bug=1648572&startday=2021-10-25&endday=2021-10-31&tree=all

Comment 16

[Intermittent Failures Robot]

1 failures in 3057 pushes (0.0 failures/push) were associated with this bug in the last 7 days.

Repository breakdown:

• autoland: 1

Platform and build breakdown:

• windows10-64-2004-qr: 1
  • debug: 1

For more details, see:
https://treeherder.mozilla.org/intermittent-failures/bugdetails?bug=1648572&startday=2022-08-01&endday=2022-08-07&tree=all

Comment 17

[Intermittent Failures Robot]

3 failures in 3339 pushes (0.001 failures/push) were associated with this bug in the last 7 days.

Repository breakdown:

• try: 2
• mozilla-central: 1

Platform and build breakdown:

• windows10-64-2004-qr: 1
  • debug: 1
• windows10-32-2004-qr: 2
  • debug: 2

For more details, see:
https://treeherder.mozilla.org/intermittent-failures/bugdetails?bug=1648572&startday=2022-08-08&endday=2022-08-14&tree=all

Comment 18

[Intermittent Failures Robot]

1 failures in 3537 pushes (0.0 failures/push) were associated with this bug in the last 7 days.

Repository breakdown:

• autoland: 1

Platform and build breakdown:

• windows10-64-2004-qr: 1
  • debug: 1

For more details, see:
https://treeherder.mozilla.org/intermittent-failures/bugdetails?bug=1648572&startday=2022-08-29&endday=2022-09-04&tree=all

Comment 19

[Intermittent Failures Robot]

1 failures in 3616 pushes (0.0 failures/push) were associated with this bug in the last 7 days.

Repository breakdown:

• autoland: 1

Platform and build breakdown:

• windows10-64-2004-qr: 1
  • debug: 1

For more details, see:
https://treeherder.mozilla.org/intermittent-failures/bugdetails?bug=1648572&startday=2022-09-05&endday=2022-09-11&tree=all

Comment 20

[Bugmon [:jkratzer for issues]]

Testcase crashes using the initial build (mozilla-central 20211225092802-95ced5795758) but not with tip (mozilla-central 20221223212957-abd20d4e1d24.)

The bug appears to have been fixed in the following build range:

Start: 516d1e04fe91d8c56d50fb41ffb92f27e4965f9a (20221213184420)
End: 5d94fded02d5748f214bc2f2494f6dc39d17af4e (20221213184459)
Pushlog: https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=516d1e04fe91d8c56d50fb41ffb92f27e4965f9a&tochange=5d94fded02d5748f214bc2f2494f6dc39d17af4e

cmartin, can you confirm that the above bisection range is responsible for fixing this issue?
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.

Comment 21

[Chris Martin [:cmartin] - OOO sick]

Confirmed -- The issue was very likely fixed by that changeset

Comment 22

[Andrew McCreight [:mccr8]]

My patch isn't really a fix, I just broke fuzzing involving the fake gamepad test service. Is it still important that it be tested? I can put together a patch that will disable this bypass in fuzzing builds. If it isn't important, maybe it would be good to talk to the fuzzing people about not bothering to flip dom.gamepad.test.enable to true.

Comment 23

[Chris Martin [:cmartin] - OOO sick]

Hmm -- Perhaps it would be best to continue fuzzing it then... This may subtly remind me that someday I should probably used a ranged type for those arrays. Upon reflection, I guess even for these testing APIs it's probably still wise to not have memory safety issues.

Comment 24

[Andrew McCreight [:mccr8]]

I put a patch in bug 1809697 to make fuzz testing of the gamepad test service work again, thereby breaking this test case again. I'll reopen this bug when it lands.

Comment 25

[Intermittent Failures Robot]

1 failures in 3606 pushes (0.0 failures/push) were associated with this bug in the last 7 days.

Repository breakdown:

• mozilla-esr102: 1

Platform and build breakdown:

• windows10-32-2004-qr: 1
  • debug: 1

For more details, see:
https://treeherder.mozilla.org/intermittent-failures/bugdetails?bug=1648572&startday=2023-01-30&endday=2023-02-05&tree=all

Comment 26

[Intermittent Failures Robot]

1 failures in 3966 pushes (0.0 failures/push) were associated with this bug in the last 7 days.

Repository breakdown:

• mozilla-esr102: 1

Platform and build breakdown:

• windows10-64-2004-qr: 1
  • debug: 1

For more details, see:
https://treeherder.mozilla.org/intermittent-failures/bugdetails?bug=1648572&startday=2023-03-06&endday=2023-03-12&tree=all

Comment 27

[Intermittent Failures Robot]

1 failures in 4161 pushes (0.0 failures/push) were associated with this bug in the last 7 days.

Repository breakdown:

• mozilla-esr102: 1

Platform and build breakdown:

• windows10-64-2004-qr: 1
  • debug: 1

For more details, see:
https://treeherder.mozilla.org/intermittent-failures/bugdetails?bug=1648572&startday=2023-03-20&endday=2023-03-26&tree=all

Comment 28

[Intermittent Failures Robot]

1 failures in 3578 pushes (0.0 failures/push) were associated with this bug in the last 7 days.

Repository breakdown:

• mozilla-esr102: 1

Platform and build breakdown:

• windows10-32-2004-qr: 1
  • debug: 1

For more details, see:
https://treeherder.mozilla.org/intermittent-failures/bugdetails?bug=1648572&startday=2023-05-15&endday=2023-05-21&tree=all

Comment 29

[Intermittent Failures Robot]

1 failures in 3471 pushes (0.0 failures/push) were associated with this bug in the last 7 days.

Repository breakdown:

• mozilla-esr102: 1

Platform and build breakdown:

• windows10-32-2004-qr: 1
  • debug: 1

For more details, see:
https://treeherder.mozilla.org/intermittent-failures/bugdetails?bug=1648572&startday=2023-05-29&endday=2023-06-04&tree=all

Comment 30

[Chris Martin [:cmartin] - OOO sick]

Attachment: Bug 1648572 - Restrain test gamepad dimensions to avoid OOM errors

Comment 31

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/812c0a897eae
Restrain test gamepad dimensions to avoid OOM errors r=handyman

Comment 32

[Iulian Moraru]

https://hg.mozilla.org/mozilla-central/rev/812c0a897eae