1676681 - Crash in [@ OOM | large | PLDHashTable::Add | nsFrameList::operator new], probably inside of a call to `RecordAlloc()`

Status: RESOLVED WORKSFORME

(Core :: Layout, defect)

Description

[Simon Giesecke [:sg] [he/him]]

Crash report: https://crash-stats.mozilla.org/report/index/de71000e-9d89-422b-a4b3-b7f000201110

MOZ_CRASH Reason: MOZ_CRASH(OOM)

Top 10 frames of crashing thread:

0 XUL PLDHashTable::Add xpcom/ds/PLDHashTable.cpp:579
1 XUL nsFrameList::operator new layout/generic/nsFrameList.cpp:29
2 XUL nsContainerFrame::PushChildrenToOverflow layout/generic/nsContainerFrame.cpp:1596
3 XUL nsInlineFrame::PushFrames layout/generic/nsInlineFrame.cpp:782
4 XUL nsInlineFrame::ReflowFrames layout/generic/nsInlineFrame.cpp:543
5 XUL nsInlineFrame::Reflow layout/generic/nsInlineFrame.cpp:358
6 XUL nsLineLayout::ReflowFrame layout/generic/nsLineLayout.cpp:878
7 XUL nsInlineFrame::ReflowFrames layout/generic/nsInlineFrame.cpp:543
8 XUL nsInlineFrame::Reflow layout/generic/nsInlineFrame.cpp:358
9 XUL nsLineLayout::ReflowFrame layout/generic/nsLineLayout.cpp:878

The allocation is >1 GB, so this seems not to be a normal memory exhaustion issue.

Comment 1

[BugBot [:suhaib / :marco/ :calixte]]

The severity field is not set for this bug.
:boris, could you have a look please?

For more information, please visit auto_nag documentation.

Comment 2

[Boris Chiou [:boris]]

Mark S3 for now because it's rare.

Comment 3

[Daniel Holbert [:dholbert]]

Looks like we're safely crashing due to PLDHashTable::Add exceeding some size threshold, for a hashtable operation inside of nsFrameList's operator new.

This new implementation simply calls aPresShell->AllocateByObjectID, which is implemented like so:

  void* AllocateByObjectID(ArenaObjectID aID, size_t aSize) {
    void* result = mFrameArena.Allocate(aID, aSize);
    RecordAlloc(result);
    return result;
  } 

I think (?) RecordAlloc is the only thing that does hashtable modifications there, and it only does them in builds that have diagnostic asserts enabled (which I think is just Nightly & DevEdition). Skimming a few of the reports, it seems they all have Release Channel set to aurora, which I think means DevEdition (correct me if I'm wrong).

So this shouldn't be a problem in release builds, which is good news.

Comment 4

[Daniel Holbert [:dholbert]]

I should've quoted RecordAlloc's hashtable modification as well -- here it is:

  void RecordAlloc(void* aPtr) {
#ifdef MOZ_DIAGNOSTIC_ASSERT_ENABLED
    MOZ_DIAGNOSTIC_ASSERT(!mAllocatedPointers.Contains(aPtr));
    mAllocatedPointers.PutEntry(aPtr);
#endif
  }

https://searchfox.org/mozilla-central/rev/ffdb6a4d934b3f5294f18cf0e1df618109ccb36b/layout/base/PresShell.h#1700

That hashtable usage comes from bug 1274443, originally (searchfox reference here) so this might sort of be a downstream effect of that bug, combined with some sort of stress-testing (I'm guessing).

Comment 5

[BugBot [:suhaib / :marco/ :calixte]]

Closing because no crashes reported for 12 weeks.