1699340 - Crash in [@ OOM | small] in ParamTraits<JSStructuredCloneData>::Write

Status: NEW

(Core :: IPC, defect, P3)

Description

[Worcester12345]

Crash report: https://crash-stats.mozilla.org/report/index/41a77bce-6b46-4317-9d80-8afae0210315

MOZ_CRASH Reason: MOZ_CRASH()

Top 10 frames of crashing thread:

0 mozglue.dll mozalloc_abort memory/mozalloc/mozalloc_abort.cpp:33
1 mozglue.dll mozalloc_handle_oom memory/mozalloc/mozalloc_oom.cpp:51
2 mozglue.dll moz_xmalloc memory/mozalloc/mozalloc.cpp:54
3 xul.dll Pickle::WriteBytes ipc/chromium/src/base/pickle.cc:634
4 xul.dll JSStructuredCloneData::ForEachDataChunk<`lambda at /builds/worker/workspace/obj-build/dist/include/mozilla/ipc/SerializedStructuredCloneBuffer.h:70:29'> const js/public/StructuredClone.h:558
5 xul.dll mozilla::ipc::WriteIPDLParam<const mozilla::SerializedStructuredCloneBuffer> ipc/glue/IPDLParamTraits.h:64
6 xul.dll static mozilla::ipc::IPDLParamTraits<mozilla::dom::indexedDB::SerializedStructuredCloneReadInfo>::Write ipc/ipdl/PBackgroundIDBSharedTypes.cpp:705
7 xul.dll mozilla::ipc::WriteIPDLParam<const mozilla::dom::indexedDB::RequestResponse&> ipc/glue/IPDLParamTraits.h:66
8 xul.dll static mozilla::dom::indexedDB::PBackgroundIDBRequestParent::Send__delete__ ipc/ipdl/PBackgroundIDBRequestParent.cpp:66
9 xul.dll mozilla::dom::indexedDB::`anonymous namespace'::NormalTransactionOp::SendSuccessResult dom/indexedDB/ActorsParent.cpp:19242

Comment 1

[Worcester12345]

Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:87.0) Gecko/20100101 Firefox/87.0 ID:20210315170302

Comment 2

[BugBot [:suhaib / :marco/ :calixte]]

The Bugbug bot thinks this bug should belong to the 'Core::IPC' component, and is moving the bug to that component. Please revert this change in case you think the bot is wrong.

Comment 3

[Simon Giesecke [:sg] [he/him]]

This is writing a potentially very large JSStructuredCloneData structure in small chunks. If the overall size of the JSStructuredCloneData is the reason for this, it's rather unfortunate that this operation is not fallible. However, the whole IPDLParamTraits::Write design is infallible right now.

Comment 6

[BugBot [:suhaib / :marco/ :calixte]]

The bug has a crash signature, thus the bug will be considered confirmed.

Comment 7

[Worcester12345]

(In reply to BugBot [:suhaib / :marco/ :calixte] from comment #6)

The bug has a crash signature, thus the bug will be considered confirmed.

Thanks.

Comment 8

[Worcester12345]

(In reply to Simon Giesecke [:sg] [he/him] from comment #3)

This is writing a potentially very large JSStructuredCloneData structure in small chunks. If the overall size of the JSStructuredCloneData is the reason for this, it's rather unfortunate that this operation is not fallible. However, the whole IPDLParamTraits::Write design is infallible right now.

Not 100% sure what this means. Is there anything I can do to help on this? Please note, I am on Ubuntu now, and a current version of Firefox.

Comment 9

[Andrew McCreight [:mccr8]]

Simon is no longer actively working on Firefox.

Comment 10

[Andrew McCreight [:mccr8]]

Are you frequently seeing this problem? It is hard to know how common this is as the signature is quite generic. I'm not sure how much we can do here to help. I guess we could make it throw an error, but something would likely silently break so I'm not sure that's an improvement.

Comment 11

[Worcester12345]

I do not recall this as a problem recently; but as I said, I am on a much newer version now, and a different machine and OS.

That said, I guess just leave this for now, as it is technically not "fixed", "worksforme", or "incomplete". It is just another bunch of broken code that is not a current priority, I guess.

Thanks anyhow.