1717942 - Crash in [@ {virtual override thunk}]

Status: NEW

(Core :: DOM: Core & HTML, defect, P3)

Description

[Lyubomir [:mystiquewolf]]

Maybe Fission related. (DOMFissionEnabled=1)

Crash report: https://crash-stats.mozilla.org/report/index/c1ea42e2-37ca-4e75-8d7a-696e10210623

Reason: SIGSEGV /0x00000000

Top 10 frames of crashing thread:

0 libxul.so {virtual override thunk} 
1 libxul.so nsAutoMutationBatch::Done /build/firefox-hG74KM/firefox-89.0.1+build1/dom/base/nsDOMMutationObserver.cpp:1067
2 libxul.so nsContentUtils::SetNodeTextContent /build/firefox-hG74KM/firefox-89.0.1+build1/dom/base/nsContentUtils.cpp:5275
3 libxul.so mozilla::dom::FragmentOrElement::SetInnerHTMLInternal /build/firefox-hG74KM/firefox-89.0.1+build1/dom/base/FragmentOrElement.cpp:1917
4 libxul.so mozilla::dom::Element_Binding::set_innerHTML /build/firefox-hG74KM/firefox-89.0.1+build1/obj-x86_64-linux-gnu/dom/bindings/ElementBinding.cpp:3855
5  @0x174d3301bda1 
6 libxul.so <unknown in c000b266e8407d9987b607630bfda4238a07a9.debug> 
7 libxul.so js::ArgumentsObject* js::ArgumentsObject::create<CopyFrameArgs> /build/firefox-hG74KM/firefox-89.0.1+build1/js/src/vm/ArgumentsObject.cpp:374
8  @0x7fff8cf67c67 
9  @0x174d32f3d4c2 

Comment 1

[Lyubomir [:mystiquewolf]]

When i open https://www.transfermarkt.com/toni-kroos/profil/spieler/31909 Firefox memory starts to rapidly increase and has freezed my Computer once and almost managed to freeze it twice before i manually sent SIGSEGV to the buggy Web Content process. I can persistently reproduce this issue. This crash is produced after i manually sent SIGSEGV to the process. Maybe some info about the process at the time of the crash can help?

Comment 2

[Lyubomir [:mystiquewolf]]

Attachment: Troubleshooting info

Comment 3

[Lyubomir [:mystiquewolf]]

I managed to reproduce it in new profile.

This seems to require Fission to reproduce. Without Fission the page doesn't scroll correctly, there is high CPU usage and a notice about page slowing down browser, but no memory increase. With Fission the page scrolls and functions correctly, there is no notice about webpage slowing down browser and there is a constant memory increase of "Web Content" process.

Comment 4

[Lyubomir [:mystiquewolf]]

While in Chrome it just works™.

Comment 5

[Chris Peterson [:cpeterson]]

This [@ {virtual override thunk}] crash signature is rather generic, but the crash volume increased around April 24–25 and again around May 2–3.

All of the crash reports are from Linux, Android, and macOS. Is Windows unaffected or does it just have a different crash signature for these virtual function crashes?

Since many of the reports are from Release channel and Android users, this crash is not a Fission bug, even though comment 0's crash report includes DOMFissionEnabled=1.

Comment 6

[Lyubomir [:mystiquewolf]]

I don't know, maybe there are two bugs here - the transfermarkt memory one and the crash? Is it possible that these crashes were also from users who killed "Web content" process manually? Or their cases are not related?

Comment 7

[Lyubomir [:mystiquewolf]]

Attachment: memory-report.json.gz

One of the Web Content processes was taking 2.1 GBs of memory when i measured the RAM. I left it to increase on its own and the oom killer killed it.

Comment 8

[Olli Pettay [:smaug][[e-mail]]]

Do you think you could try to create a performance profile when the memory usage starts up go up.
I can't locally see unusually high memory usage with https://www.transfermarkt.com/toni-kroos/profil/spieler/31909 . It goes up a bit, around 270MB, then GC runs and it goes down to 150MB. Other browsers give very similar behavior.

Comment 9

[Lyubomir [:mystiquewolf]]

Well i can't seem to reproduce it now. I'm not a frequent visitor of that site so i guess there's little change to reproduce it again.

Maybe it's better to rename the bug title to "High memory usage on transfermarkt...." and possibly close it?