Open Bug 1780745 Opened 2 years ago Updated 1 year ago

Crash in [@ OOM | unknown | NS_ABORT_OOM | mozilla::jni::StringParam::GetString]

Categories

(GeckoView :: IME, defect, P3)

ARM
Android

Tracking

(firefox103 affected, firefox110 affected, firefox111 ?, firefox112 ?)

Tracking Status
firefox103 --- affected
firefox110 --- affected
firefox111 --- ?
firefox112 --- ?

People

(Reporter: kbrosnan, Unassigned)

References

Details

(Keywords: crash)

Crash Data

Crash report: https://crash-stats.mozilla.org/report/index/228cbf53-86c6-4eb9-b3e6-8cfaa0220719

Reason: SIGSEGV / SEGV_MAPERR

Top 10 frames of crashing thread:

0 libxul.so NS_ABORT_OOM xpcom/base/nsDebugImpl.cpp:674
1 libxul.so mozilla::jni::StringParam::GetString widget/android/jni/Refs.h:722
2 libxul.so mozilla::jni::StringParam::StringParam widget/android/jni/Refs.h:770
3 libxul.so mozilla::widget::GeckoTelemetryDelegate::DispatchHistogram widget/android/GeckoTelemetryDelegate.h:53
4 libxul.so GeckoViewStreamingTelemetry::SendBatchRunnable::Run toolkit/components/telemetry/geckoview/streaming/GeckoViewStreamingTelemetry.cpp:124
5 libxul.so mozilla::detail::RunnableFunction<mozilla::TaskController::InitializeInternal xpcom/threads/nsThreadUtils.h:531
6 libxul.so nsThread::ProcessNextEvent xpcom/threads/nsThread.cpp:1205
7 libxul.so mozilla::ipc::MessagePump::Run ipc/glue/MessagePump.cpp:85
8 libxul.so MessageLoop::Run ipc/chromium/src/base/message_loop.cc:355
9 libxul.so nsBaseAppShell::Run widget/nsBaseAppShell.cpp:150

Makoto fixed a similar GetString JNI OOM last year (bug 1689369). The crash volume is very low (only about 250 crashes from Fenix 102), so we can probably ignore this crash for now.

The stack trace shows that Fenix is trying to send telemetry and the telemetry histogram's nsCString aName parameter is being implicitly converted to a mozilla::jni::String::Param object here:

https://searchfox.org/mozilla-central/rev/1061fae5e225a99ef5e43dbdf560a91a0c0d00d1/widget/android/GeckoTelemetryDelegate.h#53-54

Then converted UTF-8 to UTF-16 here:

https://searchfox.org/mozilla-central/rev/1061fae5e225a99ef5e43dbdf560a91a0c0d00d1/widget/android/jni/Refs.h#770

And then OOM'ing here after the UTF-16 conversion:

https://searchfox.org/mozilla-central/rev/1061fae5e225a99ef5e43dbdf560a91a0c0d00d1/widget/android/jni/Refs.h#718-722

I doubt the telemetry histogram's name is very long, so we're probably just running out of memory overall. Using a fallible GetString would just postpone the OOM crash.

Priority: -- → P3
Crash Signature: [@ OOM | unknown | NS_ABORT_OOM | mozilla::jni::StringParam::GetString] → [@ OOM | large | NS_ABORT_OOM | mozilla::jni::StringParam::GetString] [@ OOM | unknown | NS_ABORT_OOM | mozilla::jni::StringParam::GetString]
You need to log in before you can comment on or make changes to this bug.