1794391 - Crash in [@ OOM | large | mozalloc_abort | webrender_api::display_list::DisplayListBuilder::push_item]

Status: RESOLVED DUPLICATE of bug 1738167

(Core :: Graphics: WebRender, defect)

Description

[Pascal Chevrel:pascalc]

Crash report: https://crash-stats.mozilla.org/report/index/4f704a82-ceca-4b79-b512-385570221010

MOZ_CRASH Reason: out of memory: 0x000000000008820A bytes requested

Top 10 frames of crashing thread:

0 mozglue.dll MOZ_Crash mfbt/Assertions.h:261
0 mozglue.dll mozalloc_abort memory/mozalloc/mozalloc_abort.cpp:26
1 mozglue.dll mozalloc_handle_oom memory/mozalloc/mozalloc_oom.cpp:51
2 xul.dll mozglue_static::oom_hook::hook mozglue/static/rust/lib.rs:115
3 xul.dll std::alloc::rust_oom library/std/src/alloc.rs:352
4 xul.dll alloc::alloc::__alloc_error_handler::__rg_oom library/alloc/src/alloc.rs:413
5 xul.dll __rust_alloc_error_handler 
6 xul.dll webrender_api::display_list::DisplayListBuilder::push_item gfx/wr/webrender_api/src/display_list.rs:1270
6 xul.dll webrender_api::display_list::DisplayListBuilder::push_text gfx/wr/webrender_api/src/display_list.rs:1494
7 xul.dll webrender_bindings::bindings::wr_dp_push_text gfx/webrender_bindings/src/bindings.rs:3288

Comment 1

[BugBot [:suhaib / :marco/ :calixte]]

The bug is marked as blocking firefox106 (beta). We have limited time to fix this, the soft freeze is in 3 days. However, the bug still isn't assigned.

:bhood, could you please find an assignee for this tracked bug? If you disagree with the tracking decision, please talk with the release managers.

For more information, please visit auto_nag documentation.

Comment 2

[Pascal Chevrel:pascalc]

Signature change from bug 1738167 or new issue? I am leaving it as blocker for 106 in case it is a new issue that could be fixed in a RC

Comment 3

[Pascal Chevrel:pascalc]

Nical confirmed that it is the same crash as bug 1738167

Comment 4

[Nicolas Silva [:nical]]

(In reply to Pascal Chevrel:pascalc from comment #2)

Signature change from bug 1738167 or new issue? I am leaving it as blocker for 106 in case it is a new issue that could be fixed in a RC

It's the same crash: OOM while pushing a large amount of display items. There are multiple code paths that end up pushing into that array but none is to blame more than the next, the issue appears that there is too many items. So there's probably going to be a few similar looking signatures ending with push_item or push_item_to_section which come from the same issue.

The OOM allocation size is always pretty large according to crash reports.