1843374 - Crash in [@ OOM | large | NS_ABORT_OOM | IPC::ParamTraits<JSStructuredCloneData>::Read]

Status: NEW

(Core :: IPC, defect)

Description

[Ryan VanderMeulen [:RyanVM]]

Crash report: https://crash-stats.mozilla.org/report/index/075db37d-da45-428d-94b9-cfcda0230713

MOZ_CRASH Reason: MOZ_CRASH(OOM)

Top 10 frames of crashing thread:

0  xul.dll  NS_ABORT_OOM  xpcom/base/nsDebugImpl.cpp:674
1  xul.dll  IPC::ParamTraits<JSStructuredCloneData>::Read  ipc/glue/SerializedStructuredCloneBuffer.cpp:62
2  xul.dll  IPC::ReadParam  ipc/chromium/src/chrome/common/ipc_message_utils.h:471
2  xul.dll  IPC::ParamTraits<mozilla::SerializedStructuredCloneBuffer>::Read  ipc/glue/SerializedStructuredCloneBuffer.h:81
2  xul.dll  IPC::ReadParam  ipc/chromium/src/chrome/common/ipc_message_utils.h:481
2  xul.dll  IPC::ParamTraits<mozilla::dom::indexedDB::SerializedStructuredCloneReadInfo>::Read  ipc/ipdl/PBackgroundIDBSharedTypes.cpp:538
3  xul.dll  IPC::ReadParam  ipc/chromium/src/chrome/common/ipc_message_utils.h:478
3  xul.dll  IPC::ParamTraits<mozilla::dom::indexedDB::ObjectStoreGetResponse>::Read  ipc/ipdl/PBackgroundIDBRequest.cpp:176
3  xul.dll  IPC::ReadParam  ipc/chromium/src/chrome/common/ipc_message_utils.h:478
3  xul.dll  IPC::ParamTraits<mozilla::dom::indexedDB::RequestResponse>::Read  ipc/ipdl/PBackgroundIDBRequest.cpp:1481

Comment 1

[Nika Layzell [:nika] (ni? for response)]

This is an interesting situation, because while we're trying to allocate ~2MB of memory for the JSStructuredCloneData logic, it's being allocated in a BufferList, which actually allocates individual pages one at a time (https://searchfox.org/mozilla-central/rev/907db2c22743f1b24496198b10a3dca4085cfb08/mfbt/BufferList.h#468-473). As mStandardcapacity is actually 4096, this is actually an OOM_SMALL under the hood, as part of trying to allocate a larger 2MB allocation.

CC bug 1784307 anyway which tracks adding a mechanism for us to handle OOM errors more elegantly in IPC deserialization methods.