1884481 - Crash in [@ OOM | large | nsTArray_Impl<T>::AppendElementInternal | nsTArray<T>::AppendElement | nsLineBreaker::AppendText ]

Status: NEW

(Thunderbird :: General, defect)

Description

[Wayne Mery (:wsmwk)]

Another casualty of beta 122, starting with 122.0b1. #2 crash for 124.0b3

Crash report: https://crash-stats.mozilla.org/report/index/a0814ee2-3565-433e-aa02-468a30231228

MOZ_CRASH Reason: out of memory: 0x0000000000100000 bytes requested

Top 10 frames of crashing thread:

0  mozglue.dll  MOZ_Crash  mfbt/Assertions.h:281
0  mozglue.dll  mozalloc_abort  memory/mozalloc/mozalloc_abort.cpp:26
1  mozglue.dll  mozalloc_handle_oom  memory/mozalloc/mozalloc_oom.cpp:51
2  mozglue.dll  moz_xrealloc  memory/mozalloc/mozalloc.cpp:74
3  xul.dll  nsTArrayInfallibleAllocator::Realloc  xpcom/ds/nsTArray.h:258
3  xul.dll  nsTArray_base<nsTArrayInfallibleAllocator, nsTArray_RelocateUsingMemutils>::EnsureCapacityImpl<nsTArrayInfallibleAllocator>  xpcom/ds/nsTArray-inl.h:221
4  xul.dll  nsTArray_base<nsTArrayInfallibleAllocator, nsTArray_RelocateUsingMemutils>::EnsureCapacity  xpcom/ds/nsTArray.h:442
4  xul.dll  nsTArray_Impl<char16_t, nsTArrayInfallibleAllocator>::AppendElementInternal  xpcom/ds/nsTArray.h:2699
4  xul.dll  nsTArray<char16_t>::AppendElement  xpcom/ds/nsTArray.h:2842
4  xul.dll  nsLineBreaker::AppendText  dom/base/nsLineBreaker.cpp:446

Comment 1

[Wayne Mery (:wsmwk)]

140* still crashes via nsLineBreaker::AppendText, but somewhat rare.
https://crash-stats.mozilla.org/search/?proto_signature=~nsLineBreaker%3A%3AAppendText&version=140.2.0esr&version=140.1.0esr&version=140.1.1esr&product=Thunderbird&date=%3E%3D2025-03-11T18%3A47%3A00.000Z&date=%3C2025-09-11T18%3A47%3A00.000Z&_facets=signature&_facets=version&_sort=-date&_columns=date&_columns=signature&_columns=product&_columns=version&_columns=build_id&_columns=platform#facet-signature

There are a few additional signatures, all very rare:

• Bug 1796382 - Crash in [@ stackoverflow | nsTextFrame::ReflowText ] and [@ stackoverflow | nsLineBreaker::AppendText ] (i.e. a stack overflow where text/inline layout happens to be the thing to push us over the stack limit)
• nsLineBreaker::AppendText
• stackoverflow | AutoTArray<T>::Init