1901391 - Crash in [@ OOM | large | NS_ABORT_OOM | nsTArray_Impl<T>::AppendElementInternal<T> | nsTArray<T>::AppendElement<T> | mozilla::a11y::NotificationController::ScheduleTextUpdate]

Status: RESOLVED WORKSFORME

(Firefox :: General, defect)

Description

[andrew]

Crash report: https://crash-stats.mozilla.org/report/index/657b6bdc-ad7a-408c-8829-a69070240608

MOZ_CRASH Reason: MOZ_CRASH(OOM)

Top 10 frames:

0  XUL  NS_ABORT_OOM(unsigned long)  xpcom/base/nsDebugImpl.cpp:673
1  XUL  nsTArrayInfallibleAllocator::SizeTooBig(unsigned long)  xpcom/ds/nsTArray.h:262
2  XUL  nsTArray_base<nsTArrayInfallibleAllocator, nsTArray_RelocateUsingMemutils>::E...  xpcom/ds/nsTArray-inl.h:165
3  XUL  nsTArray_base<nsTArrayInfallibleAllocator, nsTArray_RelocateUsingMemutils>::E...  xpcom/ds/nsTArray.h:430
3  XUL  nsTArray_Impl<nsCOMPtr<nsIContent>, nsTArrayInfallibleAllocator>::AppendEleme...  xpcom/ds/nsTArray.h:2688
4  XUL  nsTArray<nsCOMPtr<nsIContent> >::AppendElement<nsIContent*&>(nsIContent*&)  xpcom/ds/nsTArray.h:2832
4  XUL  mozilla::a11y::NotificationController::ScheduleTextUpdate(nsIContent*)  accessible/base/NotificationController.h:145
4  XUL  mozilla::a11y::DocAccessible::UpdateText(nsIContent*)  accessible/generic/DocAccessible-inl.h:79
4  XUL  nsAccessibilityService::UpdateText(mozilla::PresShell*, nsIContent*)  accessible/base/nsAccessibilityService.cpp:789
5  XUL  ReflowTextA11yNotifier::~ReflowTextA11yNotifier()  layout/generic/nsTextFrame.cpp:9295

Comment 1

[andrew]

this might be a security bug from the looks of the stack trace unsure tho feel free to remove the security label

Steps to reproduce:

open new tab
enter https://search.brave.com/
search for: cmake add
Page is partially rendered, but not interaction possible.
After all available memory is used, the tab crashes with OOM

Comment 2

[andrew]

actually, from reviewing the stack traces again, I doubt this is a harmful crash

Comment 3

[:Gijs (back August 25; he/him)]

That's a safe OOM crash.