1905101 - Crash in [@ js::ArrayBufferObject::createUninitializedBufferAndData]

Status: RESOLVED DUPLICATE of bug 1898399

(Core :: JavaScript Engine, defect)

Description

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

Crash signature reported for Firefox 128.0 betas, 10-24 crashes from 3-9 installs. 77% with 32-bit builds, 87% crashes after more than 15 minutes of Firefox running. Wontfix?

The OOM likely causes the crash reports to have a corrupted/unsymbolified stack.

Crash report: https://crash-stats.mozilla.org/report/index/352ac42b-7f75-4095-85fe-4f5510240624

MOZ_CRASH Reason: MOZ_DIAGNOSTIC_ASSERT(false) (ArrayBuffer allocation OOM < 2GB - 1)

Top 10 frames:

0  xul.dll  js::ArrayBufferObject::createUninitializedBufferAndData(JSContext*, unsigned ...  js/src/vm/ArrayBufferObject.cpp:1891
0  xul.dll  js::ArrayBufferObject::createBufferAndData<0>(JSContext*, unsigned int, js::A...  js/src/vm/ArrayBufferObject.cpp:1931
1  xul.dll  js::ArrayBufferObject::createZeroed(JSContext*, unsigned int, JS::Handle<JSOb...  js/src/vm/ArrayBufferObject.cpp:2261
2  xul.dll  js::TypedArrayObject::ensureHasBuffer(JSContext*, JS::Handle<js::TypedArrayOb...  js/src/vm/TypedArrayObject.cpp:149
3  xul.dll  js::ArrayBufferViewObject::ensureBufferObject(JSContext*, JS::Handle<js::Arra...  js/src/vm/ArrayBufferViewObject.cpp:112
4  xul.dll  js::ArrayBufferViewObject::ensureNonInline(JSContext*, JS::Handle<js::ArrayBu...  js/src/vm/ArrayBufferViewObject.cpp:97
5  xul.dll  JS::EnsureNonInlineArrayBufferOrView(JSContext*, JSObject*)  js/src/vm/ArrayBufferViewObject.cpp:620
6  xul.dll  mozilla::dom::TypedArray_base<JS::ArrayBufferView>::ProcessFixedData<`lambda ...  dom/bindings/TypedArray.h:678
7  xul.dll  mozilla::dom::SourceBuffer::PrepareAppend(mozilla::dom::ArrayBufferView_base<...  dom/media/mediasource/SourceBuffer.cpp:732
7  xul.dll  mozilla::dom::SourceBuffer::AppendBuffer(mozilla::dom::ArrayBufferView_base<&...  dom/media/mediasource/SourceBuffer.cpp:194

Comment 1

[Iain Ireland [:iain]]

This diagnostic was added in bug 1891118, which landed in Fx 128. The crashes started in the first 128 beta. It looks like these are crashes that previously would have been attributed to bug 1856672.

Duping to bug 1898399, which was opened when we saw the same thing on Nightly.