Closed Bug 633473 Opened 14 years ago Closed 14 years ago

Crash [@ mozalloc_abort(char const* const) | mozalloc_handle_oom() | nsTArray_base<nsTArrayDefaultAllocator>::EnsureCapacity(unsigned int, unsigned int) | nsTArray<mozilla::FrameLayerBuilder::DisplayItemData, nsTArrayDefaultAllocator>::AppendElements<...]

Categories

(Core :: Layout, defect)

Product:
Core
Component:
Layout
Platform:
x86
Windows XP
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
RESOLVED DUPLICATE of bug 637279

People

(Reporter: scoobidiver, Unassigned)

References

Details

(Keywords: crash, regression, topcrash)

Crash Data

It is one of the breakdown of bug 627727. It is #17 top crasher inn today's build. Signature mozalloc_abort(char const* const) | mozalloc_handle_oom() | nsTArray_base<nsTArrayDefaultAllocator>::EnsureCapacity(unsigned int, unsigned int) | nsTArray<mozilla::FrameLayerBuilder::ClippedDisplayItem, nsTArrayDefaultAllocator>::AppendElements<mozilla... UUID 6019629f-7346-4949-875d-e3ed02110210 Time 2011-02-10 15:17:08.148467 Uptime 624 Last Crash 1552 seconds (25.9 minutes) before submission Install Age 26281 seconds (7.3 hours) since version was first installed. Product Firefox Version 4.0b12pre Build ID 20110210030400 Branch 2.0 OS Windows NT OS Version 5.1.2600 Service Pack 2 CPU x86 CPU Info AuthenticAMD family 15 model 104 stepping 2 Crash Reason EXCEPTION_BREAKPOINT Crash Address 0x691a39 App Notes AdapterVendorID: 10de, AdapterDeviceID: 0533, AdapterDriverVersion: 6.14.11.126 Frame Module Signature [Expand] Source 0 mozalloc.dll mozalloc_abort memory/mozalloc/mozalloc_abort.cpp:77 1 mozalloc.dll mozalloc_handle_oom memory/mozalloc/mozalloc_oom.cpp:54 2 xul.dll nsTArray_base<nsTArrayDefaultAllocator>::EnsureCapacity obj-firefox/dist/include/nsTArray-inl.h:106 3 xul.dll nsTArray<mozilla::FrameLayerBuilder::ClippedDisplayItem,nsTArrayDefaultAllocator>::AppendElements<mozilla::FrameLayerBuilder::ClippedDisplayItem> obj-firefox/dist/include/nsTArray.h:770 4 xul.dll mozilla::`anonymous namespace'::ContainerState::ProcessDisplayItems layout/base/FrameLayerBuilder.cpp:1313 5 xul.dll mozilla::`anonymous namespace'::ContainerState::ProcessDisplayItems layout/base/FrameLayerBuilder.cpp:1212 6 xul.dll mozilla::FrameLayerBuilder::BuildContainerLayerFor layout/base/FrameLayerBuilder.cpp:1568 7 xul.dll nsDisplayList::PaintForFrame layout/base/nsDisplayList.cpp:515 8 xul.dll nsLayoutUtils::PaintFrame layout/base/nsLayoutUtils.cpp:1557 9 xul.dll PresShell::Paint layout/base/nsPresShell.cpp:6174 10 xul.dll nsViewManager::RenderViews view/src/nsViewManager.cpp:458 11 xul.dll nsViewManager::Refresh view/src/nsViewManager.cpp:424 12 xul.dll nsViewManager::DispatchEvent view/src/nsViewManager.cpp:925 13 xul.dll AttachedHandleEvent view/src/nsView.cpp:193 14 xul.dll nsWindow::DispatchEvent widget/src/windows/nsWindow.cpp:3743 15 xul.dll nsWindow::DispatchWindowEvent widget/src/windows/nsWindow.cpp:3771 16 xul.dll nsWindow::OnPaint widget/src/windows/nsWindowGfx.cpp:483 17 xul.dll nsWindow::ProcessMessage widget/src/windows/nsWindow.cpp:5006 18 xul.dll nsWindow::WindowProcInternal widget/src/windows/nsWindow.cpp:4595 19 xul.dll nsWindow::WindowProc widget/src/windows/nsWindow.cpp:4535 20 user32.dll InternalCallWinProc 21 user32.dll UserCallWinProcCheckWow 22 user32.dll DispatchClientMessage 23 user32.dll __fnDWORD 24 ntdll.dll KiUserCallbackDispatcher 25 xul.dll nsThreadPool::GetIdleThreadTimeout xpcom/threads/nsThreadPool.cpp:342 26 user32.dll TestWindowProcess 27 user32.dll DispatchMessageW 28 xul.dll nsBaseAppShell::OnProcessNextEvent widget/src/xpwidgets/nsBaseAppShell.cpp:315 29 mozcrt19.dll free obj-firefox/memory/jemalloc/crtsrc/jemalloc.c:6130 30 nspr4.dll PR_AssertCurrentThreadOwnsLock nsprpub/pr/src/threads/combined/prulock.c:404 More reports at: https://crash-stats.mozilla.com/report/list?product=Firefox&range_value=4&range_unit=weeks&signature=mozalloc_abort%28char%20const*%20const%29%20|%20mozalloc_handle_oom%28%29%20|%20nsTArray_base%3CnsTArrayDefaultAllocator%3E%3A%3AEnsureCapacity%28unsigned%20int%2C%20unsigned%20int%29%20|%20nsTArray%3Cmozilla%3A%3AFrameLayerBuilder%3A%3AClippedDisplayItem%2C%20nsTArrayDefaultAllocator%3E%3A%3AAppendElements%3Cmozilla...
Note: topcrash numbers for these are only really going to be useful in beta builds, not nightlies. http://mxr.mozilla.org/mozilla-central/source/layout/base/FrameLayerBuilder.h#442 is the TArray which is aborting due to OOM. roc/tn, is this an array which can reasonably grow huge under control of content? We could use the fallible allocator for this array and null-check its uses.
It starts showing up as #16 top crasher in 4.0 RC1. More reports at: https://crash-stats.mozilla.com/report/list?range_value=4&range_unit=weeks&signature=mozalloc_abort%28char%20const*%20const%29%20|%20mozalloc_handle_oom%28%29%20|%20nsTArray_base%3CnsTArrayDefaultAllocator%3E%3A%3AEnsureCapacity%28unsigned%20int%2C%20unsigned%20int%29%20|%20nsTArray%3Cmozilla%3A%3AFrameLayerBuilder%3A%3ADisplayItemData%2C%20nsTArrayDefaultAllocator%3E%3A%3AAppendElements%3Cmozilla%3A%3AF...
Summary: Crash [@ mozalloc_abort(char const* const) | mozalloc_handle_oom() | nsTArray_base<nsTArrayDefaultAllocator>::EnsureCapacity(unsigned int, unsigned int) | nsTArray<mozilla::FrameLayerBuilder::ClippedDisplayItem nsTArrayDefaultAllocator>::AppendElements ] → Crash [@ mozalloc_abort(char const* const) | mozalloc_handle_oom() | nsTArray_base<nsTArrayDefaultAllocator>::EnsureCapacity(unsigned int, unsigned int) | nsTArray<mozilla::FrameLayerBuilder::DisplayItemData nsTArrayDefaultAllocator>::AppendElements<...]
Keywords: topcrash
(In reply to comment #1) > http://mxr.mozilla.org/mozilla-central/source/layout/base/FrameLayerBuilder.h#442 > is the TArray which is aborting due to OOM. roc/tn, is this an array which can > reasonably grow huge under control of content? We could use the fallible > allocator for this array and null-check its uses. Just saw this now. It can grow huge under control of content, not with any sort of reasonable content though.
moved to #12 on the 3 day average, and #9 on yesterday's one day ranking. there could be a few users with a repeatable crash out there, but also might be a lot of unreasonable content out there and/or some non-english lang. sites tickling a bug. maybe some of the test urls below are the results of some sites delivering a long list of search results? Correlation to startup or time of session 241 total crashes for mozalloc_abort.char.const..const....mozalloc_handle_oom.....nsTArray_base.nsTArrayDefaultAllocator.::EnsureCapacity.unsigned.int,.unsigned.int....nsTArray.mozilla::FrameLayerBuilder::DisplayItemData,.nsTArrayDefaultAllocator.::AppendElements on 20110311-crashdata.csv 12 startup crashes inside 30 sec. 99 startup crashes inside 3 min. 75 repeated crashes inside 3 min. of last crash domains of sites 125 http://www.hasznaltauto.hu 22 http://www.menetrendek.hu 15 \N// 11 http://menetrendek.hu 7 http://www.szoftverbazis.hu 5 https://www8.receita.fazenda.gov.br 3 http://www.facebook.com 3 http://kirovnet.ru 3 http://ingatlan.com 3 http://imgs.adverticum.net 3 http://bbs.fudan.edu.cn 2 jar:file:// 2 http://www8.receita.fazenda.gov.br 2 http://fanfic.hu 2 http://base.consultant.ru urls for testing 22 http://www.menetrendek.hu/cgi-bin/menetrend/html.cgi 11 http://menetrendek.hu/cgi-bin/menetrend/html.cgi 5 http://www.hasznaltauto.hu/ 4 https://www8.receita.fazenda.gov.br/SimplesNacional/Aplicacoes/ATBHE/ConsultaOptantes.app/ConsultarOpcao.aspx 2 http://www8.receita.fazenda.gov.br/SimplesNacional/Aplicacoes/ATBHE/ConsultaOptantes.app/ConsultarOpcao.aspx 1 https://www8.receita.fazenda.gov.br/SimplesNacional/controleacesso/arearestrita.aspx 4 http://www.hasznaltauto.hu/kereso/motor and search results genterated from the home page query? 20 http://www.hasznaltauto.hu/talalatilista/auto/ +XXX various session/search codes 2 http://www.hasznaltauto.hu/kereso 1 http://www.hasznaltauto.hu/talalatilista/auto/order6/ +Session id 1 http://www.hasznaltauto.hu/talalatilista/auto/order5/ +Session id 1 http://www259.megaupload.com/files/c38f6322cbaa5d994c670193b2cd2361/NP_16_0000_Krsj.rar 1 http://www.yv.hu/play_a_video.html?autostartvideoplaying=true&uploadedfileidhash=9a482a1740d24e20294ad66ceff6c1a9 1 http://www.szoftverbazis.hu/search?search=winamp&where=name&_charset_=UTF-8 1 http://www.szoftverbazis.hu/search?search=messenger&where=name&_charset_=UTF-8 1 http://www.szoftverbazis.hu/search?search=f%C3%A1jllet%C3%B6lt%C5%91k&where=name&_charset_=UTF-8 1 http://www.szoftverbazis.hu/search?search=avast&where=name&_charset_=UTF-8 1 http://www.szoftverbazis.hu/search?search=audio&where=name&_charset_=UTF-8 1 http://www.szoftverbazis.hu/search?search=adobe&where=name&_charset_=UTF-8 1 http://www.szoftverbazis.hu/search?search=&where=name 1 http://www.szalonauto.hu/talalatilista/auto/ XXXX session code /page1 1 http://www.port.hu/pls/pe/person.person?i_pers_id=20070&i_topic_id=2&i_city_id=3372&i_county_id=-1 1 http://www.orkut.com.br/Main#Application?appId= app id and args 1 http://www.izone.ru/internet/server/freeproxy.htm
can't get enough of the signature in the bugzilla title so this shows up correlated to the signature on the top crash list.
alexa says hasznaltauto.hu has Traffic Rank in HU of #19 the other hu sites ranking is much lower. fazenda.gov.br rank is #53 in brazil maybe András Tímár can help us figure why this might be affecting HU sites and hasznaltauto.hu a higher percent of the time.
If we had STR this would be easy to diagnose. It looks like just a regular OOM; the size of that array should be proportional to the size of the visible content.
Blocks: 637279
Hi, Some additional info @ https://bugzilla.mozilla.org/show_bug.cgi?id=637279
It is #10 top crasher in 4.0 over the last 3 days.
I posted more info in 637279 KAMI
Status: NEW → RESOLVED
Closed: 14 years ago
Resolution: --- → DUPLICATE
It has dropped 8 places for the last 3 days and is now #28 top crasher in 4.0.
No longer blocks: 637279
Crash Signature: [@ mozalloc_abort(char const* const) | mozalloc_handle_oom() | nsTArray_base<nsTArrayDefaultAllocator>::EnsureCapacity(unsigned int, unsigned int) | nsTArray<mozilla::FrameLayerBuilder::DisplayItemData, nsTArrayDefaultAllocator>::AppendElements<...]
You need to log in before you can comment on or make changes to this bug.