721006 - Crash when setting a very large document.title (java.lang.OutOfMemoryError @ android.text.StaticLayout.generate(StaticLayout.java:138))

Status: RESOLVED FIXED

(Firefox for Android Graveyard :: General, defect, P1)

Description

[Martijn Wargers (dead)]

Attachment: testcase

See testcase, which is crashing current Native Fennec trunk build within 10 seconds or so.

The testcase is doubling the string of document.title every 0.1 seconds, so very soon it's a very large string in there.

Comment 1

[Martijn Wargers (dead)]

Attachment: catlog from logcat of the crash

I guess this is the relevant part of the log:
01-25 15:12:12.174: I/dalvikvm(3891):   at android.widget.TextView.setText(TextView.java:2579)
01-25 15:12:12.174: I/dalvikvm(3891):   at android.widget.TextView.setText(TextView.java:2554)
01-25 15:12:12.174: I/dalvikvm(3891):   at org.mozilla.gecko.BrowserToolbar.setTitle(BrowserToolbar.java:276)
01-25 15:12:12.174: I/dalvikvm(3891):   at org.mozilla.gecko.GeckoApp$26.run(GeckoApp.java:1267)
01-25 15:12:12.174: I/dalvikvm(3891):   at android.os.Handler.handleCallback(Handler.java:587)
01-25 15:12:12.174: I/dalvikvm(3891):   at android.os.Handler.dispatchMessage(Handler.java:92)
01-25 15:12:12.174: I/dalvikvm(3891):   at android.os.Looper.loop(Looper.java:123)
01-25 15:12:12.174: I/dalvikvm(3891):   at org.mozilla.gecko.GeckoApp$31.run(GeckoApp.java:1560)
01-25 15:12:12.174: I/dalvikvm(3891):   at android.os.Handler.handleCallback(Handler.java:587)
01-25 15:12:12.174: I/dalvikvm(3891):   at android.os.Handler.dispatchMessage(Handler.java:92)
01-25 15:12:12.174: I/dalvikvm(3891):   at android.os.Looper.loop(Looper.java:123)
01-25 15:12:12.174: I/dalvikvm(3891):   at android.app.ActivityThread.main(ActivityThread.java:4627)
01-25 15:12:12.174: I/dalvikvm(3891):   at java.lang.reflect.Method.invokeNative(Native Method)
01-25 15:12:12.174: I/dalvikvm(3891):   at java.lang.reflect.Method.invoke(Method.java:521)
01-25 15:12:12.174: I/dalvikvm(3891):   at com.android.internal.os.ZygoteInit$MethodAndArgsCaller.run(ZygoteInit.java:876)
01-25 15:12:12.174: I/dalvikvm(3891):   at com.android.internal.os.ZygoteInit.main(ZygoteInit.java:634)
01-25 15:12:12.174: I/dalvikvm(3891):   at dalvik.system.NativeStart.main(Native Method)
01-25 15:12:12.174: D/AndroidRuntime(3891): Shutting down VM
01-25 15:12:12.174: W/dalvikvm(3891): threadid=1: thread exiting with uncaught exception (group=0x40020c20)
01-25 15:12:12.189: E/AndroidRuntime(3891): FATAL EXCEPTION: main
01-25 15:12:12.189: E/AndroidRuntime(3891): java.lang.OutOfMemoryError

Comment 2

[Mark Finkle (:mfinkle) (use needinfo?)]

This testcase seems to mostly hang desktop firefox. No doubt from the 0.1s updates.

Let's cap the length of the string in JS before sending the JSON message to Java. Capping to 255 chars seems ok to me.

Comment 3

[Doug Turner (:dougt)]

Attachment: patch v.1

Comment 4

[Naoki Hirata :nhirata (please use needinfo instead of cc)]

still occurs.  path in ... reviewed... just need push.  cc'ing elancaster.

Comment 5

[Mark Finkle (:mfinkle) (use needinfo?)]

https://hg.mozilla.org/integration/mozilla-inbound/rev/18d81a8130ba

Comment 6

[Ed Morley [:emorley]]

https://hg.mozilla.org/mozilla-central/rev/18d81a8130ba

Comment 7

[Brad Lassey [:blassey] (use needinfo?)]

dougt, request approval

Comment 8

[Doug Turner (:dougt)]

https://hg.mozilla.org/releases/mozilla-aurora/rev/ad17a574d68a
https://hg.mozilla.org/releases/mozilla-beta/rev/88dfe78a0892

Comment 9

[Andreea Pod]

Few seconds after accessing the testcase page, browser stops, but there is no error message in the log. Is this ok? Can I mark this bug as verified?

Builds:
Firefox 11 (tinderbox build): 	1328588649/	06-Feb-2012 21:51 		
Firefox 12: Firefox 12.0a2 (2012-02-06)
Firefox 13: Firefox 13.0a1 (2012-02-06)

Device: LG Optimus 2X (Android 2.2.2)

Comment 10

[Cristian Nicolae (:xti)]

This issue is reproducible on the latest Nightly, Aurora and Beta builds.

The Fennec process dies due to:
I/ActivityManager( 1354): Low Memory: No more background processes.

Also other opened processes are killed as well. Please see the log: http://pastebin.mozilla.org/1478222

Reopening bug.

--
Firefox 13.0a1 (2012-02-07)
20120207031136
http://hg.mozilla.org/mozilla-central/rev/b077059c575a
Device: HTC Desire Z
OS: Android 2.3.3

Comment 11

[Naoki Hirata :nhirata (please use needinfo instead of cc)]

Java crash; nom-ing for blocking fennec

Comment 12

[Doug Turner (:dougt)]

This test case hangs firefox desktop.  Please file a bug against core and mark this dup of that.

Comment 13

[Justin Wood (:Callek)]

Comment on attachment 592002 [details] [diff] [review]
patch v.1

clearing beta approval per akeybl on IRC, No Fennec Native Shipping for Gecko 11

Comment 14

[Chris Peterson [:cpeterson]]

> This test case hangs firefox desktop.  Please file a bug against core and mark this dup of that.

I filed desktop bug 736194, but I did not dup this bug because Callek has posted an r+'d patch for Fennec.

Comment 15

[Chris Peterson [:cpeterson]]

Correction: the patch was posted by mfinkle, not Callek.

I am closing this as FIXED because mfinkle's fix is in Nightly, Aurora, and Beta channels. I also confirmed that Nightly does not crash.

Comment 16

[Martijn Wargers (dead)]

I'm still seeing a (oom?) crash with the testcase, so I filed bug 736204 for it.