896165 - crash in mozilla::dom::HTMLDocumentBinding::write with abort message: "OOM: file e:\builds\...\xpcom\string\src\nsTSubstring.cpp, line 349"

Status: RESOLVED WONTFIX

(Core :: DOM: Core & HTML, defect)

Description

[Scoobidiver (away)]

It started spiking across all channels on July 18 at 19:00 UTC.

Signature 	mozalloc_abort(char const* const) | NS_DebugBreak | mozilla::dom::HTMLDocumentBinding::write More Reports Search
UUID 	e8b5269c-c030-4426-af86-b3e592130719
Date Processed	2013-07-19 22:43:55.761397
Uptime	101
Install Age 	3064 since version was first installed.
Install Time 	2013-07-19 21:57:07
Product 	Firefox
Version 	25.0a1
Build ID 	20130719030204
Release Channel 	nightly
OS 	Windows NT
OS Version 	6.1.7601 Service Pack 1
Build Architecture 	x86
Build Architecture Info 	GenuineIntel family 6 model 15 stepping 13 | 2
Crash Reason 	EXCEPTION_BREAKPOINT
Crash Address 	0x74aa11cd
App Notes 	
AdapterVendorID: 0x8086, AdapterDeviceID: 0x2a42, AdapterSubsysID: 360b103c, AdapterDriverVersion: 8.15.10.2302
D2D? D2D+ DWrite? DWrite+ D3D10 Layers? D3D10 Layers+ xpcom_runtime_abort(###!!! ABORT: OOM: file e:\builds\moz2_slave\m-cen-w32-ntly-000000000000000\build\xpcom\string\src\nsTSubstring.cpp, line 349)
Processor Notes 	sp-processor05_phx1_mozilla_com_17568:2012; non-integer value of "SecondsSinceLastCrash"
EMCheckCompatibility 	
Adapter Vendor ID 	0x8086
Adapter Device ID 	0x2a42
Total Virtual Memory 	2147352576
Available Virtual Memory 	701607936
System Memory Use Percentage 	52
Available Page File 	4229414912
Available Physical Memory 	1502511104

Frame 	Module 	Signature 	Source
0 	mozalloc.dll 	mozalloc_abort(char const * const) 	memory/mozalloc/mozalloc_abort.cpp
1 	xul.dll 	NS_DebugBreak 	xpcom/base/nsDebugImpl.cpp
2 	xul.dll 	mozilla::dom::HTMLDocumentBinding::write 	obj-firefox/dom/bindings/HTMLDocumentBinding.cpp
3 	xul.dll 	mozilla::dom::HTMLDocumentBinding::genericMethod 	obj-firefox/dom/bindings/HTMLDocumentBinding.cpp
4 	mozjs.dll 	js::Invoke(JSContext *,JS::CallArgs,js::MaybeConstruct) 	js/src/vm/Interpreter.cpp
5 	mozjs.dll 	Interpret 	js/src/vm/Interpreter.cpp
6 	mozjs.dll 	js::RunScript(JSContext *,js::RunState &) 	js/src/vm/Interpreter.cpp
7 	mozjs.dll 	js::ExecuteKernel(JSContext *,JS::Handle<JSScript *>,JSObject &,JS::Value const &,js::ExecuteType,js::AbstractFramePtr,JS::Value *) 	js/src/vm/Interpreter.cpp
8 	mozjs.dll 	js::Execute(JSContext *,JS::Handle<JSScript *>,JSObject &,JS::Value *) 	js/src/vm/Interpreter.cpp
9 	mozjs.dll 	JS::Evaluate(JSContext *,JS::Handle<JSObject *>,JS::CompileOptions,wchar_t const *,unsigned int,JS::Value *) 	js/src/jsapi.cpp
10 	xul.dll 	nsJSContext::EvaluateString(nsAString_internal const &,JS::Handle<JSObject *>,JS::CompileOptions &,bool,JS::Value *) 	dom/base/nsJSEnvironment.cpp
11 	xul.dll 	nsScriptLoader::EvaluateScript(nsScriptLoadRequest *,nsString const &) 	content/base/src/nsScriptLoader.cpp
12 	xul.dll 	nsScriptLoader::ProcessRequest(nsScriptLoadRequest *) 	content/base/src/nsScriptLoader.cpp
13 	xul.dll 	nsScriptLoader::ProcessScriptElement(nsIScriptElement *) 	content/base/src/nsScriptLoader.cpp
14 	xul.dll 	nsScriptElement::MaybeProcessScript() 	content/base/src/nsScriptElement.cpp
15 	xul.dll 	nsHtml5TreeOpExecutor::RunScript(nsIContent *) 	parser/html/nsHtml5TreeOpExecutor.cpp
16 	xul.dll 	nsHtml5TreeOpExecutor::RunFlushLoop() 	parser/html/nsHtml5TreeOpExecutor.cpp
17 	xul.dll 	nsHtml5ExecutorReflusher::Run() 	parser/html/nsHtml5TreeOpExecutor.cpp
18 	xul.dll 	nsThread::ProcessNextEvent(bool,bool *) 	xpcom/threads/nsThread.cpp
19 	xul.dll 	NS_ProcessNextEvent(nsIThread *,bool) 	obj-firefox/xpcom/build/nsThreadUtils.cpp
20 	xul.dll 	mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate *) 	ipc/glue/MessagePump.cpp
21 	xul.dll 	MessageLoop::RunHandler() 	ipc/chromium/src/base/message_loop.cc
22 	xul.dll 	MessageLoop::Run() 	ipc/chromium/src/base/message_loop.cc
23 	xul.dll 	nsBaseAppShell::Run() 	widget/xpwidgets/nsBaseAppShell.cpp
24 	xul.dll 	nsAppShell::Run() 	widget/windows/nsAppShell.cpp
25 	xul.dll 	nsAppStartup::Run() 	toolkit/components/startup/nsAppStartup.cpp
26 	xul.dll 	XREMain::XRE_mainRun() 	toolkit/xre/nsAppRunner.cpp
27 	xul.dll 	XREMain::XRE_main(int,char * * const,nsXREAppData const *) 	toolkit/xre/nsAppRunner.cpp
28 	xul.dll 	XRE_main 	toolkit/xre/nsAppRunner.cpp

More reports at:
https://crash-stats.mozilla.com/report/list?product=Firefox&signature=mozalloc_abort%28char+const*+const%29+|+NS_DebugBreak+|+mozilla%3A%3Adom%3A%3AHTMLDocumentBinding%3A%3Awrite

Comment 1

[Peter Van der Beken [:peterv]]

I don't see any allocating happening inside the binding, so I wonder if the stack is wrong from inlining. nsHTMLDocument::WriteCommon does join all the strings in the sequence, maybe we should detect the OOM there and throw instead.

Comment 3

[Andrew McCreight [:mccr8]]

There's a test case in bug 957030 if that helps.  It is fairly simple.

Comment 4

[Sylvestre Ledru [:Sylvestre]]

Closing because no crash reported since 12 weeks.