939440 - Out of memory silently causes empty blobs

Status: RESOLVED FIXED

(Core :: DOM: Core & HTML, defect)

Description

[Nicolas George]

Using the following minimal HTML file:

<script>
var test_array;
var test_blob;
function create_array() {
  test_array = new Uint8Array(512 * 1024 * 1024);
  for (var i = 0; i < test_array.length; i++)
    test_array[i] = i;
  alert("array created, length = " + test_array.length);
}
function create_blob() {
  test_blob = Blob([ test_array ], { type: "application/octet-stream" });
  alert("blob created, size = " + test_blob.size);
}
</script>
<p onclick="create_array()">create array</p>
<p onclick="create_blob()">create blob</p>

Using a blank browser, observe, with ps, VSZ before and after creating the blob. Then restart the browser limiting the VSZ to some intermediate value ("ulimit -v 1000000") and try again.

The size of the blob will be reported as 0 instead of 512 M. Creating an URL and using it to save the blob saves an empty file.

Some kind of error should be reported.

The problem was initially detected when using a blob to allot to save a 500 M file synthesized (from downloaded data and cryptography) in a 32-bits browser with already quite a few tabs.

In Chromium (30.0.1599.101-3 from Debian), the tab running the script shows the "this is embarrassing" crash message when creating the blob.

Comment 1

[Boris Zbarsky [:bzbarsky]]

The issue is that in nsDOMMultipartFile::ParseBlobArrayArgument we just ignore the return value of blobSet.AppendVoidPtr.  We probably shouldn't.  Similar for the AppendArrayBuffer call?

Comment 2

[Kyle Huey (Exited; not receiving bugmail, old account, do not use)]

Yeah.

Comment 3

[Andrea Marchesini [:baku]]

Attachment: blob.patch

Comment 4

[Boris Zbarsky [:bzbarsky]]

Comment on attachment 8342530 [details] [diff] [review]
blob.patch

Can we add a test too?

And you can probably just declare rv where it's used instead of all the way at the top there.

r=me

Comment 5

[Andrea Marchesini [:baku]]

Attachment: blob.patch

https://hg.mozilla.org/integration/mozilla-inbound/rev/d9133077f7cf

about the mochitest, do we have OOM tests? If yes, I'm happy to implement it in a follow-up. I don't find any example about how to simulate low memory environment.

Comment 6

[Boris Zbarsky [:bzbarsky]]

It ought to be possible to do this on 32-bit in general: just need big enough blobs to not fit in the address space and making sure that the exception is thrown on the right line.

Comment 7

[Andrea Marchesini [:baku]]

I wrote a test but it's not reliable 100% of the cases because OOM is not always received by the Blob constructor. If some other component receives this OOM, ff crashes.

Comment 8

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/d9133077f7cf