970981 - crash in mozalloc_abort(char const*) | mozalloc_handle_oom(unsigned int) | moz_xmalloc | nsTArray_base<nsTArrayInfallibleAllocator, nsTArray_CopyWithMemutils>::EnsureCapacity(unsigned int, unsigned int) | mozilla::safebrowsing::HashStore::ReadAddPrefixes(

Status: RESOLVED DUPLICATE of bug 943021

(Toolkit :: Safe Browsing, defect)

Description

[Flaviu Cos]

This bug was filed from the Socorro interface and is 
report bp-7eb118f7-d357-40a9-a0cb-396392140211.
=============================================================
Environment: 
Device: Google Nexus 5 (Android 4.4.2);
Build:  Firefox 27.

Steps to reproduce:
1. Load intel.com/museumofme;
2. Tap to activate and play the flash.
3. Let the video play for a while.

Stack trace:
0	libmozalloc.so	mozalloc_abort(char const*)	memory/mozalloc/mozalloc_abort.cpp
1	libmozalloc.so	mozalloc_handle_oom(unsigned int)	memory/mozalloc/mozalloc_oom.cpp
2	libmozalloc.so	moz_xmalloc	memory/mozalloc/mozalloc.cpp
3	libxul.so	nsTArray_base<nsTArrayInfallibleAllocator, nsTArray_CopyWithMemutils>::EnsureCapacity(unsigned int, unsigned int)	obj-firefox/dist/include/nsTArray.h
4	libxul.so	mozilla::safebrowsing::HashStore::ReadAddPrefixes()	obj-firefox/dist/include/nsTArray.h
5	libxul.so	mozilla::safebrowsing::HashStore::ReadHashes()	toolkit/components/url-classifier/HashStore.cpp
6	libxul.so	mozilla::safebrowsing::HashStore::BeginUpdate()	toolkit/components/url-classifier/HashStore.cpp
7	libxul.so	mozilla::safebrowsing::Classifier::ApplyTableUpdates(nsTArray<mozilla::safebrowsing::TableUpdate*>*, nsACString_internal const&)	toolkit/components/url-classifier/Classifier.cpp
8	libxul.so	mozilla::safebrowsing::Classifier::ApplyUpdates(nsTArray<mozilla::safebrowsing::TableUpdate*>*)	toolkit/components/url-classifier/Classifier.cpp
9	libxul.so	nsUrlClassifierDBServiceWorker::FinishUpdate()	toolkit/components/url-classifier/nsUrlClassifierDBService.cpp
10	libxul.so	nsRunnableMethodImpl<tag_nsresult (mozilla::dom::NotificationPermissionRequest::*)(), void, true>::Run()	obj-firefox/dist/include/nsThreadUtils.h
11	libxul.so	nsThread::ProcessNextEvent(bool, bool*)	xpcom/threads/nsThread.cpp
12	libxul.so	NS_ProcessNextEvent(nsIThread*, bool)	xpcom/glue/nsThreadUtils.cpp
13	libxul.so	nsThread::ThreadFunc(void*)	xpcom/threads/nsThread.cpp
14	libnss3.so	_pt_root	nsprpub/pr/src/pthreads/ptthread.c
15	libc.so	libc.so@0xd172	
16	libc.so	libc.so@0xd30a

Comment 1

[Kevin Brosnan [Ex-Mozilla]]

While the stack says phishing protection is involved. I doubt that is the area that needs to be fixed. Good chance this is memory corruption.

Comment 2

[Robert Kaiser]

(In reply to Kevin Brosnan [:kbrosnan] from comment #1)
> While the stack says phishing protection is involved. I doubt that is the
> area that needs to be fixed. Good chance this is memory corruption.

Why do you doubt that, any specific reason?

For me, it looks like we are running out of memory with an infallible allocator in safebrowsing code - it may be something else that made us run out of allocatable memory to a large enough degree or it may be that safebrowsing code that is either allocating too large memory blocks or using an infallible allocator when they should be using a fallible one. I can't tell what's the case but we probably need a dev to figure that out.

Comment 4

[Gian-Carlo Pascutto [:gcp]]

Note that the STR here imply there's a memory leak when playing Flash. The fix will prevent SafeBrowsing from crashing when there is less than 1.5M RAM available, at the cost of disabling those updates.

But obviously, if we're down to <1.5M free RAM, we have other problems.