1570206 - OOM on android

Status: NEW

(Core :: Web Painting, defect, P2)

Description

[Tyson Smith [:tsmith]]

Attachment: testcase.html

I am seeing this crash frequently while fuzzing on android.

Minimized with m-c:
BuildID=20190730215316
SourceStamp=d497a1f58d27d75da3667e74a5a7efe5799119fd

[26830, Main Thread] ###!!! ASSERTION: Children must have same reference frame: 'mListPtr->IsEmpty() || !ReferenceFrame() || !mListPtr->GetBottom()->ReferenceFrame() || mListPtr->GetBottom()->ReferenceFrame() == ReferenceFrame()', file /builds/worker/workspace/build/src/layout/painting/nsDisplayList.h, line 5521
[26830, Main Thread] ###!!! ASSERTION: Children must have same reference frame: 'mListPtr->IsEmpty() || !ReferenceFrame() || !mListPtr->GetBottom()->ReferenceFrame() || mListPtr->GetBottom()->ReferenceFrame() == ReferenceFrame()', file /builds/worker/workspace/build/src/layout/painting/nsDisplayList.h, line 5521
mozalloc_abort: out of memory: 0x000000002DDE21F8 bytes requested
>>> REPORTING UNCAUGHT EXCEPTION FROM THREAD 148 ("Gecko")
org.mozilla.gecko.mozglue.GeckoLoader$AbortException: out of memory: 0x000000002DDE21F8 bytes requested
    at org.mozilla.gecko.mozglue.GeckoLoader.abort(SourceFile:494)
    at org.mozilla.gecko.mozglue.GeckoLoader.nativeRun(Native Method)
    at org.mozilla.gecko.GeckoThread.run(SourceFile:476)
Main thread (2) stack:
    android.view.ThreadedRenderer.nSyncAndDrawFrame(Native Method)
    android.view.ThreadedRenderer.draw(ThreadedRenderer.java:823)
    android.view.ViewRootImpl.draw(ViewRootImpl.java:3311)
    android.view.ViewRootImpl.performDraw(ViewRootImpl.java:3115)
    android.view.ViewRootImpl.performTraversals(ViewRootImpl.java:2484)
    android.view.ViewRootImpl.doTraversal(ViewRootImpl.java:1460)
    android.view.ViewRootImpl$TraversalRunnable.run(ViewRootImpl.java:7183)
    android.view.Choreographer$CallbackRecord.run(Choreographer.java:949)
    android.view.Choreographer.doCallbacks(Choreographer.java:761)
    android.view.Choreographer.doFrame(Choreographer.java:696)
    android.view.Choreographer$FrameDisplayEventReceiver.run(Choreographer.java:935)
    android.os.Handler.handleCallback(Handler.java:873)
    android.os.Handler.dispatchMessage(Handler.java:99)
    android.os.Looper.loop(Looper.java:193)
    android.app.ActivityThread.main(ActivityThread.java:6669)
    java.lang.reflect.Method.invoke(Native Method)
    com.android.internal.os.RuntimeInit$MethodAndArgsCaller.run(RuntimeInit.java:493)
    com.android.internal.os.ZygoteInit.main(ZygoteInit.java:858)
Hit MOZ_CRASH(Uncaught Java exception) at /builds/worker/workspace/build/src/widget/android/nsAppShell.cpp:266

Hit MOZ_CRASH(Uncaught Java exception) at /builds/worker/workspace/build/src/widget/android/nsAppShell.cpp:266
Crash|SIGSEGV|0x0|14
14|0|libxul.so|GeckoAppShellSupport::ReportJavaCrash(mozilla::jni::LocalRef<mozilla::jni::TypedObject<_jclass*> > const&, mozilla::jni::Ref<mozilla::jni::TypedObject<_jthrowable*>, _jthrowable*> const&, mozilla::jni::StringParam const&)|hg:hg.mozilla.org/mozilla-central:widget/android/nsAppShell.cpp:d497a1f58d27d75da3667e74a5a7efe5799119fd|266|0x2b
14|1|libxul.so|void mozilla::jni::NativeStub<mozilla::java::GeckoAppShell::ReportJavaCrash_t, GeckoAppShellSupport, mozilla::jni::Args<mozilla::jni::Ref<mozilla::jni::TypedObject<_jthrowable*>, _jthrowable*> const&, mozilla::jni::StringParam const&> >::Wrap<&GeckoAppShellSupport::ReportJavaCrash>(_JNIEnv*, _jclass*, _jthrowable*, _jstring*)|hg:hg.mozilla.org/mozilla-central:widget/android/jni/Natives.h:d497a1f58d27d75da3667e74a5a7efe5799119fd|740|0x18
14|2|libart.so||||0x634318

Comment 1

[Timothy Nikkel (:tnikkel)]

Uses a lot of memory on desktop too, but no asserts.

Comment 2

[BugBot [:suhaib / :marco/ :calixte]]

The priority flag is not set for this bug.
:mattwoodrow, could you have a look please?

For more information, please visit auto_nag documentation.

Comment 3

[Miko Mynttinen]

mozalloc_abort: out of memory: 0x000000002DDE21F8 bytes requested

= 769 532 408 bytes.

Comment 4

[Matt Woodrow (:mattwoodrow)]

Want to have a look at this Jamie?

Comment 5

[Jamie Nicol [:jnicol]]

Sorry I was on PTO. Yes, I'll have a look.