Closed Bug 775078 Opened 12 years ago Closed 6 years ago

OOM crash in nsTextFragment::operator= after memory allocation fails

Categories

(Core :: DOM: Core & HTML, defect)

Product:
Core
Component:
DOM: Core & HTML
Version:
13 Branch
Platform:
x86
Windows 7
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
RESOLVED WONTFIX

People

(Reporter: vulnerable.zappa, Unassigned)

References

(Blocks 1 open bug)

Details

(Keywords: crash, Whiteboard: oom [games])

Crash Data

Attachments

(2 files)

ff_13.0.1_ux_crash.zip
(deleted), application/octet-stream
Details
Testcase from the reporter
(deleted), text/html
Details
User Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:13.0) Gecko/20100101 Firefox/13.0.1 Build ID: 20120614114901 Actual results: firefox crash Expected results: i dont know
Attached file ff_13.0.1_ux_crash.zip (deleted) —
repro and dmp
Severity: normal → critical
Attached file Testcase from the reporter (deleted) —
An example from my system bp-80ab76f3-2771-4d2a-9d52-29eae2120718 Handle_OOM means crash with intent ?
Status: UNCONFIRMED → NEW
Crash Signature: [@ mozalloc_abort(char const* const) | mozalloc_handle_oom(unsigned int) | moz_xmalloc | nsMemory::Clone(void const*, unsigned int) ]
Component: Untriaged → XPCOM
Ever confirmed: true
Keywords: crash
Product: Firefox → Core
Component: XPCOM → DOM
Hardware: x86_64 → x86
Summary: crash after memmory allocation fail → OOM crash in nsTextFragment::operator= after memory allocation fails
Whiteboard: oom
Can reproduce this bug by loading the Epic Citadel html5 demo on Windows 7 Ultimate 32bit. About:Support details Name Firefox Version 28.0a1 Update History User Agent Mozilla/5.0 (Windows NT 6.1; rv:28.0) Gecko/20100101 Firefox/28.0 Profile Folder Enabled Plugins about:plugins Build Configuration about:buildconfig Memory Use about:memory Crash Reports for the Last 3 Days Report ID Submitted bp-ec9fc5fc-545e-4608-8224-532232131113 5 minutes ago bp-a0768b3d-c8f3-4a1b-8326-08a102131113 6 minutes ago All Crash Reports Extensions Name Version Enabled ID Important Modified Preferences Name Value accessibility.typeaheadfind.flashBar 0 browser.cache.disk.capacity 358400 browser.cache.disk.smart_size_cached_value 358400 browser.cache.disk.smart_size.first_run false browser.cache.disk.smart_size.use_old_max false browser.places.smartBookmarksVersion 4 browser.sessionstore.upgradeBackup.latestBuildID 20131113030205 browser.startup.homepage_override.buildID 20131113030205 browser.startup.homepage_override.mstone 28.0a1 dom.mozApps.used true extensions.lastAppVersion 28.0a1 gfx.direct3d.last_used_feature_level_idx 0 network.cookie.prefsMigrated true places.database.lastMaintenance 1384364601 places.history.expiration.transient_current_max_pages 53639 plugin.disable_full_page_plugin_for_types application/pdf plugin.importedState true privacy.sanitize.migrateFx3Prefs true storage.vacuum.last.index 0 storage.vacuum.last.places.sqlite 1384364601 Graphics Adapter Description AMD Radeon HD 6900 Series Adapter Drivers aticfx32 aticfx32 aticfx32 atiumdag atidxx32 atiumdva Adapter RAM 2048 Device ID 0x6719 Direct2D Enabled true DirectWrite Enabled true (6.1.7600.16385) Driver Date 9-27-2012 Driver Version 9.2.0.0 GPU #2 Active false GPU Accelerated Windows 1/1 Direct3D 10 Vendor ID 0x1002 WebGL Renderer Google Inc. -- ANGLE (AMD Radeon HD 6900 Series Direct3D9Ex vs_3_0 ps_3_0) windowLayerManagerRemote false AzureCanvasBackend direct2d AzureContentBackend direct2d AzureFallbackCanvasBackend cairo AzureSkiaAccelerated 0 JavaScript Incremental GC true Accessibility Activated false Prevent Accessibility 0 Library Versions Expected minimum version Version in use NSPR 4.10.2 4.10.2 NSS 3.15.3 Basic ECC Beta 3.15.3 Basic ECC Beta NSSSMIME 3.15.3 Basic ECC Beta 3.15.3 Basic ECC Beta NSSSSL 3.15.3 Basic ECC Beta 3.15.3 Basic ECC Beta NSSUTIL 3.15.3 Beta 3.15.3 Beta
QA Contact: mschifer
Whiteboard: oom → oom [games]
Blocks: gecko-games
Crash Signature: [@ mozalloc_abort(char const* const) | mozalloc_handle_oom(unsigned int) | moz_xmalloc | nsMemory::Clone(void const*, unsigned int) ] → [@ mozalloc_abort(char const* const) | mozalloc_handle_oom(unsigned int) | moz_xmalloc | nsMemory::Clone(void const*, unsigned int) ] [@ mozalloc_abort | mozalloc_handle_oom | moz_xmalloc | nsMemory::Clone ]
Closing because no crash reported since 12 weeks.
Status: NEW → RESOLVED
Closed: 6 years ago
Resolution: --- → WONTFIX
Closing because no crash reported since 12 weeks.
Component: DOM → DOM: Core & HTML
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: