1139905 - crash in je_arena_salloc

Status: VERIFIED DUPLICATE of bug 1131180

(Core :: Memory Allocator, defect)

Description

[Robert Kaiser]

This bug was filed from the Socorro interface and is 
report bp-37f1ece2-066e-49c7-b059-586e62150303.
=============================================================

Top frames:
0 	mozglue.dll 	je_arena_salloc 	memory/jemalloc/src/include/jemalloc/internal/arena.h
1 	mozglue.dll 	ifree 	memory/jemalloc/src/src/jemalloc.c
2 	mozglue.dll 	free_impl 	memory/build/replace_malloc.c
3 	xul.dll 	js::ctypes::CData::Finalize 	js/src/ctypes/CTypes.cpp
4 	xul.dll 	FinalizeArenas 	js/src/jsgc.cpp
5 	xul.dll 	js::gc::ArenaLists::forceFinalizeNow(js::FreeOp*, js::gc::AllocKind, js::gc::ArenaLists::KeepArenasEnum, js::gc::ArenaHeader**) 	js/src/jsgc.cpp
6 	xul.dll 	js::gc::ArenaLists::queueForegroundObjectsForSweep(js::FreeOp*) 	js/src/jsgc.cpp
7 	xul.dll 	js::gc::GCRuntime::beginSweepingZoneGroup() 	js/src/jsgc.cpp
[...]

Those crashes have started on 39.0a1 Nightly on 2015-03-03, so I'm pretty sure that bug 762449 triggered/caused them. Looks like they're almost all startup and almost all with GC running.

We probably also should file a bug on Socorro to get this frame added to the signature prefix list so that the following frame will be appended (same with all following frames until we get to something non-generic - where would that be in this case?).

Comment 1

[(Away)]

Bug 762449 only caused the symbol rename.