Open Bug 1166854 Opened 11 years ago Updated 3 years ago

Crash in arena_dalloc_small() at jemalloc.c:4651

Categories

(Core :: Memory Allocator, defect)

Product:
Core
Component:
Memory Allocator
Platform:
x86_64
Linux
Type:
defect

Tracking

()

Tracking Flags:
Tracking Status
firefox41 --- affected

People

(Reporter: botond, Unassigned)

Details

I was running a debug build of Nightly on Linux, and crashed due to the following release assertion: #0 0x00007fa1560466fd in nanosleep () at ../sysdeps/unix/syscall-template.S:81 #1 0x00007fa156046594 in __sleep (seconds=0) at ../sysdeps/unix/sysv/linux/sleep.c:137 #2 0x00007fa1518d16e0 in ah_crap_handler (signum=11) at /home/botond/dev/mozilla/central/toolkit/xre/nsSigHandlers.cpp:101 #3 0x00007fa1518be5b6 in nsProfileLock::FatalSignalHandler (signo=11, info=<optimized out>, context=<optimized out>) at /home/botond/dev/mozilla/central/profile/dirserviceprovider/nsProfileLock.cpp:191 #4 0x00007fa151ed1c01 in AsmJSFaultHandler (signum=<optimized out>, info=0x7fff78ed7670, context=0x7fff78ed7540) at /home/botond/dev/mozilla/central/js/src/asmjs/AsmJSSignalHandlers.cpp:1135 #5 <signal handler called> #6 jemalloc_crash () at /home/botond/dev/mozilla/central/memory/mozjemalloc/jemalloc.c:1610 #7 0x0000000000416c9c in arena_dalloc_small (arena=<optimized out>, chunk=<optimized out>, ptr=<optimized out>, mapelm=<optimized out>) at /home/botond/dev/mozilla/central/memory/mozjemalloc/jemalloc.c:4651 #8 arena_dalloc (ptr=<optimized out>, offset=<optimized out>) at /home/botond/dev/mozilla/central/memory/mozjemalloc/jemalloc.c:4719 #9 0x00007fa151b0e6e7 in _cairo_clip_reset (clip=0x7fa12dfbb8e0) at /home/botond/dev/mozilla/central/gfx/cairo/cairo/src/cairo-clip.c:212 #10 0x00007fa151b1687a in _cairo_gstate_fini (gstate=0x7fa12dfbb830) at /home/botond/dev/mozilla/central/gfx/cairo/cairo/src/cairo-gstate.c:216 #11 0x00007fa151b46af6 in INT__moz_cairo_destroy (cr=0x7fa12dfbb800) at /home/botond/dev/mozilla/central/gfx/cairo/cairo/src/cairo.c:461 #12 0x00007fa14fc02c5a in mozilla::gfx::DrawTargetCairo::~DrawTargetCairo (this=0x7fa1363faa00) at /home/botond/dev/mozilla/central/gfx/2d/DrawTargetCairo.cpp:590 #13 0x00007fa14fc02d00 in mozilla::gfx::DrawTargetCairo::~DrawTargetCairo (this=0x7fa1363faa00) at /home/botond/dev/mozilla/central/gfx/2d/DrawTargetCairo.cpp:589 #14 0x00007fa14fc92ed2 in unref (aVal=<optimized out>) at ../../dist/include/mozilla/RefPtr.h:310 #15 assign (this=<optimized out>, aVal=<optimized out>) at ../../dist/include/mozilla/RefPtr.h:293 #16 operator= (this=<optimized out>, aVal=<optimized out>) at ../../dist/include/mozilla/RefPtr.h:265 #17 mozilla::layers::TextureClientX11::Unlock (this=0x7fa124a40e80) at /home/botond/dev/mozilla/central/gfx/layers/basic/TextureClientX11.cpp:80 #18 0x00007fa14fcd8e02 in mozilla::layers::ContentClientRemoteBuffer::EndPaint (this=0x7fa123faecf0, aReadbackUpdates=<optimized out>) at /home/botond/dev/mozilla/central/gfx/layers/client/ContentClient.cpp:266 #19 0x00007fa14fcd5f63 in mozilla::layers::ClientPaintedLayer::RenderLayerWithReadback (this=0x7fa135e03400, aReadback=<optimized out>) at /home/botond/dev/mozilla/central/gfx/layers/client/ClientPaintedLayer.cpp:143 #20 0x00007fa14fcd4e08 in mozilla::layers::ClientContainerLayer::RenderLayer (this=0x7fa135e03000) at /home/botond/dev/mozilla/central/gfx/layers/client/ClientContainerLayer.h:68 #21 0x00007fa14fcd4e08 in mozilla::layers::ClientContainerLayer::RenderLayer (this=0x7fa135eab000) at /home/botond/dev/mozilla/central/gfx/layers/client/ClientContainerLayer.h:68 #22 0x00007fa14fcd05a6 in mozilla::layers::ClientLayerManager::EndTransactionInternal (this=0x7fa136443b80, aCallback= 0x7fa151249962 <mozilla::FrameLayerBuilder::DrawPaintedLayer(mozilla::layers::PaintedLayer*, gfxContext*, nsIntRegion const&, mozilla::layers::DrawRegionClip, nsIntRegion const&, void*)>, aCallbackData=0x7fff78ed85d8) at /home/botond/dev/mozilla/central/gfx/layers/client/ClientLayerManager.cpp:272 #23 0x00007fa14fcd0729 in mozilla::layers::ClientLayerManager::EndTransaction (this=0x7fa136443b80, aCallback=0x7fa151249962 <mozilla::FrameLayerBuilder::DrawPaintedLayer(mozilla::layers::PaintedLayer*, gfxContext*, nsIntRegion const&, mozilla::layers::DrawRegionClip, nsIntRegion const&, void*)>, aCallbackData=0x7fff78ed85d8, aFlags=mozilla::layers::LayerManager::END_DEFAULT) at /home/botond/dev/mozilla/central/gfx/layers/client/ClientLayerManager.cpp:315 #24 0x00007fa1512a271b in nsDisplayList::PaintRoot (this=0x7fff78ed8550, aBuilder=0x7fff78ed85d8, aCtx=<optimized out>, aFlags=<optimized out>) at /home/botond/dev/mozilla/central/layout/base/nsDisplayList.cpp:1604 #25 0x00007fa1512d3c53 in nsLayoutUtils::PaintFrame (aRenderingContext=0x0, aFrame=0x7fa13b940538, aDirtyRegion=..., aBackstop=2028831816, aFlags=<optimized out>) at /home/botond/dev/mozilla/central/layout/base/nsLayoutUtils.cpp:3283 #26 0x00007fa1512f90b8 in PresShell::Paint (this=0x7fa13c3dac00, aViewToPaint=0x7fa13c3a6120, aDirtyRegion=..., aFlags=1) at /home/botond/dev/mozilla/central/layout/base/nsPresShell.cpp:6331 #27 0x00007fa1510135c4 in nsViewManager::ProcessPendingUpdatesPaint (this=0x7fa13cba8b00, aWidget=0x7fa13c8043e0) at /home/botond/dev/mozilla/central/view/nsViewManager.cpp:456 #28 0x00007fa1510133a6 in nsViewManager::ProcessPendingUpdatesForView (this=0x7fa13cba8b00, aView=<optimized out>, aFlushDirtyRegion=<optimized out>) at /home/botond/dev/mozilla/central/view/nsViewManager.cpp:396 #29 0x00007fa15123583f in nsRefreshDriver::Tick (this=0x7fa13c3da800, aNowEpoch=1432146673357397, aNowTime=...) at /home/botond/dev/mozilla/central/layout/base/nsRefreshDriver.cpp:1791 #30 0x00007fa151236532 in nsRefreshDriver::FinishedWaitingForTransaction (this=0x7fa13c3da800) at /home/botond/dev/mozilla/central/layout/base/nsRefreshDriver.cpp:1925 #31 0x00007fa14fd030eb in mozilla::layers::CompositorChild::RecvDidComposite (this=<optimized out>, aId=<optimized out>, aTransactionId=@0x7fff78ed9220: 355) at /home/botond/dev/mozilla/central/gfx/layers/ipc/CompositorChild.cpp:348 #32 0x00007fa14f873976 in mozilla::layers::PCompositorChild::OnMessageReceived (this=0x7fa135ea7000, msg__=...) at ./PCompositorChild.cpp:820 #33 0x00007fa14f5c5596 in mozilla::ipc::MessageChannel::DispatchAsyncMessage (this=0x7fa135ea7068, aMsg=...) at /home/botond/dev/mozilla/central/ipc/glue/MessageChannel.cpp:1279 #34 0x00007fa14f5c4aab in mozilla::ipc::MessageChannel::DispatchMessage (this=0x7fa135ea7068, aMsg=...) at /home/botond/dev/mozilla/central/ipc/glue/MessageChannel.cpp:1198 #35 0x00007fa14f5c16bd in mozilla::ipc::MessageChannel::OnMaybeDequeueOne (this=0x7fa135ea7068) at /home/botond/dev/mozilla/central/ipc/glue/MessageChannel.cpp:1182 #36 0x00007fa14f596fc6 in MessageLoop::RunTask (this=0x7fa155df91c0, task=0x7fa1310462e0) at /home/botond/dev/mozilla/central/ipc/chromium/src/base/message_loop.cc:361 #37 0x00007fa14f597380 in MessageLoop::DeferOrRunPendingTask (this=0x7fa156333060 <_IO_2_1_stderr_>, pending_task=...) at /home/botond/dev/mozilla/central/ipc/chromium/src/base/message_loop.cc:369 #38 0x00007fa14f5974ce in MessageLoop::DoWork (this=0x7fa155df91c0) at /home/botond/dev/mozilla/central/ipc/chromium/src/base/message_loop.cc:456 #39 0x00007fa14f5c7815 in mozilla::ipc::DoWorkRunnable::Run (this=<optimized out>) at /home/botond/dev/mozilla/central/ipc/glue/MessagePump.cpp:220 #40 0x00007fa14f29b4d0 in nsThread::ProcessNextEvent (this=0x7fa155d674f0, aMayWait=<optimized out>, aResult=0x7fff78ed95d7) ---Type <return> to continue, or q <return> to quit--- at /home/botond/dev/mozilla/central/xpcom/threads/nsThread.cpp:866 #41 0x00007fa14f2c1bc7 in NS_ProcessNextEvent (aThread=<optimized out>, aMayWait=false) at /home/botond/dev/mozilla/central/xpcom/glue/nsThreadUtils.cpp:265 #42 0x00007fa14f5c7358 in mozilla::ipc::MessagePump::Run (this=0x7fa155df1940, aDelegate=0x7fa155df91c0) at /home/botond/dev/mozilla/central/ipc/glue/MessagePump.cpp:95 #43 0x00007fa14f596e18 in RunHandler (this=0x7fa156333060 <_IO_2_1_stderr_>) at /home/botond/dev/mozilla/central/ipc/chromium/src/base/message_loop.cc:226 #44 MessageLoop::Run (this=0x7fa156333060 <_IO_2_1_stderr_>) at /home/botond/dev/mozilla/central/ipc/chromium/src/base/message_loop.cc:200 #45 0x00007fa15102b96d in nsBaseAppShell::Run (this=0x7fa14232da00) at /home/botond/dev/mozilla/central/widget/nsBaseAppShell.cpp:165 #46 0x00007fa15187399a in nsAppStartup::Run (this=0x7fa142318060) at /home/botond/dev/mozilla/central/toolkit/components/startup/nsAppStartup.cpp:280 #47 0x00007fa1518ca87f in XREMain::XRE_mainRun (this=<optimized out>) at /home/botond/dev/mozilla/central/toolkit/xre/nsAppRunner.cpp:4079 #48 0x00007fa1518cad7f in XREMain::XRE_main (this=0x7fff78ed9a48, argc=<optimized out>, argv=<optimized out>, aAppData=<optimized out>) at /home/botond/dev/mozilla/central/toolkit/xre/nsAppRunner.cpp:4170 #49 0x00007fa1518cb2b4 in XRE_main (argc=1446201232, argv=0x0, aAppData=0x7fa15606863d <write+45>, aFlags=<optimized out>) at /home/botond/dev/mozilla/central/toolkit/xre/nsAppRunner.cpp:4259 #50 0x0000000000404ba0 in do_main (argc=4, argv=<optimized out>, xreDirectory=0x7fa155d4d6c0) at /home/botond/dev/mozilla/central/browser/app/nsBrowserApp.cpp:214 #51 main (argc=4, argv=<optimized out>) at /home/botond/dev/mozilla/central/browser/app/nsBrowserApp.cpp:478 I was running with APZ enabled, but I don't think that's relevant to this crash.
(Er, sorry, the trace in comment 1 was not "elsewhere in jemalloc.c", it was in the same place.) This assertion is basically making Nightly usuable for me in debug mode. Is it safe to comment it out locally?
Flags: needinfo?(mh+mozilla)
(In reply to Botond Ballo [:botond] from comment #2) > This assertion is basically making Nightly usuable for me in debug mode er, "unusable" :)
OK, here's a crash from elsewhere in jemalloc.c: #6 jemalloc_crash () at /home/botond/dev/mozilla/central/memory/mozjemalloc/jemalloc.c:1610 #7 0x0000000000416c76 in arena_dalloc_small (arena=<optimized out>, chunk=<optimized out>, ptr=<optimized out>, mapelm=<optimized out>) at /home/botond/dev/mozilla/central/memory/mozjemalloc/jemalloc.c:4639 #8 arena_dalloc (ptr=<optimized out>, offset=<optimized out>) at /home/botond/dev/mozilla/central/memory/mozjemalloc/jemalloc.c:4719 #9 0x00007fa21680e737 in _cairo_clip_reset (clip=0x7fa1e79310e0) at /home/botond/dev/mozilla/central/gfx/cairo/cairo/src/cairo-clip.c:212 #10 0x00007fa2168168ca in _cairo_gstate_fini (gstate=0x7fa1e7931030) at /home/botond/dev/mozilla/central/gfx/cairo/cairo/src/cairo-gstate.c:216 #11 0x00007fa216846b46 in INT__moz_cairo_destroy (cr=0x7fa1e7931000) at /home/botond/dev/mozilla/central/gfx/cairo/cairo/src/cairo.c:461 #12 0x00007fa214902c5a in mozilla::gfx::DrawTargetCairo::~DrawTargetCairo (this=0x7fa1f1eb9a00) at /home/botond/dev/mozilla/central/gfx/2d/DrawTargetCairo.cpp:590 #13 0x00007fa214902d00 in mozilla::gfx::DrawTargetCairo::~DrawTargetCairo (this=0x7fa1f1eb9a00) at /home/botond/dev/mozilla/central/gfx/2d/DrawTargetCairo.cpp:589 #14 0x00007fa2149a16c2 in unref (aVal=<optimized out>) at ../../dist/include/mozilla/RefPtr.h:310 #15 assign (this=0x7fa1e87ef9b8, aVal=0x7fa1f1eb9780) at ../../dist/include/mozilla/RefPtr.h:293 #16 mozilla::RefPtr<mozilla::gfx::DrawTarget>::operator= (this=0x7fa1e87ef9b8, aOther=...) at ../../dist/include/mozilla/RefPtr.h:250 #17 0x00007fa214a5768b in gfxContext::Restore (this=0x7fa1e87ef940) at /home/botond/dev/mozilla/central/gfx/thebes/gfxContext.cpp:182 #18 0x00007fa214a5b553 in gfxContext::PopGroupToSource (this=0x7fa1e87ef940) at /home/botond/dev/mozilla/central/gfx/thebes/gfxContext.cpp:943 #19 0x00007fa2149cd871 in mozilla::layers::BasicPaintedLayer::PaintThebes (this=<optimized out>, aContext=0x7fa1e87ef940, aMaskLayer=0x0, aCallback= 0x7fa215f49962 <mozilla::FrameLayerBuilder::DrawPaintedLayer(mozilla::layers::PaintedLayer*, gfxContext*, nsIntRegion const&, mozilla::layers::DrawRegionClip, nsIntRegion const&, void*)>, aCallbackData=0x7fff187d41e8) at /home/botond/dev/mozilla/central/gfx/layers/basic/BasicPaintedLayer.cpp:96 #20 0x00007fa2149cbdc2 in mozilla::layers::BasicLayerManager::PaintLayer (this=0x7fa1eecc5a10, aTarget=0x7fa1e87ef940, aLayer=<optimized out>, aCallback=<optimized out>, aCallbackData=<optimized out>) at /home/botond/dev/mozilla/central/gfx/layers/basic/BasicLayerManager.cpp:916 #21 0x00007fa2149cca99 in mozilla::layers::BasicLayerManager::PaintSelfOrChildren (this=0x7fa1eecc5a10, aPaintContext=..., aGroupTarget=0x7fa1e87ef940) at /home/botond/dev/mozilla/central/gfx/layers/basic/BasicLayerManager.cpp:815 #22 0x00007fa2149cbdc2 in mozilla::layers::BasicLayerManager::PaintLayer (this=0x7fa1eecc5a10, aTarget=0x7fa1e87ef940, aLayer=<optimized out>, aCallback=<optimized out>, aCallbackData=<optimized out>) at /home/botond/dev/mozilla/central/gfx/layers/basic/BasicLayerManager.cpp:916 #23 0x00007fa2149cb0df in mozilla::layers::BasicLayerManager::EndTransactionInternal (this=0x7fa1eecc5a10, aCallback=0x7fa215f49962 <mozilla::FrameLayerBuilder::DrawPaintedLayer(mozilla::layers::PaintedLayer*, gfxContext*, nsIntRegion const&, mozilla::layers::DrawRegionClip, nsIntRegion const&, void*)>, aCallbackData=0x7fff187d41e8, aFlags=<optimized out>) at /home/botond/dev/mozilla/central/gfx/layers/basic/BasicLayerManager.cpp:533 #24 0x00007fa215f49482 in PaintInactiveLayer (aBuilder=0x7fff187d41e8, aManager=0x7fa1eecc5a10, aItem=0x7fa1ee61f470, aContext=0x7fa1e87ef940, aCtx=0x7fff187d3768) at /home/botond/dev/mozilla/central/layout/base/FrameLayerBuilder.cpp:3289 #25 mozilla::FrameLayerBuilder::PaintItems (this=0x7fa1e8af1120, aItems=..., aRect=..., aContext=0x7fa1e87ef940, aRC=0x7fff187d3768, aBuilder=0x7fff187d41e8, aPresContext=<optimized out>, aOffset=..., aXScale=-4.81631575e+24, aYScale=5.18480432e-43, aCommonClipCount=<optimized out>) at /home/botond/dev/mozilla/central/layout/base/FrameLayerBuilder.cpp:5062 #26 0x00007fa215f49fdd in mozilla::FrameLayerBuilder::DrawPaintedLayer (aLayer=0x7fa1fcae6c00, aContext=0x7fa1e87ef940, aRegionToDraw=..., aClip=mozilla::layers::DRAW, aRegionToInvalidate=..., aCallbackData=0x7fff187d41e8) at /home/botond/dev/mozilla/central/layout/base/FrameLayerBuilder.cpp:5271 #27 0x00007fa2149d5c49 in mozilla::layers::ClientPaintedLayer::PaintThebes (this=0x7fa1fcae6c00) at /home/botond/dev/mozilla/central/gfx/layers/client/ClientPaintedLayer.cpp:87 #28 0x00007fa2149d5f4b in mozilla::layers::ClientPaintedLayer::RenderLayerWithReadback (this=0x7fa1fcae6c00, aReadback=<optimized out>) at /home/botond/dev/mozilla/central/gfx/layers/client/ClientPaintedLayer.cpp:142 #29 0x00007fa2149d4e08 in mozilla::layers::ClientContainerLayer::RenderLayer (this=0x7fa1fc7b5c00) at /home/botond/dev/mozilla/central/gfx/layers/client/ClientContainerLayer.h:68 #30 0x00007fa2149d4e08 in mozilla::layers::ClientContainerLayer::RenderLayer (this=0x7fa1fcd44000) at /home/botond/dev/mozilla/central/gfx/layers/client/ClientContainerLayer.h:68 #31 0x00007fa2149d05a6 in mozilla::layers::ClientLayerManager::EndTransactionInternal (this=0x7fa1fd435c80, aCallback=0x7fa215f49962 <mozilla::FrameLayerBuilder::DrawPaintedLayer(mozilla::layers::PaintedLayer*, gfxContext*, nsIntRegion const&, mozilla::layers::DrawRegionClip, nsIntRegion const&, void*)>, aCallbackData=0x7fff187d41e8) at /home/botond/dev/mozilla/central/gfx/layers/client/ClientLayerManager.cpp:272 #32 0x00007fa2149d0729 in mozilla::layers::ClientLayerManager::EndTransaction (this=0x7fa1fd435c80, aCallback=0x7fa215f49962 <mozilla::FrameLayerBuilder::DrawPaintedLayer(mozilla::layers::PaintedLayer*, gfxContext*, nsIntRegion const&, mozilla::layers::DrawRegionClip, nsIntRegion const&, void*)>, aCallbackData=0x7fff187d41e8, aFlags=mozilla::layers::LayerManager::END_DEFAULT) at /home/botond/dev/mozilla/central/gfx/layers/client/ClientLayerManager.cpp:315 #33 0x00007fa215fa271b in nsDisplayList::PaintRoot (this=0x7fff187d4160, aBuilder=0x7fff187d41e8, aCtx=<optimized out>, aFlags=<optimized out>) at /home/botond/dev/mozilla/central/layout/base/nsDisplayList.cpp:1604 #34 0x00007fa215fd3ca5 in nsLayoutUtils::PaintFrame (aRenderingContext=0x0, aFrame=0x7fa200012538, aDirtyRegion=..., aBackstop=410861656, aFlags=<optimized out>) at /home/botond/dev/mozilla/central/layout/base/nsLayoutUtils.cpp:3284 #35 0x00007fa215ff910c in PresShell::Paint (this=0x7fa2013a3400, aViewToPaint=0x7fa2013b9a20, aDirtyRegion=..., aFlags=1) ---Type <return> to continue, or q <return> to quit--- at /home/botond/dev/mozilla/central/layout/base/nsPresShell.cpp:6331 #36 0x00007fa215d135c4 in nsViewManager::ProcessPendingUpdatesPaint (this=0x7fa2013d7fc0, aWidget=0x7fa2018223e0) at /home/botond/dev/mozilla/central/view/nsViewManager.cpp:456 #37 0x00007fa215d133a6 in nsViewManager::ProcessPendingUpdatesForView (this=0x7fa2013d7fc0, aView=<optimized out>, aFlushDirtyRegion=<optimized out>) at /home/botond/dev/mozilla/central/view/nsViewManager.cpp:396 #38 0x00007fa215f3583f in nsRefreshDriver::Tick (this=0x7fa2013a3000, aNowEpoch=1432150412075390, aNowTime=...) at /home/botond/dev/mozilla/central/layout/base/nsRefreshDriver.cpp:1791 #39 0x00007fa215f38b78 in mozilla::RefreshDriverTimer::Tick (this=0x7fa203d80840, jsnow=1432150412075390, now=...) at /home/botond/dev/mozilla/central/layout/base/nsRefreshDriver.cpp:189 #40 0x00007fa215f38d8d in apply<mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver, void (mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::*)(mozilla::TimeStamp)> ( o=<optimized out>, this=<optimized out>, m=<optimized out>) at ../../dist/include/nsThreadUtils.h:615 #41 nsRunnableMethodImpl<void (mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::*)(mozilla::TimeStamp), true, mozilla::TimeStamp>::Run (this=0x0) at ../../dist/include/nsThreadUtils.h:809 #42 0x00007fa213f9b4d0 in nsThread::ProcessNextEvent (this=0x7fa21aa674f0, aMayWait=<optimized out>, aResult=0x7fff187d4e17) at /home/botond/dev/mozilla/central/xpcom/threads/nsThread.cpp:866 #43 0x00007fa213fc1bc7 in NS_ProcessNextEvent (aThread=<optimized out>, aMayWait=true) at /home/botond/dev/mozilla/central/xpcom/glue/nsThreadUtils.cpp:265 #44 0x00007fa2142c734d in mozilla::ipc::MessagePump::Run (this=0x7fa21aae9a40, aDelegate=0x7fa21aaf91c0) at /home/botond/dev/mozilla/central/ipc/glue/MessagePump.cpp:127 #45 0x00007fa214296e18 in RunHandler (this=0x7fa21b058060 <_IO_2_1_stderr_>) at /home/botond/dev/mozilla/central/ipc/chromium/src/base/message_loop.cc:226 #46 MessageLoop::Run (this=0x7fa21b058060 <_IO_2_1_stderr_>) at /home/botond/dev/mozilla/central/ipc/chromium/src/base/message_loop.cc:200 #47 0x00007fa215d2b96d in nsBaseAppShell::Run (this=0x7fa20732d980) at /home/botond/dev/mozilla/central/widget/nsBaseAppShell.cpp:165 #48 0x00007fa2165739ea in nsAppStartup::Run (this=0x7fa207308060) at /home/botond/dev/mozilla/central/toolkit/components/startup/nsAppStartup.cpp:280 #49 0x00007fa2165ca8cf in XREMain::XRE_mainRun (this=<optimized out>) at /home/botond/dev/mozilla/central/toolkit/xre/nsAppRunner.cpp:4079 #50 0x00007fa2165cadcf in XREMain::XRE_main (this=0x7fff187d5288, argc=<optimized out>, argv=<optimized out>, aAppData=<optimized out>) at /home/botond/dev/mozilla/central/toolkit/xre/nsAppRunner.cpp:4170 #51 0x00007fa2165cb304 in XRE_main (argc=453351312, argv=0x0, aAppData=0x7fa21ad8d63d <write+45>, aFlags=<optimized out>) at /home/botond/dev/mozilla/central/toolkit/xre/nsAppRunner.cpp:4259 #52 0x0000000000404ba0 in do_main (argc=4, argv=<optimized out>, xreDirectory=0x7fa21aa4d6c0) at /home/botond/dev/mozilla/central/browser/app/nsBrowserApp.cpp:214 #53 main (argc=4, argv=<optimized out>) at /home/botond/dev/mozilla/central/browser/app/nsBrowserApp.cpp:478
I rebuilt with --disable-jemalloc, and I'm still getting a crash in _cairo_clip_reset, but this time in the system malloc implementation - so I guess this is unrelated to jemalloc?
Seems like something is doing bad things with memory it shouldn't be touching, or using pointers that didn't come out straight from the allocator.
Flags: needinfo?(mh+mozilla)
Severity: normal → S3
You need to log in before you can comment on or make changes to this bug.