1278085 - Crash in jemalloc_crash | je_free | js::PropertyTree::getChild

Status: RESOLVED INCOMPLETE

(Core :: WebRTC: Audio/Video, defect, P1)

Description

[Marco Castelluccio [:marco]]

This bug was filed from the Socorro interface and is 
report bp-38536460-02c7-4c57-be38-f60ae2160604.
=============================================================

Crashed while starting a WebRTC call on https://apprtc.appspot.com/.

Looks like the crash happened while interpreting some JavaScript code, but I can see mozilla::MediaManager::NotifyRecordingStatusChange up in the stack.

https://hg.mozilla.org/integration/mozilla-inbound/annotate/f3740cfc4b04/memory/mozjemalloc/jemalloc.c#l4731 - Probably `arena` was null here.

Comment 1

[Marco Castelluccio [:marco]]

(In reply to Marco Castelluccio [:marco] from comment #0)
> https://hg.mozilla.org/integration/mozilla-inbound/annotate/f3740cfc4b04/
> memory/mozjemalloc/jemalloc.c#l4731 - Probably `arena` was null here.

Actually, I guess the assertion failed and so MOZ_CRASH explicitly writes to 0
in order to cause a crash.

Comment 2

[Paul Adenot (:padenot)]

Marco, are you able to repro? It's a bit hard to pinpoint exactly what the cause is. I'd say part of the heap has been trashed maybe ?

Comment 3

[Marco Castelluccio [:marco]]

No, unfortunately I can't. I'll comment again if I find a way to reproduce it.

Comment 4

[Jan-Ivar Bruaroey [:jib] (needinfo? me)]

Paul, is this actionable? Unsure how to triage this one?

Comment 5

[Paul Adenot (:padenot)]

Maire, what would be the correct way to triage this real but non-actionnable bug?

Comment 6

[Maire Reavy [:mreavy]]

I agree this is not actionable.  When we have a non-actionable bug that no one can repro AND we think it's unlikely that it will reproduced soon, we typically close the bug as INCOMPLETE.  If anyone can repro this with more info in the future or anyone can think of a way to get more info out of a future crash, we should reopen.