Open Bug 1405062 Opened 2 years ago Updated 6 months ago

Crash in RedBlackTree<T>::Remove

Categories

(Core :: Memory Allocator, defect, P3, critical)

defect

Tracking

()

Tracking Status
firefox-esr60 --- affected
firefox57 --- unaffected
firefox58 --- wontfix
firefox59 --- wontfix
firefox66 --- affected
firefox67 --- affected

People

(Reporter: marcia, Unassigned)

References

Details

(Keywords: crash)

Crash Data

This bug was filed from the Socorro interface and is 
report bp-a62f5fb8-b90b-485c-ba26-c6c600171002.
=============================================================

Seen while looking at nightly crash stats: http://bit.ly/2fEAnTD. Crashes started using 20170929100122

Possible regression range based on Build ID: https://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=76a26ef7c493311c170ae83eb0c1d6592a21396d&tochange=57f68296c350469d73d788eb3695a898947b4acb

Possibly Bug 1403444? ni on :glandium
Flags: needinfo?(mh+mozilla)
Crashing address is 0x20, so looks like a null pointer when calling `RedBlackTree::Remove` [1]. I wonder if we should make this a diagnostic assert instead?

[1] http://searchfox.org/mozilla-central/source/memory/build/mozjemalloc.cpp#4280-4284
Changing platform to all. Still a small volume crash with about 15 crashes in the last week.
OS: Windows 10 → All
Hardware: Unspecified → All
Mike, can you give this a priority?
Flags: needinfo?(mh+mozilla)
(In reply to Mike Taylor [:miketaylr] (58 Regression Engineering Owner) from comment #4)
> Mike, can you give this a priority?

As mentioned in comment 2, this is not a regression. It's a signature change.
Flags: needinfo?(mh+mozilla)
Crashes here on Debian ppc64:

(gdb) bt
#0  0x0000000100010718 in RedBlackTree<arena_chunk_map_t, ArenaAvailTreeTrait>::Remove(RedBlackTree<arena_chunk_map_t, ArenaAvailTreeTrait>::TreeNode*) (this=0x7ffff7800080, aNode=0x7ffff4f00038)
    at /build/firefox-083moG/firefox-59.0~b4/memory/build/rb.h:388
#1  0x0000000100011890 in RedBlackTree<arena_chunk_map_t, ArenaAvailTreeTrait>::Remove(arena_chunk_map_t*) (aNode=0x7ffff4f00038, this=<optimized out>) at /build/firefox-083moG/firefox-59.0~b4/memory/build/rb.h:152
#2  0x0000000100011890 in arena_t::SplitRun(arena_run_t*, unsigned long, bool, bool) (this=this@entry=0x7ffff7800000, aRun=aRun@entry=0x7ffff4f10000, aSize=aSize@entry=1048576, aLarge=<optimized out>, 
    aLarge@entry=false, aZero=<optimized out>) at /build/firefox-083moG/firefox-59.0~b4/memory/build/mozjemalloc.cpp:2363
#3  0x0000000100011f60 in arena_t::AllocRun(unsigned long, bool, bool) (this=0x7ffff7800000, aSize=1048576, aLarge=aLarge@entry=false, aZero=aZero@entry=false)
    at /build/firefox-083moG/firefox-59.0~b4/memory/build/mozjemalloc.cpp:2541
#4  0x0000000100014090 in arena_t::GetNonFullBinRun(arena_bin_t*) (this=<optimized out>, aBin=0x7ffff78008d8) at /build/firefox-083moG/firefox-59.0~b4/memory/build/mozjemalloc.cpp:2791
#5  0x0000000100015e7c in arena_t::MallocSmall(unsigned long, bool) (aZero=true, aSize=<optimized out>, this=0x7ffff7800000) at /build/firefox-083moG/firefox-59.0~b4/memory/build/mozjemalloc.cpp:2937
#6  0x0000000100015e7c in arena_t::Malloc(unsigned long, bool) (aZero=true, aSize=<optimized out>, this=0x7ffff7800000) at /build/firefox-083moG/firefox-59.0~b4/memory/build/mozjemalloc.cpp:2994
#7  0x0000000100015e7c in BaseAllocator::calloc(unsigned long, unsigned long) (aSize=<optimized out>, aNum=<optimized out>, this=<synthetic pointer>)
    at /build/firefox-083moG/firefox-59.0~b4/memory/build/mozjemalloc.cpp:4173
#8  0x0000000100015e7c in Allocator<MozJemallocBase>::calloc(unsigned long, unsigned long) (arg2=<optimized out>, arg1=<optimized out>) at /build/firefox-083moG/firefox-59.0~b4/memory/build/malloc_decls.h:38
#9  0x0000000100015e7c in calloc(size_t, size_t) (arg1=<optimized out>, arg2=<optimized out>) at /build/firefox-083moG/firefox-59.0~b4/memory/build/malloc_decls.h:38
#10 0x00007ffff5b34afc in .xcb_connect_to_fd () at /usr/lib/powerpc64-linux-gnu/libxcb.so.1
#11 0x00007ffff5b3a0ac in .xcb_connect_to_display_with_auth_info () at /usr/lib/powerpc64-linux-gnu/libxcb.so.1
#12 0x00007ffff5b3a208 in .xcb_connect () at /usr/lib/powerpc64-linux-gnu/libxcb.so.1
#13 0x00007ffff698bb4c in ._XConnectXCB () at /usr/lib/powerpc64-linux-gnu/libX11.so.6
#14 0x00007ffff6976e3c in .XOpenDisplay () at /usr/lib/powerpc64-linux-gnu/libX11.so.6
#15 0x00007ffff6d01764 in  () at /usr/lib/powerpc64-linux-gnu/libgdk-3.so.0
#16 0x00007ffff6cbd57c in .gdk_display_manager_open_display () at /usr/lib/powerpc64-linux-gnu/libgdk-3.so.0
#17 0x00007ffff6cba8a4 in .gdk_display_open () at /usr/lib/powerpc64-linux-gnu/libgdk-3.so.0
#18 0x00007ffff308432c in XREMain::XRE_mainStartup(bool*) (this=this@entry=0x7fffffffdb58, aExitFlag=aExitFlag@entry=0x7fffffffda98) at /build/firefox-083moG/firefox-59.0~b4/toolkit/xre/nsAppRunner.cpp:3951
#19 0x00007ffff30890ac in XREMain::XRE_mainStartup(bool*) (aExitFlag=0x7fffffffda98, this=0x7fffffffdb58) at /build/firefox-083moG/firefox-59.0~b4/build-browser/dist/include/nsCOMPtr.h:313
#20 0x00007ffff30890ac in XREMain::XRE_main(int, char**, mozilla::BootstrapConfig const&) (this=this@entry=0x7fffffffdb58, argc=argc@entry=1, argv=argv@entry=0x7ffffffff358, aConfig=...)
    at /build/firefox-083moG/firefox-59.0~b4/toolkit/xre/nsAppRunner.cpp:4826
#21 0x00007ffff3089528 in XRE_main(int, char**, mozilla::BootstrapConfig const&) (argc=<optimized out>, argv=0x7ffffffff358, aConfig=...) at /build/firefox-083moG/firefox-59.0~b4/toolkit/xre/nsAppRunner.cpp:4933
#22 0x00007ffff308b2bc in mozilla::BootstrapImpl::XRE_main(int, char**, mozilla::BootstrapConfig const&) (this=<optimized out>, argc=<optimized out>, argv=<optimized out>, aConfig=...)
    at /build/firefox-083moG/firefox-59.0~b4/toolkit/xre/Bootstrap.cpp:49
#23 0x000000010000a1d8 in do_main(int, char**, char**) (argc=<optimized out>, argv=0x7ffffffff358, envp=<optimized out>) at /build/firefox-083moG/firefox-59.0~b4/browser/app/nsBrowserApp.cpp:231
#24 0x0000000100009850 in main(int, char**, char**) (argc=<optimized out>, argv=0x7ffffffff358, envp=0x7ffffffff368) at /build/firefox-083moG/firefox-59.0~b4/browser/app/nsBrowserApp.cpp:304
(gdb)
We've got the same on SUSE Linux ppc64le, right at startup. An interesting thing: the only architecture where we see this has pagesize of 64k (may be just a coincidence though).
See Also: → 1466567
Priority: -- → P3
You need to log in before you can comment on or make changes to this bug.