1453101 - Crash in arena_t::DallocSmall | static void arena_dalloc

Status: RESOLVED DUPLICATE of bug 1319454

(Core :: Security: PSM, defect)

Description

[Marcia Knous [:marcia]]

This bug was filed from the Socorro interface and is
report bp-5a584f40-2551-4c3a-bc07-30c700180410.
=============================================================

Seen while looking at Windows nightly crash stats: https://bit.ly/2IJuWiC. Crashes started using 20180313100127. Some but not all reports have crash reason: MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)

Possible regression range based on Build ID: https://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=fdd1a0082c71673239fc2f3a6a93de889c07a1be&tochange=c56ef1c14a555023949ad727c86e3c2df995edd2

Top 10 frames of crashing thread:

0 mozglue.dll arena_t::DallocSmall memory/build/mozjemalloc.cpp:3418
1 mozglue.dll static void arena_dalloc memory/build/mozjemalloc.cpp:3504
2 nss3.dll static void DefaultFreeEntry nsprpub/lib/ds/plhash.c:55
3 nss3.dll PL_HashTableDestroy nsprpub/lib/ds/plhash.c:115
4 nss3.dll SECOID_Shutdown security/nss/lib/util/secoid.c:2258
5 nss3.dll nss_Shutdown security/nss/lib/nss/nssinit.c:1159
6 nss3.dll NSS_Shutdown security/nss/lib/nss/nssinit.c:1221
7 xul.dll mozilla::ShutdownXPCOM xpcom/build/XPCOMInit.cpp:1003
8 xul.dll ScopedXPCOMStartup::~ScopedXPCOMStartup toolkit/xre/nsAppRunner.cpp:1508
9 xul.dll XREMain::XRE_main toolkit/xre/nsAppRunner.cpp:5007

=============================================================

Comment 2

[Andrew McCreight [:mccr8]]

This is probably a signature change from the MSVC version change, which is in the range in comment 0.

Comment 3

[Liz Henry (:lizzard) (relman/hg->git project)]

We're close to the end of the release cycle. No crashes showing up in 61, 62 or 63. Calling this a wontfix for 61.