1576454 - Crash in [@ malloc_init | BaseAllocator::malloc | Allocator<T>::malloc | replace_malloc]

Status: RESOLVED DUPLICATE of bug 1575842

(Toolkit :: Safe Browsing, defect)

Description

[Julian Seward [:jseward]]

This bug is for crash report bp-f9121144-41ef-45d6-b829-31fef0190823.

This has 5 crashes in 3 installations in the Windows nightly 20190822095439.
Is it some early stage malloc crashing, or startup race, or something like that?

Top 10 frames of crashing thread:

0 mozglue.dll malloc_init memory/build/mozjemalloc.cpp:1223
1 mozglue.dll BaseAllocator::malloc memory/build/mozjemalloc.cpp:3934
2 mozglue.dll Allocator<MozJemallocBase>::malloc memory/build/malloc_decls.h:38
3 mozglue.dll replace_malloc memory/replace/phc/PHC.cpp:943
4 xul.dll nsTSubstring<char16_t>::StartBulkWriteImpl xpcom/string/nsTSubstring.cpp:203
5 xul.dll nsTSubstring<char16_t>::Assign xpcom/string/nsTSubstring.cpp:408
6 xul.dll mozilla::NtPathToDosPath xpcom/io/FileUtilsWin.h:51
7 xul.dll void `anonymous namespace'::WinIOAutoObservation::WinIOAutoObservation xpcom/build/PoisonIOInterposerWin.cpp:134
8 xul.dll static long `anonymous namespace'::InterposedNtCreateFile xpcom/build/PoisonIOInterposerWin.cpp:207
9 kernelbase.dll CreateFileInternal 

Comment 1

[Mike Hommey [:glandium]]

It's a stack overflow on the URL Classifier thread, that just happens to happen while calling in the allocator.

Comment 2

[Mike Hommey [:glandium]]

There's an infinite recursion between mozilla::safebrowsing::Classifier::GetLookupCache and mozilla::safebrowsing::Classifier::ResetTables