1607183 - Crash in [@ arena_t::DallocSmall | arena_dalloc | replace_free | nsStyleDisplay::~nsStyleDisplay]

Status: RESOLVED WORKSFORME

(Core :: Layout, defect, P3)

Description

[reifmanpackett]

This bug is for crash report bp-6b513d16-91f3-49bf-bedb-91c8c0200106.

Top 10 frames of crashing thread:

0 mozglue.dll arena_t::DallocSmall memory/build/mozjemalloc.cpp:3257
1 mozglue.dll arena_dalloc memory/build/mozjemalloc.cpp:3341
2 mozglue.dll replace_free memory/replace/phc/PHC.cpp:1101
3 xul.dll nsStyleDisplay::~nsStyleDisplay layout/style/nsStyleStruct.cpp:2784
4 xul.dll servo_arc::Arc<style::gecko_bindings::structs::root::mozilla::GeckoDisplay>::drop_slow<style::gecko_bindings::structs::root::mozilla::GeckoDisplay> servo/components/servo_arc/lib.rs:357
5 xul.dll servo_arc::Arc<style::gecko_properties::ComputedValues>::drop_slow<style::gecko_properties::ComputedValues> servo/components/servo_arc/lib.rs:357
6 xul.dll static mozilla::RestyleManager::ClearServoDataFromSubtree layout/base/RestyleManager.cpp:2316
7 xul.dll mozilla::RestyleManager::ContentRemoved layout/base/RestyleManager.cpp:376
8 xul.dll mozilla::PresShell::ContentRemoved layout/base/PresShell.cpp:4325
9 xul.dll static mozilla::dom::MutationObservers::NotifyContentRemoved dom/base/MutationObservers.cpp:215

Tab crashed in google Maps when trying to open Your Places > Open in My Maps.

Comment 1

[BugBot [:suhaib / :marco/ :calixte]]

The priority flag is not set for this bug.
:Dolske, could you have a look please?

For more information, please visit auto_nag documentation.

Comment 2

[Emilio Cobos Álvarez [:emilio]]

I couldn't repro this, does it reproducibly crash for you?

Mike, this is hitting this assertion in the allocator, may it be a PHC-related bug? I had never seen that one, and I haven't seen such a stack.

Comment 3

[Mike Hommey [:glandium]]

Seems like a (rare) case of double-free where the allocation used to be in a run that became empty and was reused for a different run for a different size class.

Comment 4

[Emilio Cobos Álvarez [:emilio]]

Hmm, so there aren't that many heap allocations hanging off nsStyleDisplay. Some of them like nsStyleAutoArray and such... Bug 1607049 introduced some more but that patch isn't in the build from comment 0...

Comment 5

[Emilio Cobos Álvarez [:emilio]]

Yeah, I don't see anything obviously wrong with nsStyleAutoArray and such, so pretty hard to investigate :/

Comment 6

[BugBot [:suhaib / :marco/ :calixte]]

Closing because no crashes reported for 12 weeks.