1740203 - Crash in [@ RtlpHpLfhSubsegmentFreeBlock | RtlpFreeHeapInternal | RtlpHpFreeWithExceptionProtection | RtlFreeHeap | free_base | std::_Tree_val<T>::_Erase_tree<T>]

Status: RESOLVED FIXED

(Firefox :: Installer, defect)

Description

[Catalin Sasca, Desktop Test Engineering [:csasca]]

Crash report: https://crash-stats.mozilla.org/report/index/3d1114ca-5b45-4e6b-9565-6dad50211109

Reason: STATUS_HEAP_CORRUPTION

Top 10 frames of crashing thread:

0 ntdll.dll RtlReportFatalFailure 
1 ntdll.dll RtlReportCriticalFailure 
2 ntdll.dll RtlpHeapHandleError 
3 ntdll.dll RtlpHpHeapHandleError 
4 ntdll.dll RtlpLogHeapFailure 
5 ntdll.dll RtlpHpLfhSubsegmentFreeBlock 
6 ntdll.dll RtlpFreeHeapInternal 
7 ntdll.dll RtlpHpFreeWithExceptionProtection 
8 ntdll.dll RtlFreeHeap 
9 nvdahelperremote.dll free_base minkernel\crts\ucrt\src\appcrt\heap\free_base.cpp:105

[Platforms Affected]

• Windows 11

[Builds Affected]

• Firefox 95.0b5
• Firefox 96.0a1 (no crashes occurred only some hangs ~2 seconds)

[Steps to Reproduce]

• See the steps from Bug 1736742 (crash occurred while verifying the fixed builds on the wikipedia page)

[Notes]

• Here is an attachment with the hangs, and where this crash occurs aswell (not caught in the gif).
• Feel free to change the component to the right one
• Seems that Firefox 96.0a1 is much more stable than 95.0b5

Comment 1

[Pascal Chevrel (relman team) -> :pascalc]

https://hg.mozilla.org/releases/mozilla-beta/rev/42ccd24f9308

Comment 2

[Pascal Chevrel (relman team) -> :pascalc]

Bug fixed in beta by the backout in https://bugzilla.mozilla.org/show_bug.cgi?id=1736742#c36

Comment 3

[Ryan VanderMeulen [:RyanVM]]

Reopening based on https://bugzilla.mozilla.org/show_bug.cgi?id=1736742#c37 - this is going to affect 96 when it rides to Beta also.

Comment 4

[[e-mail] (:bhearsum)]

(In reply to Ryan VanderMeulen [:RyanVM] from comment #3)

Reopening based on https://bugzilla.mozilla.org/show_bug.cgi?id=1736742#c37 - this is going to affect 96 when it rides to Beta also.

That bug has now been re-fixed, and verified for 96. Should we close this again?

Comment 5

[Ryan VanderMeulen [:RyanVM]]

Yes indeed!