1827549 - AllocInfo::GetInChunk should be added to the signature prefix list

Status: NEW

(Socorro :: Signature, task)

Description

[Paul Bone [:pbone]]

AllocInfo::GetInChunk can crash for double-frees but causes many different causes of double-frees to be grouped together.

https://crash-stats.mozilla.org/search/?signature=~GetInChunk&date=%3E%3D2023-04-04T04%3A28%3A00.000Z&date=%3C2023-04-11T04%3A28%3A00.000Z&_facets=signature&_sort=-date&_columns=date&_columns=signature&_columns=product&_columns=version&_columns=build_id&_columns=platform#facet-signature

Comment 1

[Gabriele Svelto [:gsvelto]]

While looking at this signatures I noticed something problematic: because several frames are inlined the signatures are highly unstable. If we prefix one frame the next one might be different between builds and architectures, so what is a single stack ends up under different signatures because of this. Given these are specifically double-frees I wonder if we might do something more radical here, like flagging these crashes as double-frees and adjusting the signature generation code to skip all the memory allocator frames up until the code which called free() (which is what we care about). Always ignoring all the memory allocator frames is also possible but would make us blind to allocator-specific crashes in the future.

Comment 2

[Will Kahn-Greene [:willkg] ET needinfo? me]

This is definitely possible. Can someone pick a couple of example crash reports and provide their desired crash signatures?