1855806 - Crash in [@ arena_run_reg_dalloc | arena_t::DallocSmall | arena_dalloc | idalloc]

Status: NEW

(Firefox for Android :: General, defect)

Description

[mobilogicw50]

Crash report: https://crash-stats.mozilla.org/report/index/dab4eca5-7d4f-4821-be29-77cc70230927

MOZ_CRASH Reason: MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)

Top 10 frames of crashing thread:

0  libmozglue.so  arena_run_reg_dalloc  memory/build/mozjemalloc.cpp:2578
0  libmozglue.so  arena_t::DallocSmall  memory/build/mozjemalloc.cpp:3713
0  libmozglue.so  arena_dalloc  memory/build/mozjemalloc.cpp:3809
1  libmozglue.so  idalloc  memory/build/mozjemalloc.cpp:3828
1  libmozglue.so  arena_t::RallocSmallOrLarge  memory/build/mozjemalloc.cpp:3925
1  libmozglue.so  arena_t::Ralloc  memory/build/mozjemalloc.cpp:3934
1  libmozglue.so  BaseAllocator::realloc  memory/build/mozjemalloc.cpp:4611
2  libmozglue.so  Allocator<MozJemallocBase>::realloc  memory/build/malloc_decls.h:53
3  libmozglue.so  moz_xrealloc  memory/mozalloc/mozalloc.cpp:72
4  libxul.so  nsTArrayInfallibleAllocator::Realloc  xpcom/ds/nsTArray.h:259

Comment 1

[BugBot [:suhaib / :marco/ :calixte]]

The bug has a crash signature, thus the bug will be considered confirmed.

Comment 2

[BugBot [:suhaib / :marco/ :calixte]]

The severity field is not set for this bug.
:jonalmeida, could you have a look please?

For more information, please visit BugBot documentation.