1881372 - Crash in [@ RedBlackTree<T>::TreeNode::SetLeft]

Status: NEW

(Core :: Memory Allocator, defect)

Description

[BugBot [:suhaib / :marco/ :calixte]]

Crash report: https://crash-stats.mozilla.org/report/index/9695b1d6-530d-48ae-9d26-417310240217

MOZ_CRASH Reason: MOZ_RELEASE_ASSERT(mNode)

Top 10 frames of crashing thread:

0  mozglue.dll  AnnotateMozCrashReason  mfbt/Assertions.h:46
0  mozglue.dll  RedBlackTree<arena_chunk_t, ArenaDirtyChunkTrait>::TreeNode::SetLeft  memory/build/rb.h:160
0  mozglue.dll  RedBlackTree<arena_chunk_t, ArenaDirtyChunkTrait>::RotateLeft  memory/build/rb.h:557
0  mozglue.dll  RedBlackTree<arena_chunk_t, ArenaDirtyChunkTrait>::Remove  memory/build/rb.h:447
0  mozglue.dll  RedBlackTree<arena_chunk_t, ArenaDirtyChunkTrait>::Remove  memory/build/rb.h:137
0  mozglue.dll  arena_t::SplitRun  memory/build/mozjemalloc.cpp:2692
0  mozglue.dll  arena_t::AllocRun  memory/build/mozjemalloc.cpp:2830
0  mozglue.dll  arena_t::MallocLarge  memory/build/mozjemalloc.cpp:3313
0  mozglue.dll  arena_t::Malloc  memory/build/mozjemalloc.cpp:3335
0  mozglue.dll  BaseAllocator::malloc  memory/build/mozjemalloc.cpp:4551

By querying Nightly crashes reported within the last 2 months, here are some insights about the signature:

• First crash report: 2024-02-17
• Process type: Content
• Is startup crash: No
• Has user comments: No
• Is null crash: Yes - 1 out of 2 crashes happened on null or near null memory address

Comment 1

[BugBot [:suhaib / :marco/ :calixte]]

The Bugbug bot thinks this bug should belong to the 'Core::Memory Allocator' component, and is moving the bug to that component. Please correct in case you think the bot is wrong.

Comment 2

[BugBot [:suhaib / :marco/ :calixte]]

The severity field is not set for this bug.
:glandium, could you have a look please?

For more information, please visit BugBot documentation.

Comment 3

[BugBot [:suhaib / :marco/ :calixte]]

Since the crash volume is low (less than 15 per week), the severity is downgraded to S3. Feel free to change it back if you think the bug is still critical.

For more information, please visit BugBot documentation.