1881372 - Crash in [@ RedBlackTree<T>::TreeNode::SetLeft]

Status: NEW

(Core :: Memory Allocator, defect)

Description

[BugBot [:suhaib / :marco/ :calixte]]

Crash report: https://crash-stats.mozilla.org/report/index/9695b1d6-530d-48ae-9d26-417310240217

MOZ_CRASH Reason: MOZ_RELEASE_ASSERT(mNode)

Top 10 frames of crashing thread:

0  mozglue.dll  AnnotateMozCrashReason  mfbt/Assertions.h:46
0  mozglue.dll  RedBlackTree<arena_chunk_t, ArenaDirtyChunkTrait>::TreeNode::SetLeft  memory/build/rb.h:160
0  mozglue.dll  RedBlackTree<arena_chunk_t, ArenaDirtyChunkTrait>::RotateLeft  memory/build/rb.h:557
0  mozglue.dll  RedBlackTree<arena_chunk_t, ArenaDirtyChunkTrait>::Remove  memory/build/rb.h:447
0  mozglue.dll  RedBlackTree<arena_chunk_t, ArenaDirtyChunkTrait>::Remove  memory/build/rb.h:137
0  mozglue.dll  arena_t::SplitRun  memory/build/mozjemalloc.cpp:2692
0  mozglue.dll  arena_t::AllocRun  memory/build/mozjemalloc.cpp:2830
0  mozglue.dll  arena_t::MallocLarge  memory/build/mozjemalloc.cpp:3313
0  mozglue.dll  arena_t::Malloc  memory/build/mozjemalloc.cpp:3335
0  mozglue.dll  BaseAllocator::malloc  memory/build/mozjemalloc.cpp:4551

By querying Nightly crashes reported within the last 2 months, here are some insights about the signature:

• First crash report: 2024-02-17
• Process type: Content
• Is startup crash: No
• Has user comments: No
• Is null crash: Yes - 1 out of 2 crashes happened on null or near null memory address

Comment 1

[BugBot [:suhaib / :marco/ :calixte]]

The Bugbug bot thinks this bug should belong to the 'Core::Memory Allocator' component, and is moving the bug to that component. Please correct in case you think the bot is wrong.

Comment 2

[BugBot [:suhaib / :marco/ :calixte]]

The severity field is not set for this bug.
:glandium, could you have a look please?

For more information, please visit BugBot documentation.