1883167 - Crash in [@ arena_t::DallocSmall | arena_dalloc | BaseAllocator::free | MozJemalloc::free | PageFree]

Status: NEW

(Core :: Memory Allocator, defect)

Description

[BugBot [:suhaib / :marco/ :calixte]]

Crash report: https://crash-stats.mozilla.org/report/index/8b554cc9-c6eb-430c-bf41-ffa130240229

Reason: EXCEPTION_ACCESS_VIOLATION_WRITE

Top 10 frames of crashing thread:

0  mozglue.dll  arena_t::DallocSmall  memory/build/mozjemalloc.cpp:3740
0  mozglue.dll  arena_dalloc  memory/build/mozjemalloc.cpp:3813
0  mozglue.dll  BaseAllocator::free  memory/build/mozjemalloc.cpp:4639
0  mozglue.dll  MozJemalloc::free  memory/build/malloc_decls.h:54
0  mozglue.dll  PageFree  memory/build/PHC.cpp:1548
0  mozglue.dll  MozJemallocPHC::free  memory/build/PHC.cpp:1553
0  mozglue.dll  ReplaceMalloc::free  memory/build/malloc_decls.h:54
0  mozglue.dll  je_free  memory/build/malloc_decls.h:54
1  xul.dll  operator delete  memory/mozalloc/cxxalloc.h:51
1  xul.dll  mozilla::MozPromise<RefPtr<mozilla::MediaTrackDemuxer::SamplesHolder>, mozilla::MediaResult, 1>::Private::~Private  xpcom/threads/MozPromise.h:257

By querying Nightly crashes reported within the last 2 months, here are some insights about the signature:

• First crash report: 2024-01-12
• Process type: Multiple distinct types
• Is startup crash: No
• Has user comments: No
• Is null crash: Yes - 3 out of 4 crashes happened on null or near null memory address

Comment 1

[BugBot [:suhaib / :marco/ :calixte]]

The Bugbug bot thinks this bug should belong to the 'Core::Memory Allocator' component, and is moving the bug to that component. Please correct in case you think the bot is wrong.

Comment 2

[BugBot [:suhaib / :marco/ :calixte]]

The severity field is not set for this bug.
:glandium, could you have a look please?

For more information, please visit BugBot documentation.

Comment 3

[Andrew McCreight [:mccr8]]

The volume is pretty low here. This signature is also bad.