1893563 - Crash in [@ mozilla::LinkedListElement<T>::remove]

Status: RESOLVED INCOMPLETE

(Core :: MFBT, defect)

Description

[BugBot [:suhaib / :marco/ :calixte]]

Crash report: https://crash-stats.mozilla.org/report/index/41501ce0-8cb0-496e-b61c-793670240419

Reason: SIGSEGV / SEGV_MAPERR

Top 10 frames of crashing thread:

0  libxul.so  mozilla::LinkedListElement<RefPtr<mozilla::dom::Timeout> >::remove  mfbt/LinkedList.h:244
0  libxul.so  mozilla::LinkedListElement<RefPtr<mozilla::dom::Timeout> >::~LinkedListElement  mfbt/LinkedList.h:200
0  libxul.so  mozilla::dom::Timeout::~Timeout  dom/base/Timeout.h:138
0  libxul.so  mozilla::dom::Timeout::DeleteCycleCollectable  dom/base/Timeout.h:30
0  libxul.so  mozilla::dom::Timeout::cycleCollection::DeleteCycleCollectable  dom/base/Timeout.h:30
1  libxul.so  SnowWhiteKiller::MaybeKillObject  xpcom/base/nsCycleCollector.cpp:2512
1  libxul.so  SnowWhiteKiller::~SnowWhiteKiller  xpcom/base/nsCycleCollector.cpp:2499
2  libxul.so  RemoveSkippableVisitor::~RemoveSkippableVisitor  xpcom/base/nsCycleCollector.cpp:2620
2  libxul.so  nsPurpleBuffer::RemoveSkippable  xpcom/base/nsCycleCollector.cpp:2667
2  libxul.so  nsCycleCollector::ForgetSkippable  xpcom/base/nsCycleCollector.cpp:2729

By querying Nightly crashes reported within the last 2 months, here are some insights about the signature:

• First crash report: 2024-04-09
• Process type: Multiple distinct types
• Is startup crash: No
• Has user comments: No
• Is null crash: Yes - 1 out of 3 crashes happened on null or near null memory address

Comment 1

[Jens Stutte [:jstutte]]

Could this be related to bug 1615564 ? Otherwise: Could you suggest a good component for investigation ?

Comment 2

[Andrew McCreight [:mccr8]]

We have so many users of LinkedListElement that this signature is useless. Splitting these crashes by proto signature, these crashes are all over the place. If the volume wasn't trivial, the first step would be to add this to the prefix list on Socorro, but let's just close this. Also, we usually move generic data structure signatures to the component for the data structure.