1909775 - Crash in [@ arena_t::DallocLarge | arena_dalloc | BaseAllocator::free | MozJemalloc::free | PageFree]

Status: NEW

(Core :: Memory Allocator, defect)

Description

[BugBot [:suhaib / :marco/ :calixte]]

Crash report: https://crash-stats.mozilla.org/report/index/98ae8c0e-0b92-47fd-8fce-087730240724

MOZ_CRASH Reason: MOZ_DIAGNOSTIC_ASSERT((uintptr_t(aPtr) & gPageSizeMask) == 0)

Top 10 frames of crashing thread:

0  mozglue.dll  arena_t::DallocLarge  memory/build/mozjemalloc.cpp:3948
0  mozglue.dll  arena_dalloc  memory/build/mozjemalloc.cpp:3991
0  mozglue.dll  BaseAllocator::free  memory/build/mozjemalloc.cpp:4816
0  mozglue.dll  MozJemalloc::free  memory/build/malloc_decls.h:54
0  mozglue.dll  PageFree  memory/build/PHC.cpp:1793
0  mozglue.dll  MozJemallocPHC::free  memory/build/PHC.cpp:1797
0  mozglue.dll  ReplaceMalloc::free  memory/build/malloc_decls.h:54
0  mozglue.dll  je_free  memory/build/malloc_decls.h:54
1  xul.dll  nsTArrayInfallibleAllocator::Free  xpcom/ds/nsTArray.h:261
1  xul.dll  nsTArray_base<nsTArrayInfallibleAllocator, nsTArray_RelocateUsingMemutils>::~nsTArray_base  xpcom/ds/nsTArray-inl.h:34

By querying Nightly crashes reported within the last 2 months, here are some insights about the signature:

• First crash report: 2024-05-25
• Process type: Multiple distinct types
• Is startup crash: No
• Has user comments: No
• Is null crash: Yes - 1 out of 4 crashes happened on null or near null memory address

Comment 1

[BugBot [:suhaib / :marco/ :calixte]]

The Bugbug bot thinks this bug should belong to the 'Core::Memory Allocator' component, and is moving the bug to that component. Please correct in case you think the bot is wrong.