Bug 2403278

Summary: [abrt] firefox: AllocInfo::GetInChunk(): firefox killed by SIGSEGV
Product: [Fedora] Fedora Reporter: Zephyr Lykos <fedora>
Component: firefoxAssignee: Gecko Maintainer <gecko-bugs-nobody>
Status: CLOSED DUPLICATE QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: unspecified Docs Contact:
Priority: unspecified    
Version: rawhideCC: amk, fedora, gecko-bugs-nobody, jhorak, klaas, rstrode, sam, suraj.ghimire7
Target Milestone: ---   
Target Release: ---   
Hardware: x86_64   
OS: Unspecified   
URL: https://retrace.fedoraproject.org/faf/reports/bthash/d48c18a0c1c4f3bf1b4a5354fcbf9ff53a908ac
Whiteboard: abrt_hash:d50d33a00c6b8a39e5414c4f05242f7fff950f8d;VARIANT_ID=workstation;
Fixed In Version: Doc Type: ---
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2025-11-05 16:30:56 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Attachments:
Description Flags
File: proc_pid_status
none
File: maps
none
File: limits
none
File: open_fds
none
File: os_info
none
File: cpuinfo
none
File: core_backtrace
none
File: exploitable
none
File: dso_list
none
File: backtrace
none
File: environ
none
File: repro.html none

Description Zephyr Lykos 2025-10-11 12:07:54 UTC 
Description of problem:
0. (optional, if you want to generate the repro file yourself) pyinstrument -r html -o repro.html [any python script]
1. wget https://fars.ee/ACcO_gDCN6XrzHwLLqv7KwCC6GvP -O repro.html
2. firefox --profile /path/to/fresh/profile ./repro.html
3. see crash

Version-Release number of selected component:
firefox-144.0-1.fc44

Additional info:
reporter:       libreport-2.17.15
type:           CCpp
reason:         firefox killed by SIGSEGV
journald_cursor: s=258c7dd3ac4d4ca08f4b9b29a589d159;i=5ccaff4;b=d83db486936a4627b2b4f4b1f9bb218c;m=2c1ad591b;t=640e01e4c1509;x=8d934f84103aa3cf
executable:     /usr/lib64/firefox/firefox
cmdline:        $'/usr/lib64/firefox/firefox -contentproc -isForBrowser -prefsHandle 0:39576 -prefMapHandle 1:294798 -jsInitHandle 2:224660 -parentBuildID 20251009090546 -sandboxReporter 3 -chrootClient 4 -ipcHandle 5 -initialChannelId {38b6b28d-707f-4b07-b59a-03b00220cba4} -parentPid 92709 -crashReporter 6 -crashHelper 7 -greomni /usr/lib64/firefox/omni.ja -appomni /usr/lib64/firefox/browser/omni.ja -appDir /usr/lib64/firefox/browser 6 tab'
cgroup:         0::/user.slice/user-1000.slice/user/app.slice/app-org.mozilla.firefox.slice/app-org.mozilla.firefox-92709.scope
rootdir:        /proc/92959/fdinfo
uid:            1000
mountinfo:      
kernel:         6.18.0-0.rc0.251009gec714e371f22f.12.fc44.x86_64
package:        firefox-144.0-1.fc44
runlevel:       /bin/sh: line 1: runlevel: command not found
backtrace_rating: 4
crash_function: AllocInfo::GetInChunk

Truncated backtrace:
Thread no. 0 (37 frames)
 #0 AllocInfo::GetInChunk at /usr/src/debug/firefox-144.0-1.fc44.x86_64/memory/build/mozjemalloc.cpp:2932
 #1 arena_dalloc at /usr/src/debug/firefox-144.0-1.fc44.x86_64/memory/build/mozjemalloc.cpp:3190
 #2 BaseAllocator::free at /usr/src/debug/firefox-144.0-1.fc44.x86_64/memory/build/mozjemalloc.cpp:4151
 #3 MozJemalloc::free at /usr/src/debug/firefox-144.0-1.fc44.x86_64/memory/build/malloc_decls.h:63
 #4 PageFree at /usr/src/debug/firefox-144.0-1.fc44.x86_64/memory/build/PHC.cpp:1827
 #5 MozJemallocPHC::free at /usr/src/debug/firefox-144.0-1.fc44.x86_64/memory/build/PHC.cpp:1830
 #6 ReplaceMalloc::free at /usr/src/debug/firefox-144.0-1.fc44.x86_64/memory/build/malloc_decls.h:63
 #7 free at /usr/src/debug/firefox-144.0-1.fc44.x86_64/memory/build/malloc_decls.h:63
 #8 mozilla::detail::FreePolicy<char>::operator() at /usr/src/debug/firefox-144.0-1.fc44.x86_64/objdir/dist/include/mozilla/UniquePtrExtensions.h:93
 #9 std::unique_ptr<char, mozilla::detail::FreePolicy<char> >::~unique_ptr at /usr/include/c++/15/bits/unique_ptr.h:398
 #10 nsTArrayElementTraits<std::unique_ptr<char, mozilla::detail::FreePolicy<char> > >::Destruct at /usr/src/debug/firefox-144.0-1.fc44.x86_64/objdir/dist/include/nsTArray.h:578
 #11 nsTArray_Impl<std::unique_ptr<char, mozilla::detail::FreePolicy<char> >, nsTArrayInfallibleAllocator>::DestructRange at /usr/src/debug/firefox-144.0-1.fc44.x86_64/objdir/dist/include/nsTArray.h:2309
 #12 nsTArray_Impl<std::unique_ptr<char, mozilla::detail::FreePolicy<char> >, nsTArrayInfallibleAllocator>::ClearAndRetainStorage at /usr/src/debug/firefox-144.0-1.fc44.x86_64/objdir/dist/include/nsTArray.h:1362
 #13 nsTArray_Impl<std::unique_ptr<char, mozilla::detail::FreePolicy<char> >, nsTArrayInfallibleAllocator>::~nsTArray_Impl at /usr/src/debug/firefox-144.0-1.fc44.x86_64/objdir/dist/include/nsTArray.h:907
 #14 nsTArray<std::unique_ptr<char, mozilla::detail::FreePolicy<char> > >::~nsTArray at /usr/src/debug/firefox-144.0-1.fc44.x86_64/objdir/dist/include/nsTArray.h:2607
 #15 AutoTArray<std::unique_ptr<char, mozilla::detail::FreePolicy<char> >, 4ul>::~AutoTArray at /usr/src/debug/firefox-144.0-1.fc44.x86_64/objdir/dist/include/nsTArray.h:2907
 #16 nsPipeEvents::~nsPipeEvents at /usr/src/debug/firefox-144.0-1.fc44.x86_64/xpcom/io/nsPipe3.cpp:1178
 #17 nsPipe::OnInputStreamException at /usr/src/debug/firefox-144.0-1.fc44.x86_64/xpcom/io/nsPipe3.cpp:948
 #18 nsPipeInputStream::CloseWithStatus at /usr/src/debug/firefox-144.0-1.fc44.x86_64/xpcom/io/nsPipe3.cpp:1306
 #19 nsPipeInputStream::Close at /usr/src/debug/firefox-144.0-1.fc44.x86_64/xpcom/io/nsPipe3.cpp:1323
 #20 nsPipeInputStream::~nsPipeInputStream at /usr/src/debug/firefox-144.0-1.fc44.x86_64/xpcom/io/nsPipe3.cpp:1576
 #22 nsPipeInputStream::Release at /usr/src/debug/firefox-144.0-1.fc44.x86_64/xpcom/io/nsPipe3.cpp:1185
 #23 mozilla::RefPtrTraits<nsIInputStream>::Release at /usr/src/debug/firefox-144.0-1.fc44.x86_64/objdir/dist/include/mozilla/RefPtr.h:49
 #24 nsCOMPtr<nsIInputStream>::~nsCOMPtr at /usr/src/debug/firefox-144.0-1.fc44.x86_64/objdir/dist/include/nsCOMPtr.h:344
 #25 mozilla::dom::InternalResponse::~InternalResponse at /usr/src/debug/firefox-144.0-1.fc44.x86_64/dom/fetch/InternalResponse.cpp:124
 #26 mozilla::detail::SafeRefCounted<mozilla::dom::InternalResponse, (mozilla::detail::RefCountAtomicity)0>::Release at /usr/src/debug/firefox-144.0-1.fc44.x86_64/objdir/dist/include/mozilla/dom/SafeRefPtr.h:81
 #27 mozilla::RefPtrTraits<mozilla::dom::InternalResponse>::Release at /usr/src/debug/firefox-144.0-1.fc44.x86_64/objdir/dist/include/mozilla/RefPtr.h:49
 #28 mozilla::SafeRefPtr<mozilla::dom::InternalResponse>::ConstRemovingRefPtrTraits<mozilla::dom::InternalResponse>::Release at /usr/src/debug/firefox-144.0-1.fc44.x86_64/objdir/dist/include/mozilla/dom/SafeRefPtr.h:177
 #29 mozilla::SafeRefPtr<mozilla::dom::InternalResponse>::~SafeRefPtr at /usr/src/debug/firefox-144.0-1.fc44.x86_64/objdir/dist/include/mozilla/dom/SafeRefPtr.h:233
 #30 mozilla::dom::InternalResponse::~InternalResponse at /usr/src/debug/firefox-144.0-1.fc44.x86_64/dom/fetch/InternalResponse.cpp:124
 #31 mozilla::detail::SafeRefCounted<mozilla::dom::InternalResponse, (mozilla::detail::RefCountAtomicity)0>::Release at /usr/src/debug/firefox-144.0-1.fc44.x86_64/objdir/dist/include/mozilla/dom/SafeRefPtr.h:81
 #32 mozilla::RefPtrTraits<mozilla::dom::InternalResponse>::Release at /usr/src/debug/firefox-144.0-1.fc44.x86_64/objdir/dist/include/mozilla/RefPtr.h:49
 #33 mozilla::SafeRefPtr<mozilla::dom::InternalResponse>::ConstRemovingRefPtrTraits<mozilla::dom::InternalResponse>::Release at /usr/src/debug/firefox-144.0-1.fc44.x86_64/objdir/dist/include/mozilla/dom/SafeRefPtr.h:177
 #34 mozilla::SafeRefPtr<mozilla::dom::InternalResponse>::~SafeRefPtr at /usr/src/debug/firefox-144.0-1.fc44.x86_64/objdir/dist/include/mozilla/dom/SafeRefPtr.h:233
 #35 mozilla::dom::Response::~Response at /usr/src/debug/firefox-144.0-1.fc44.x86_64/dom/fetch/Response.cpp:72
 #37 SnowWhiteKiller::MaybeKillObject at /usr/src/debug/firefox-144.0-1.fc44.x86_64/xpcom/base/nsCycleCollector.cpp:2645
 #38 SnowWhiteKiller::Visit at /usr/src/debug/firefox-144.0-1.fc44.x86_64/xpcom/base/nsCycleCollector.cpp:2670
Comment 1 Zephyr Lykos 2025-10-11 12:07:57 UTC 
Created attachment 2109353 [details]
File: proc_pid_status
Comment 2 Zephyr Lykos 2025-10-11 12:07:59 UTC 
Created attachment 2109354 [details]
File: maps
Comment 3 Zephyr Lykos 2025-10-11 12:08:00 UTC 
Created attachment 2109355 [details]
File: limits
Comment 4 Zephyr Lykos 2025-10-11 12:08:01 UTC 
Created attachment 2109356 [details]
File: open_fds
Comment 5 Zephyr Lykos 2025-10-11 12:08:03 UTC 
Created attachment 2109357 [details]
File: os_info
Comment 6 Zephyr Lykos 2025-10-11 12:08:04 UTC 
Created attachment 2109358 [details]
File: cpuinfo
Comment 7 Zephyr Lykos 2025-10-11 12:08:05 UTC 
Created attachment 2109359 [details]
File: core_backtrace
Comment 8 Zephyr Lykos 2025-10-11 12:08:06 UTC 
Created attachment 2109360 [details]
File: exploitable
Comment 9 Zephyr Lykos 2025-10-11 12:08:07 UTC 
Created attachment 2109361 [details]
File: dso_list
Comment 10 Zephyr Lykos 2025-10-11 12:08:08 UTC 
Created attachment 2109362 [details]
File: backtrace
Comment 11 Zephyr Lykos 2025-10-11 12:08:09 UTC 
Created attachment 2109363 [details]
File: environ
Comment 12 Zephyr Lykos 2025-10-11 12:08:11 UTC 
Created attachment 2109364 [details]
File: repro.html
Comment 13 Zephyr Lykos 2025-11-05 16:30:56 UTC 

*** This bug has been marked as a duplicate of bug 2403275 ***