1028483 - Intermittent leak in XML parser

Status: NEW

(Core :: XML, defect)

Description

[Andrew McCreight [:mccr8]]

Direct leak of 40 byte(s) in 1 object(s) allocated from:
   #0 0x471d41 in malloc /builds/slave/moz-toolchain/src/llvm/projects/compiler-rt/lib/asan/asan_malloc_linux.cc:74
  #1 0x7f03fd1b024f in processInternalEntity /builds/slave/m-in-l64-asan-0000000000000000/build/parser/expat/lib/xmlparse.c:4825
  #2 0x7f03fd1b6801 in doContent /builds/slave/m-in-l64-asan-0000000000000000/build/parser/expat/lib/xmlparse.c:2306
  #3 0x7f03fd1b05ad in processInternalEntity /builds/slave/m-in-l64-asan-0000000000000000/build/parser/expat/lib/xmlparse.c:4849
  #4 0x7f03fd1b6801 in doContent /builds/slave/m-in-l64-asan-0000000000000000/build/parser/expat/lib/xmlparse.c:2306

Comment 1

[Andrew McCreight [:mccr8]]

Ooo the first intermittent LSan failure.

Comment 2

[Legacy TBPL/Treeherder Robot]

mccr8
https://tbpl.mozilla.org/php/getParsedLog.php?id=42236523&tree=Mozilla-Inbound
Ubuntu ASAN VM 12.04 x64 mozilla-inbound opt test mochitest-browser-chrome-3 on 2014-06-22 15:51:54
revision: cd60dcd19847
slave: tst-linux64-spot-671

SUMMARY: AddressSanitizer: SEGV /builds/slave/m-in-l64-asan-0000000000000000/build/js/src/ctypes/typedefs.h:78 js::ctypes::ConvertToJS(JSContext*, JS::Handle<JSObject*>, JS::Handle<JSObject*>, void*, bool, bool, JS::Value*)
SUMMARY: AddressSanitizer: SEGV /builds/slave/m-in-l64-asan-0000000000000000/build/js/src/ctypes/typedefs.h:78 js::ctypes::ConvertToJS(JSContext*, JS::Handle<JSObject*>, JS::Handle<JSObject*>, void*, bool, bool, JS::Value*)
SUMMARY: AddressSanitizer: 40 byte(s) leaked in 1 allocation(s).
TEST-UNEXPECTED-FAIL | LeakSanitizer | leak at processInternalEntity, doContent, processInternalEntity, doContent

Comment 3

[Andrew McCreight [:mccr8]]

This seems to happen fairly often (3 times since LSan landed), and we probably don't care a huge amount about an XML parser leak, so I think I'll land a suppression for it and then turn this into a bug for fixing the leak.  Annoying the sheriffs has no value.  The stack in comment 0 is all the information we have.

Comment 4

[Legacy TBPL/Treeherder Robot]

Tomcat
https://tbpl.mozilla.org/php/getParsedLog.php?id=42261504&tree=Mozilla-Inbound
Ubuntu ASAN VM 12.04 x64 mozilla-inbound opt test mochitest-browser-chrome-3 on 2014-06-23 05:23:09
revision: 6ddc7aee37eb
slave: tst-linux64-spot-345

ImportError: No module named pygtk
SUMMARY: AddressSanitizer: SEGV /builds/slave/m-in-l64-asan-0000000000000000/build/js/src/ctypes/typedefs.h:78 js::ctypes::ConvertToJS(JSContext*, JS::Handle<JSObject*>, JS::Handle<JSObject*>, void*, bool, bool, JS::Value*)
SUMMARY: AddressSanitizer: SEGV /builds/slave/m-in-l64-asan-0000000000000000/build/js/src/ctypes/typedefs.h:78 js::ctypes::ConvertToJS(JSContext*, JS::Handle<JSObject*>, JS::Handle<JSObject*>, void*, bool, bool, JS::Value*)
SUMMARY: AddressSanitizer: 40 byte(s) leaked in 1 allocation(s).
TEST-UNEXPECTED-FAIL | LeakSanitizer | leak at processInternalEntity, doContent, processInternalEntity, doContent

Comment 5

[Legacy TBPL/Treeherder Robot]

edmorley
https://tbpl.mozilla.org/php/getParsedLog.php?id=42266264&tree=Mozilla-Inbound
Ubuntu ASAN VM 12.04 x64 mozilla-inbound opt test mochitest-browser-chrome-3 on 2014-06-23 07:00:18
revision: 6aade5365ee1
slave: tst-linux64-spot-575

SUMMARY: AddressSanitizer: SEGV /builds/slave/m-in-l64-asan-0000000000000000/build/js/src/ctypes/typedefs.h:78 js::ctypes::ConvertToJS(JSContext*, JS::Handle<JSObject*>, JS::Handle<JSObject*>, void*, bool, bool, JS::Value*)
SUMMARY: AddressSanitizer: SEGV /builds/slave/m-in-l64-asan-0000000000000000/build/js/src/ctypes/typedefs.h:78 js::ctypes::ConvertToJS(JSContext*, JS::Handle<JSObject*>, JS::Handle<JSObject*>, void*, bool, bool, JS::Value*)
SUMMARY: AddressSanitizer: 40 byte(s) leaked in 1 allocation(s).
TEST-UNEXPECTED-FAIL | LeakSanitizer | leak at processInternalEntity, doContent, processInternalEntity, doContent

Comment 6

[Legacy TBPL/Treeherder Robot]

edmorley
https://tbpl.mozilla.org/php/getParsedLog.php?id=42274248&tree=Mozilla-Inbound
Ubuntu ASAN VM 12.04 x64 mozilla-inbound opt test mochitest-browser-chrome-3 on 2014-06-23 08:58:59
revision: a43d41c1645a
slave: tst-linux64-spot-926

ImportError: No module named pygtk
SUMMARY: AddressSanitizer: SEGV /builds/slave/m-in-l64-asan-0000000000000000/build/js/src/ctypes/typedefs.h:78 js::ctypes::ConvertToJS(JSContext*, JS::Handle<JSObject*>, JS::Handle<JSObject*>, void*, bool, bool, JS::Value*)
SUMMARY: AddressSanitizer: SEGV /builds/slave/m-in-l64-asan-0000000000000000/build/js/src/ctypes/typedefs.h:78 js::ctypes::ConvertToJS(JSContext*, JS::Handle<JSObject*>, JS::Handle<JSObject*>, void*, bool, bool, JS::Value*)
SUMMARY: AddressSanitizer: 40 byte(s) leaked in 1 allocation(s).
TEST-UNEXPECTED-FAIL | LeakSanitizer | leak at processInternalEntity, doContent, processInternalEntity, doContent

Comment 7

[Legacy TBPL/Treeherder Robot]

KWierso
https://tbpl.mozilla.org/php/getParsedLog.php?id=42308069&tree=Mozilla-Inbound
Ubuntu ASAN VM 12.04 x64 mozilla-inbound opt test mochitest-browser-chrome-3 on 2014-06-23 16:40:29
revision: 64f5e84e9985
slave: tst-linux64-spot-809

SUMMARY: AddressSanitizer: SEGV /builds/slave/m-in-l64-asan-0000000000000000/build/js/src/ctypes/typedefs.h:78 js::ctypes::ConvertToJS(JSContext*, JS::Handle<JSObject*>, JS::Handle<JSObject*>, void*, bool, bool, JS::Value*)
SUMMARY: AddressSanitizer: SEGV /builds/slave/m-in-l64-asan-0000000000000000/build/js/src/ctypes/typedefs.h:78 js::ctypes::ConvertToJS(JSContext*, JS::Handle<JSObject*>, JS::Handle<JSObject*>, void*, bool, bool, JS::Value*)
SUMMARY: AddressSanitizer: 40 byte(s) leaked in 1 allocation(s).
TEST-UNEXPECTED-FAIL | LeakSanitizer | leak at processInternalEntity, doContent, processInternalEntity, doContent

Comment 8

[Legacy TBPL/Treeherder Robot]

jimb
https://tbpl.mozilla.org/php/getParsedLog.php?id=42307777&tree=Try
Ubuntu ASAN VM 12.04 x64 try opt test mochitest-browser-chrome-3 on 2014-06-23 16:26:08
revision: be42f71f9b80
slave: tst-linux64-spot-593

SUMMARY: AddressSanitizer: SEGV /builds/slave/try-l64-asan-00000000000000000/build/js/src/ctypes/typedefs.h:78 js::ctypes::ConvertToJS(JSContext*, JS::Handle<JSObject*>, JS::Handle<JSObject*>, void*, bool, bool, JS::Value*)
SUMMARY: AddressSanitizer: SEGV /builds/slave/try-l64-asan-00000000000000000/build/js/src/ctypes/typedefs.h:78 js::ctypes::ConvertToJS(JSContext*, JS::Handle<JSObject*>, JS::Handle<JSObject*>, void*, bool, bool, JS::Value*)
SUMMARY: AddressSanitizer: 40 byte(s) leaked in 1 allocation(s).
TEST-UNEXPECTED-FAIL | LeakSanitizer | leak at processInternalEntity, doContent, processInternalEntity, doContent

Comment 9

[Legacy TBPL/Treeherder Robot]

Tomcat
https://tbpl.mozilla.org/php/getParsedLog.php?id=42331091&tree=Fx-Team
Ubuntu ASAN VM 12.04 x64 fx-team opt test mochitest-browser-chrome-3 on 2014-06-23 23:29:29
revision: 577642baa9bf
slave: tst-linux64-spot-419

SUMMARY: AddressSanitizer: SEGV /builds/slave/fx-team-l64-asan-0000000000000/build/js/src/ctypes/typedefs.h:78 js::ctypes::ConvertToJS(JSContext*, JS::Handle<JSObject*>, JS::Handle<JSObject*>, void*, bool, bool, JS::Value*)
SUMMARY: AddressSanitizer: SEGV /builds/slave/fx-team-l64-asan-0000000000000/build/js/src/ctypes/typedefs.h:78 js::ctypes::ConvertToJS(JSContext*, JS::Handle<JSObject*>, JS::Handle<JSObject*>, void*, bool, bool, JS::Value*)
SUMMARY: AddressSanitizer: 40 byte(s) leaked in 1 allocation(s).
TEST-UNEXPECTED-FAIL | LeakSanitizer | leak at processInternalEntity, doContent, processInternalEntity, doContent

Comment 10

[Legacy TBPL/Treeherder Robot]

Tomcat
https://tbpl.mozilla.org/php/getParsedLog.php?id=42322034&tree=Fx-Team
Ubuntu ASAN VM 12.04 x64 fx-team opt test mochitest-browser-chrome-3 on 2014-06-23 20:05:43
revision: cc4602e0c1d8
slave: tst-linux64-spot-414

ImportError: No module named pygtk
SUMMARY: AddressSanitizer: SEGV /builds/slave/fx-team-l64-asan-0000000000000/build/js/src/ctypes/typedefs.h:78 js::ctypes::ConvertToJS(JSContext*, JS::Handle<JSObject*>, JS::Handle<JSObject*>, void*, bool, bool, JS::Value*)
SUMMARY: AddressSanitizer: SEGV /builds/slave/fx-team-l64-asan-0000000000000/build/js/src/ctypes/typedefs.h:78 js::ctypes::ConvertToJS(JSContext*, JS::Handle<JSObject*>, JS::Handle<JSObject*>, void*, bool, bool, JS::Value*)
SUMMARY: AddressSanitizer: 40 byte(s) leaked in 1 allocation(s).
TEST-UNEXPECTED-FAIL | LeakSanitizer | leak at processInternalEntity, doContent, processInternalEntity, doContent

Comment 11

[Legacy TBPL/Treeherder Robot]

edmorley
https://tbpl.mozilla.org/php/getParsedLog.php?id=42360566&tree=Fx-Team
Ubuntu ASAN VM 12.04 x64 fx-team opt test mochitest-browser-chrome-3 on 2014-06-24 07:47:17
revision: 461021ed6301
slave: tst-linux64-spot-524

SUMMARY: AddressSanitizer: SEGV /builds/slave/fx-team-l64-asan-0000000000000/build/js/src/ctypes/typedefs.h:78 js::ctypes::ConvertToJS(JSContext*, JS::Handle<JSObject*>, JS::Handle<JSObject*>, void*, bool, bool, JS::Value*)
SUMMARY: AddressSanitizer: SEGV /builds/slave/fx-team-l64-asan-0000000000000/build/js/src/ctypes/typedefs.h:78 js::ctypes::ConvertToJS(JSContext*, JS::Handle<JSObject*>, JS::Handle<JSObject*>, void*, bool, bool, JS::Value*)
SUMMARY: AddressSanitizer: 40 byte(s) leaked in 1 allocation(s).
TEST-UNEXPECTED-FAIL | LeakSanitizer | leak at processInternalEntity, doContent, processInternalEntity, doContent

Comment 12

[Legacy TBPL/Treeherder Robot]

Tomcat
https://tbpl.mozilla.org/php/getParsedLog.php?id=43136307&tree=Mozilla-Inbound
Ubuntu ASAN VM 12.04 x64 mozilla-inbound opt test mochitest-3 on 2014-07-04 05:48:53
revision: c64e89d42f6c
slave: tst-linux64-spot-870

SUMMARY: AddressSanitizer: 720 byte(s) leaked in 18 allocation(s).
TEST-UNEXPECTED-FAIL | LeakSanitizer | leak at DeferNPObjectLastRelease, mozilla::plugins::DeferNPVariantLastRelease, mozilla::plugins::PluginScriptableObjectChild::AnswerInvoke, mozilla::plugins::PPluginScriptableObjectChild::OnCallReceived

Comment 13

[Andrew McCreight [:mccr8]]

The last one is a new leak.  I filed bug 1034602 for it.

I'm removing the intermittent failure tag from this, as it shouldn't happen any more due to a suppression, but there's still a leak that could in theory be fixed.

Comment 14

[Jon Coppeard (:jonco)]

Some instances of this are getting annotated as bug 1166041.

Comment 15

[Ryan VanderMeulen [:RyanVM]]

FYI, I did a recent Try push with this suppression removed and all the occurrence I hit were in toolkit/components/thumbnails, in case that helps pin down where the problem is.