Mismatched free() / delete / delete [] in webrtc::VoiceEngineImpl::Release()

RESOLVED INVALID

Status

()

defect
RESOLVED INVALID
5 years ago
5 years ago

People

(Reporter: mitchwharper, Unassigned)

Tracking

({valgrind})

34 Branch
x86_64
Windows 8
Points:
---

Firefox Tracking Flags

(Not tracked)

Details

Reporter

Description

5 years ago
User Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; rv:34.0) Gecko/20100101 Firefox/34.0
Build ID: 20141126041045



Actual results:

==6262== Mismatched free() / delete / delete []
==6262==    at 0x4C2BDEC: free (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==6262==    by 0x40334D8: moz_free (mozalloc.cpp:46)
==6262==    by 0x9269457: std::_Rb_tree<void*, std::pair<void* const, webrtc::Config::BaseOption*>, std::_Select1st<std::pair<void* const, webrtc::Config::BaseOption*> >, std::less<void*>, std::allocator<std::pair<void* const, webrtc::Config::BaseOption*> > >::_M_erase(std::_Rb_tree_node<std::pair<void* const, webrtc::Config::BaseOption*> >*) (new_allocator.h:110)
==6262==    by 0x976A26E: webrtc::VoiceEngineImpl::~VoiceEngineImpl() (stl_tree.h:671)
==6262==    by 0x976997E: webrtc::VoiceEngineImpl::Release() (voice_engine_impl.cc:75)
==6262==    by 0x9769D6A: webrtc::VoiceEngine::Delete(webrtc::VoiceEngine*&) (voice_engine_impl.cc:138)
==6262==    by 0x84512DF: mozilla::WebrtcAudioConduit::~WebrtcAudioConduit() (AudioConduit.cpp:124)
==6262==    by 0x845139A: mozilla::WebrtcAudioConduit::~WebrtcAudioConduit() (AudioConduit.cpp:127)
==6262==    by 0x846584D: mozilla::ConduitDeleteEvent::~ConduitDeleteEvent() (MediaConduitInterface.h:197)
==6262==    by 0x7DCC37E: nsRunnable::Release() (nsThreadUtils.cpp:32)
==6262==    by 0x7DB34C9: nsThread::ProcessNextEvent(bool, bool*) (nsCOMPtr.h:427)
==6262==    by 0x7DCC81B: NS_ProcessNextEvent(nsIThread*, bool) (nsThreadUtils.cpp:265)
==6262==  Address 0x232e1e30 is 0 bytes inside a block of size 48 alloc'd
==6262==    at 0x4C2B0E0: operator new(unsigned long) (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==6262==    by 0x976A49D: void webrtc::Config::Set<webrtc::AudioCodingModuleFactory>(webrtc::AudioCodingModuleFactory*) (new_allocator.h:104)
==6262==    by 0x9769DFD: webrtc::VoiceEngine::Create() (voice_engine_impl.cc:83)
==6262==    by 0x844F24D: mozilla::WebrtcAudioConduit::Init(mozilla::WebrtcAudioConduit*) (AudioConduit.cpp:227)
==6262==    by 0x844F6A3: mozilla::AudioSessionConduit::Create(mozilla::AudioSessionConduit*) (AudioConduit.cpp:50)
==6262==    by 0x845AE9F: vcmRxStartICE (VcmSIPCCBinding.cpp:1258)
==6262==    by 0x83BB967: lsm_rx_start (lsm.c:1018)
==6262==    by 0x83BC9B0: lsm_update_media (lsm.c:3804)
==6262==    by 0x83BE863: cc_call_state (lsm.c:3850)
==6262==    by 0x839ECC2: fsmdef_ev_setremotedesc (fsmdef.c:3735)
==6262==    by 0x83C04BF: sm_process_event (sm.c:48)
==6262==    by 0x83929EE: fim_process_event (fim.c:651)

Updated

5 years ago
Component: Untriaged → WebRTC
Product: Firefox → Core
Keywords: valgrind
Reporter

Comment 1

5 years ago
Reproducible in Firefox 37
Invalid, caused by differential inlining of new vs delete.
Please use --show-mismatched-frees=no for the time being.
Status: UNCONFIRMED → RESOLVED
Closed: 5 years ago
Resolution: --- → INVALID
Group: core-security
You need to log in before you can comment on or make changes to this bug.