1359097 - AddressSanitizer: heap-use-after-free @ mozilla_dump_image

Status: RESOLVED INCOMPLETE

(Core :: Graphics, defect)

Description

[Bob Clary [:bc] (inactive)]

Attachment: asan report

Windows 10 64bit asan opt Nightly build

1. https://www.visual-paradigm.com/download/?platform=windows&arch=64bit

2. ==5800==ERROR: AddressSanitizer: heap-use-after-free on address 0x1216c249d618 at pc 0x7ffef5fa4421 bp 0x00f2a8ffeba0 sp 0x00f2a8ffebe8
READ of size 1 at 0x1216c249d618 thread T0
    #0 0x7ffef5fa4420 in mozilla_dump_image+0x84439c0 (C:\mozilla\builds\nightly-asan\mozilla\firefox-opt\dist\bin\xul.dll+0x18b0b4420)

...

Comment 1

[Andrew McCreight [:mccr8]]

The stacks don't look to be property symbolized. Could you look at fixing that, Bob?

These stacks also look like the bug is happening in mozilla_dump_image, which looks to be some debugging utility we don't call anywhere. I don't know how that is getting triggered, but that probably reduces the severity.

Comment 2

[Andrew McCreight [:mccr8]]

Maybe the automation harness is triggering the dump_image somehow?

Comment 3

[Bob Clary [:bc] (inactive)]

Attachment: nsNSSShutDownList::evaporateAllNSSResourcesAndShutDown() stack

I'm not sure. I'm trying to reproduce manually so I can get the symbolizer to work for sure. There is another crash for that url on Windows but it isn't obviously related to the asan issue. Attaching the crash report. I'm still trying to get the Windows asan report symbolized. I also realized the windows 64bit asan builds are a couple of weeks old.

Comment 4

[Bob Clary [:bc] (inactive)]

I've failed to get the packaged llvm-symbolizer to produce anything other than references to xul.dll. The asan build is problematic I think. The fact that no new builds are being produced is probably a sign that I jumped the gun on starting asan testing on windows.

We can revisit this once windows asan builds are in better shape and the llvm-symbolizer works. In the mean time I will cease using windows asan builds.

Comment 5

[Andrew McCreight [:mccr8]]

Nathan, is it expected that we're not producing Windows ASan builds any more? And that llvm-symbolizer doesn't work?

Comment 6

[Nathan Froyd [:froydnj]]

(In reply to Andrew McCreight [:mccr8] from comment #5)
> Nathan, is it expected that we're not producing Windows ASan builds any
> more? And that llvm-symbolizer doesn't work?

I don't know about the Windows ASan builds...I thought those were being generated automatically now?

As far as llvm-symbolizer not working, I know that when I initially tried Windows ASan builds, I could get llvm-symbolizer working on my local build, but it did not want to work with packaged builds.  I did not investigate much further than that.  Our Linux builds have actual symbols in libxul.so, but I suspect our Windows builds relegate everything to .pdb files...

Comment 7

[Tyson Smith [:tsmith]]

There is a bug logged to get symbols packaged with the windows asan builds.

Comment 8

[Daniel Veditz [:dveditz]]

We can reopen this one once we can start making progress.

Comment 9

[(Away)]

With bug 1360650 fixed, WinASan builds on Try should be producing xul.pdb's inside the target.zip now. Care to give this another try, Bob?

Note that you'll need to disable stylo on WinASan builds until bug 1417504 is fixed.

Comment 10

[Bob Clary [:bc] (inactive)]

Wow! I have been waiting for this for some time. I'm right in the first part of retesting the 43,000 urls where I found crashes this last year, but I will definitely see about trying to get this ready for production. I've got a couple of things going on but I will get to it very very soon. Thanks!

Comment 11

[Bob Clary [:bc] (inactive)]

Attachment: example asan report for a different url/different crash

used build from https://treeherder.mozilla.org/#/jobs?repo=try&revision=e5515e5beffe4d814877341f339087937f69bd38&filter-tier=1&filter-tier=2&filter-tier=3&selectedJob=151359165 

I didn't crash on this url but on a different one it does look like I got symbols! Do they look alright?

Comment 12

[(Away)]

> I didn't crash on this url but on a different one it does look like I got
> symbols! Do they look alright?

Hmm, mostly! The topmost frame is bogus because it looks like we don't upload symbols for the ASan runtime DLL -- I'll file a separate bug.

But the remainder of the stack, AddSizeOfExcludingThis etc., looks valid and suggests that you hit the stylo issue from bug 1417504.