1400438 - stylo: heap write hazard in Gecko_AppendMozBorderColors

Reporter

Description

•

7 years ago

While most border color hazards were eliminated by telling the analysis that nsStyleBorder uniquely owns its mBorderColors, that's not enough to resolve this hazard, because it is appending to the linked list pointed to by the known-to-be-safe aBorder argument. I can't tell if the entire list is owned or not; if any of these nodes are shared, this would be a race. (I'm guessing it's wholly owned.)

Analyzing Gecko_AppendMozBorderColors ...
Error: Field write nsBorderColors.mNext
Location: void nsStyleBorder::AppendBorderColor(int32, uint32) @ /builds/worker/checkouts/gecko/obj-analyzed/dist/include/nsStyleStruct.h#1279 ### SafeArguments: this
Stack Trace:
Gecko_AppendMozBorderColors @ /builds/worker/checkouts/gecko/layout/style/ServoBindings.cpp#1268 ### SafeArguments: aBorder

Bobby Holley (:bholley)

Updated

•

7 years ago

Priority: -- → P2

Summary: stylo heap write hazard in Gecko_AppendMozBorderColors → stylo: heap write hazard in Gecko_AppendMozBorderColors

Xidorn Quan [:xidorn] UTC+11

Assignee

Comment 1

•

7 years ago

Yes, it is wholly owned, but I really don't like the current approach of storing -moz-border-*-colors... I'll figure out a better way to store and make it easier to reason about for static analysis.

Assignee: nobody → xidorn+moz

Comment hidden (mozreview-request)

Review commit: https://reviewboard.mozilla.org/r/180832/diff/#index_header
See other reviews: https://reviewboard.mozilla.org/r/180832/

Xidorn Quan [:xidorn] UTC+11

Assignee

Comment 3

•

7 years ago

https://treeherder.mozilla.org/#/jobs?repo=try&revision=74fd1a8267d2e76617ad882b6b2d9870e242f4fb

Xidorn Quan [:xidorn] UTC+11

Assignee

Comment 4

•

7 years ago

Actually, I don't see any hazard on Gecko_AppendMozBorderColors at all on m-c. Maybe some changes to the analyzer in bug 1400442 would make it harder to track the relation here and lead to an extra hazard alarm?

Matt Woodrow (:mattwoodrow)

Comment 5

•

7 years ago

mozreview-review

Comment on attachment 8909239 [details]
Bug 1400438 - Use array instead of linked list for -moz-border-*-colors.

https://reviewboard.mozilla.org/r/180832/#review186194

::: layout/painting/nsCSSRenderingBorders.cpp:3152
(Diff revision 1)
>                                          { -0.5,  0   },
>                                          {    0, -0.5 } };
>  
>    for (int i = 0; i < mBorderWidths[0]; i++) {
>      NS_FOR_CSS_SIDES(side) {
> +      if (mCompositeColors[side] &&

This code is way easier to follow than the old one (yay), but it's still fairly complicated.

Maybe a comment like 'advance to the next composite color, if one exists' or something would help?

::: layout/style/nsStyleStruct.h:1158
(Diff revision 1)
>      }
>    }
>  
>    void ClearBorderColors(mozilla::Side aSide) {
> -    if (mBorderColors && mBorderColors[aSide]) {
> -      delete mBorderColors[aSide];
> +    if (mBorderColors) {
> +      mBorderColors->mColors[aSide].Clear();

Could just use the [] operator on nsBorderColors directly here?

Same in a few other places (nsRuleNode) where we're accessing mColors[] and don't need to.

Attachment #8909239 - Flags: review?(matt.woodrow) → review+

Xidorn Quan [:xidorn] UTC+11

Assignee

Comment 6

•

7 years ago

mozreview-review-reply

Comment on attachment 8909239 [details]
Bug 1400438 - Use array instead of linked list for -moz-border-*-colors.

https://reviewboard.mozilla.org/r/180832/#review186194

> Could just use the [] operator on nsBorderColors directly here?
> 
> Same in a few other places (nsRuleNode) where we're accessing mColors[] and don't need to.

The `operator[]` is currently implemented on `const nsBorderColors` only, so this and the places in `nsRuleNode` cannot really use it. If we want to enable them, we need a separate `operator[]` for non-const object, which I don't think it's worth.

Cameron McCormack (:heycam)

Comment 7

•

7 years ago

mozreview-review

Comment on attachment 8909239 [details]
Bug 1400438 - Use array instead of linked list for -moz-border-*-colors.

https://reviewboard.mozilla.org/r/180832/#review186282

r=me on the bits outside layout/painting/.

::: layout/style/ServoBindings.cpp:1265
(Diff revision 1)
>  void
>  Gecko_CopyMozBorderColors(nsStyleBorder* aDest, const nsStyleBorder* aSrc,
>                            mozilla::Side aSide)
>  {
>    if (aSrc->mBorderColors) {

This might be an existing issue, but do we never have the case where we want to copy an empty border colors from aSrc, and the one in aDest needs to be cleared?  If so, can you assert that the one in aDest is empty, or otherwise, just clear it?

Attachment #8909239 - Flags: review?(cam) → review+

Comment hidden (mozreview-request)

Comment on attachment 8909239 [details]
Bug 1400438 - Use array instead of linked list for -moz-border-*-colors.

Review request updated; see interdiff: https://reviewboard.mozilla.org/r/180832/diff/1-2/

Pulsebot

Comment 9

•

7 years ago

Pushed by xquan@mozilla.com:
https://hg.mozilla.org/integration/autoland/rev/df9036657f25
Use array instead of linked list for -moz-border-*-colors. r=heycam,mattwoodrow

Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)

Comment 10

•

7 years ago

Backed out for crashing chrome test mobile/android/components/extensions/test/mochitest/test_ext_options_ui.html on Android:

https://hg.mozilla.org/integration/autoland/rev/7d8bac06b7275668e62e5dfb80ffcad69ec71035
https://hg.mozilla.org/integration/autoland/rev/229b5c4c95cb7b431f51fffb27c9ae01fdb9a5a3

Push which ran failing tests: https://treeherder.mozilla.org/#/jobs?repo=autoland&revision=b10415064b6626fc1fddceaa2e847f958d10e287&filter-resultStatus=testfailed&filter-resultStatus=busted&filter-resultStatus=exception&filter-resultStatus=retry&filter-resultStatus=usercancel&filter-resultStatus=runnable
Failure log: https://treeherder.mozilla.org/logviewer.html#?job_id=131944778&repo=autoland

[task 2017-09-19T11:02:18.885Z] 11:02:18     INFO -  101 INFO TEST-START | mobile/android/components/extensions/test/mochitest/test_ext_options_ui.html
[task 2017-09-19T11:02:40.155Z] 11:02:40     INFO -  INFO | automation.py | Application ran for: 0:07:55.579270
[task 2017-09-19T11:02:40.157Z] 11:02:40     INFO -  INFO | zombiecheck | Reading PID log: /tmp/tmpvvka_Jpidlog
[task 2017-09-19T11:02:40.746Z] 11:02:40     INFO -  /data/tombstones does not exist; tombstone check skipped
[task 2017-09-19T11:02:41.604Z] 11:02:41     INFO -  mozcrash Downloading symbols from: https://queue.taskcluster.net/v1/task/FYpj083PSDeHQWTdgfp5lg/artifacts/public/build/target.crashreporter-symbols.zip
[task 2017-09-19T11:02:45.241Z] 11:02:45     INFO -  mozcrash Copy/paste: /builds/worker/workspace/build/linux64-minidump_stackwalk /tmp/tmpBZGfMM/161bed50-6d50-a29d-60f3-6a4b451e5955.dmp /tmp/tmpysBC3W
[task 2017-09-19T11:02:53.212Z] 11:02:53     INFO -  mozcrash Saved minidump as /builds/worker/workspace/build/blobber_upload_dir/161bed50-6d50-a29d-60f3-6a4b451e5955.dmp
[task 2017-09-19T11:02:53.213Z] 11:02:53     INFO -  mozcrash Saved app info as /builds/worker/workspace/build/blobber_upload_dir/161bed50-6d50-a29d-60f3-6a4b451e5955.extra
[task 2017-09-19T11:02:53.216Z] 11:02:53  WARNING -  PROCESS-CRASH | mobile/android/components/extensions/test/mochitest/test_ext_options_ui.html | application crashed [@ libmozglue.so + 0x20ad2]
[task 2017-09-19T11:02:53.216Z] 11:02:53     INFO -  Crash dump filename: /tmp/tmpBZGfMM/161bed50-6d50-a29d-60f3-6a4b451e5955.dmp
[task 2017-09-19T11:02:53.217Z] 11:02:53     INFO -  Operating system: Android
[task 2017-09-19T11:02:53.218Z] 11:02:53     INFO -                    0.0.0 Linux 2.6.29-gea477bb #1 Wed Sep 26 11:04:45 PDT 2012 armv7l
[task 2017-09-19T11:02:53.218Z] 11:02:53     INFO -  CPU: arm
[task 2017-09-19T11:02:53.218Z] 11:02:53     INFO -       ARMv7 ARM Cortex-A8 features: swp,half,thumb,fastmult,vfpv2,edsp,neon,vfpv3
[task 2017-09-19T11:02:53.218Z] 11:02:53     INFO -       1 CPU
[task 2017-09-19T11:02:53.218Z] 11:02:53     INFO -  GPU: UNKNOWN
[task 2017-09-19T11:02:53.219Z] 11:02:53     INFO -  Crash reason:  SIGSEGV
[task 2017-09-19T11:02:53.219Z] 11:02:53     INFO -  Crash address: 0x0
[task 2017-09-19T11:02:53.219Z] 11:02:53     INFO -  Process uptime: not available
[task 2017-09-19T11:02:53.219Z] 11:02:53     INFO -  Thread 12 (crashed)
[task 2017-09-19T11:02:53.220Z] 11:02:53     INFO -   0  libmozglue.so + 0x20ad2
[task 2017-09-19T11:02:53.220Z] 11:02:53     INFO -       r0 = 0x00000022    r1 = 0x00000000    r2 = 0x00000029    r3 = 0x527da138
[task 2017-09-19T11:02:53.220Z] 11:02:53     INFO -       r4 = 0x00000000    r5 = 0x527da144    r6 = 0x52be98ec    r7 = 0x00000001
[task 2017-09-19T11:02:53.220Z] 11:02:53     INFO -       r8 = 0x52be95bc    r9 = 0x52be95e0   r10 = 0x52be959c   r12 = 0xfffe14e4
[task 2017-09-19T11:02:53.220Z] 11:02:53     INFO -       fp = 0x52be95cc    sp = 0x52be9538    lr = 0x527b98a9    pc = 0x5276ead2
[task 2017-09-19T11:02:53.221Z] 11:02:53     INFO -      Found by: given as instruction pointer in context
[task 2017-09-19T11:02:53.221Z] 11:02:53     INFO -   1  libxul.so!InvalidArrayIndex_CRASH [nsTArray.cpp:b10415064b66 : 26 + 0x9]
[task 2017-09-19T11:02:53.221Z] 11:02:53     INFO -       sp = 0x52be954c    pc = 0x55e8c471
[task 2017-09-19T11:02:53.221Z] 11:02:53     INFO -      Found by: stack scanning
[task 2017-09-19T11:02:53.222Z] 11:02:53     INFO -   2  0xffffffff
[task 2017-09-19T11:02:53.222Z] 11:02:53     INFO -       sp = 0x52be955c    pc = 0x00000001
[task 2017-09-19T11:02:53.222Z] 11:02:53     INFO -      Found by: call frame info
[task 2017-09-19T11:02:53.223Z] 11:02:53     INFO -   3  libxul.so!nsTArray_Impl<Area*, nsTArrayInfallibleAllocator>::ElementAt [nsTArray.h:b10415064b66 : 1048 + 0x5]
[task 2017-09-19T11:02:53.223Z] 11:02:53     INFO -       sp = 0x52be9568    pc = 0x55e50963
[task 2017-09-19T11:02:53.223Z] 11:02:53     INFO -      Found by: stack scanning
[task 2017-09-19T11:02:53.224Z] 11:02:53     INFO -   4  libxul.so!nsCSSBorderRenderer::DrawBorderSidesCompositeColors [nsTArray.h:b10415064b66 : 1089 + 0xb]
[task 2017-09-19T11:02:53.224Z] 11:02:53     INFO -       r3 = 0x00000004    sp = 0x52be9570    pc = 0x56dfc4ef
[task 2017-09-19T11:02:53.224Z] 11:02:53     INFO -      Found by: call frame info
[task 2017-09-19T11:02:53.224Z] 11:02:53     INFO -   5  libxul.so!nsCSSBorderRenderer::DrawBorderSides [nsCSSRenderingBorders.cpp:b10415064b66 : 1385 + 0x7]
[task 2017-09-19T11:02:53.225Z] 11:02:53     INFO -       r4 = 0x52be98ec    r5 = 0x00000000    r6 = 0x80000000    r7 = 0x00000004
[task 2017-09-19T11:02:53.225Z] 11:02:53     INFO -       r8 = 0x52be9954    r9 = 0x52be9850   r10 = 0x00000001    fp = 0x5b930f80
[task 2017-09-19T11:02:53.225Z] 11:02:53     INFO -       sp = 0x52be9640    pc = 0x56dfdbf5
[task 2017-09-19T11:02:53.226Z] 11:02:53     INFO -      Found by: call frame info
[task 2017-09-19T11:02:53.226Z] 11:02:53     INFO -   6  libxul.so!nsCSSBorderRenderer::DrawBorders [nsCSSRenderingBorders.cpp:b10415064b66 : 3568 + 0x9]
[task 2017-09-19T11:02:53.226Z] 11:02:53     INFO -       r4 = 0x52be98ec    r5 = 0x00000000    r6 = 0x00000002    r7 = 0x00000000
[task 2017-09-19T11:02:53.226Z] 11:02:53     INFO -       r8 = 0x52be9954    r9 = 0x52be9850   r10 = 0x00000001    fp = 0x5b930f80
[task 2017-09-19T11:02:53.227Z] 11:02:53     INFO -       sp = 0x52be9760    pc = 0x56dffb09
[task 2017-09-19T11:02:53.227Z] 11:02:53     INFO -      Found by: call frame info
[task 2017-09-19T11:02:53.227Z] 11:02:53     INFO -   7  libxul.so!nsCSSRendering::PaintBorderWithStyleBorder [nsCSSRendering.cpp:b10415064b66 : 877 + 0x5]
[task 2017-09-19T11:02:53.228Z] 11:02:53     INFO -       r4 = 0x00000000    r5 = 0x628fe1a0    r6 = 0x5b930f80    r7 = 0x628fe140
[task 2017-09-19T11:02:53.228Z] 11:02:53     INFO -       r8 = 0x5543ac00    r9 = 0x59134380   r10 = 0x52be98ec    fp = 0x00000000
[task 2017-09-19T11:02:53.228Z] 11:02:53     INFO -       sp = 0x52be98c0    pc = 0x56e03a55
[task 2017-09-19T11:02:53.229Z] 11:02:53     INFO -      Found by: call frame info
[task 2017-09-19T11:02:53.229Z] 11:02:53     INFO -   8  libxul.so!nsCSSRendering::PaintBorder [nsCSSRendering.cpp:b10415064b66 : 649 + 0x1b]
[task 2017-09-19T11:02:53.229Z] 11:02:53     INFO -       r4 = 0x628fdc80    r5 = 0x00000000    r6 = 0x00000000    r7 = 0x59134380
[task 2017-09-19T11:02:53.229Z] 11:02:53     INFO -       r8 = 0x628fe140    r9 = 0x60241700   r10 = 0x5543ac00    fp = 0x52be99fc
[task 2017-09-19T11:02:53.230Z] 11:02:53     INFO -       sp = 0x52be99d0    pc = 0x56e03ad1
[task 2017-09-19T11:02:53.230Z] 11:02:53     INFO -      Found by: call frame info
[task 2017-09-19T11:02:53.230Z] 11:02:53     INFO -   9  libxul.so!nsDisplayBorder::Paint [nsDisplayList.cpp:b10415064b66 : 5169 + 0x17]
[task 2017-09-19T11:02:53.230Z] 11:02:53     INFO -       r4 = 0x59134358    r5 = 0x628fe140    r6 = 0x628fdc80    r7 = 0x60241700
[task 2017-09-19T11:02:53.231Z] 11:02:53     INFO -       r8 = 0x5543ac00    r9 = 0x00000000   r10 = 0x5b930f80    fp = 0x60494ad8
[task 2017-09-19T11:02:53.231Z] 11:02:53     INFO -       sp = 0x52be9af0    pc = 0x56e03ba1
[task 2017-09-19T11:02:53.231Z] 11:02:53     INFO -      Found by: call frame info
[task 2017-09-19T11:02:53.232Z] 11:02:53     INFO -  10  libxul.so!mozilla::FrameLayerBuilder::PaintItems [FrameLayerBuilder.cpp:b10415064b66 : 6052 + 0xd]
[task 2017-09-19T11:02:53.232Z] 11:02:53     INFO -       r4 = 0x00000002    r5 = 0x00000000    r6 = 0x60241700    r7 = 0x00000001
[task 2017-09-19T11:02:53.232Z] 11:02:53     INFO -       r8 = 0x54da8720    r9 = 0x59134358   r10 = 0x5b930f80    fp = 0x60494ad8
[task 2017-09-19T11:02:53.232Z] 11:02:53     INFO -       sp = 0x52be9b30    pc = 0x56e03e5b
[task 2017-09-19T11:02:53.233Z] 11:02:53     INFO -      Found by: call frame info
[task 2017-09-19T11:02:53.233Z] 11:02:53     INFO -  11  libxul.so!mozilla::FrameLayerBuilder::DrawPaintedLayer [FrameLayerBuilder.cpp:b10415064b66 : 6222 + 0x1d]
[task 2017-09-19T11:02:53.233Z] 11:02:53     INFO -       r4 = 0x60241700    r5 = 0x52be9f20    r6 = 0x62cf7a00    r7 = 0x6278a000
[task 2017-09-19T11:02:53.233Z] 11:02:53     INFO -       r8 = 0x60494ad0    r9 = 0x52be9c50   r10 = 0x62cf7a5c    fp = 0x52be9c08
[task 2017-09-19T11:02:53.234Z] 11:02:53     INFO -       sp = 0x52be9bd0    pc = 0x56e0418d
[task 2017-09-19T11:02:53.234Z] 11:02:53     INFO -      Found by: call frame info
[task 2017-09-19T11:02:53.234Z] 11:02:53     INFO -  12  libxul.so!mozilla::layers::ClientMultiTiledLayerBuffer::Update [TiledContentClient.cpp:b10415064b66 : 991 + 0x13]
[task 2017-09-19T11:02:53.234Z] 11:02:53     INFO -       r4 = 0x5d1468ac    r5 = 0x00000100    r6 = 0x52be9d90    r7 = 0x56e03ec1
[task 2017-09-19T11:02:53.235Z] 11:02:53     INFO -       r8 = 0x60241700    r9 = 0x6278a000   r10 = 0x00000005    fp = 0x52be9d68
[task 2017-09-19T11:02:53.235Z] 11:02:53     INFO -       sp = 0x52be9ce0    pc = 0x563d9f89
[task 2017-09-19T11:02:53.235Z] 11:02:53     INFO -      Found by: call frame info
[task 2017-09-19T11:02:53.235Z] 11:02:53     INFO -  13  libxul.so!mozilla::layers::ClientMultiTiledLayerBuffer::PaintThebes [TiledContentClient.cpp:b10415064b66 : 801 + 0xb]
[task 2017-09-19T11:02:53.235Z] 11:02:53     INFO -       r4 = 0x5d1468ac    r5 = 0x52be9e6c    r6 = 0x6278a278    r7 = 0x52be9f20
[task 2017-09-19T11:02:53.236Z] 11:02:53     INFO -       r8 = 0x52be9f20    r9 = 0x56e03ec1   r10 = 0x56e03ec1    fp = 0x563da0a1
[task 2017-09-19T11:02:53.236Z] 11:02:53     INFO -       sp = 0x52be9e60    pc = 0x563da0e9
[task 2017-09-19T11:02:53.236Z] 11:02:53     INFO -      Found by: call frame info
[task 2017-09-19T11:02:53.236Z] 11:02:53     INFO -  14  libxul.so!mozilla::layers::ClientTiledPaintedLayer::RenderHighPrecision [ClientTiledPaintedLayer.cpp:b10415064b66 : 347 + 0x15]
[task 2017-09-19T11:02:53.237Z] 11:02:53     INFO -       r4 = 0x6278a000    r5 = 0x52be9eac    r6 = 0x5d1468ac    r7 = 0x52be9f20
[task 2017-09-19T11:02:53.237Z] 11:02:53     INFO -       r8 = 0x6278a278    r9 = 0x56e03ec1   r10 = 0x56e03ec1    fp = 0x563da0a1
[task 2017-09-19T11:02:53.237Z] 11:02:53     INFO -       sp = 0x52be9e88    pc = 0x563c7863
[task 2017-09-19T11:02:53.237Z] 11:02:53     INFO -      Found by: call frame info
[task 2017-09-19T11:02:53.238Z] 11:02:53     INFO -  15  libxul.so!mozilla::layers::ClientTiledPaintedLayer::RenderLayer [ClientTiledPaintedLayer.cpp:b10415064b66 : 550 + 0xf]
[task 2017-09-19T11:02:53.238Z] 11:02:53     INFO -       r4 = 0x6278a000    r5 = 0x52be9f34    r6 = 0x52be9f20    r7 = 0x52be9f0c
[task 2017-09-19T11:02:53.239Z] 11:02:53     INFO -       r8 = 0x6278a278    r9 = 0x52be9efc   r10 = 0x56e03ec1    fp = 0x52bea540
[task 2017-09-19T11:02:53.239Z] 11:02:53     INFO -       sp = 0x52be9ee8    pc = 0x563c8ff9
[task 2017-09-19T11:02:53.239Z] 11:02:53     INFO -      Found by: call frame info
[task 2017-09-19T11:02:53.240Z] 11:02:53     INFO -  16  libxul.so!mozilla::layers::ClientContainerLayer::RenderLayer [ClientContainerLayer.h:b10415064b66 : 57 + 0x3]
[task 2017-09-19T11:02:53.240Z] 11:02:53     INFO -       r4 = 0x5d1ed400    r5 = 0x52be9f78    r6 = 0x6278a000    r7 = 0x00000001
[task 2017-09-19T11:02:53.240Z] 11:02:53     INFO -       r8 = 0x52be9f7c    r9 = 0x00000000   r10 = 0x6043be98    fp = 0x6043bc00
[task 2017-09-19T11:02:53.241Z] 11:02:53     INFO -       sp = 0x52be9f70    pc = 0x563c70ab
[task 2017-09-19T11:02:53.241Z] 11:02:53     INFO -      Found by: call frame info
[task 2017-09-19T11:02:53.241Z] 11:02:53     INFO -  17  libxul.so!mozilla::layers::ClientContainerLayer::RenderLayer [ClientContainerLayer.h:b10415064b66 : 57 + 0x3]
[task 2017-09-19T11:02:53.241Z] 11:02:53     INFO -       r4 = 0x6043bc00    r5 = 0x52be9fa0    r6 = 0x5d1ed400    r7 = 0x00000002
[task 2017-09-19T11:02:53.242Z] 11:02:53     INFO -       r8 = 0x52be9fa4    r9 = 0x00000000   r10 = 0x6043be98    fp = 0x6043bc00
[task 2017-09-19T11:02:53.242Z] 11:02:53     INFO -       sp = 0x52be9f98    pc = 0x563c70ab
[task 2017-09-19T11:02:53.242Z] 11:02:53     INFO -      Found by: call frame info
[task 2017-09-19T11:02:53.242Z] 11:02:53     INFO -  18  libxul.so!mozilla::layers::ClientLayerManager::EndTransactionInternal [ClientLayerManager.cpp:b10415064b66 : 380 + 0x9]
[task 2017-09-19T11:02:53.243Z] 11:02:53     INFO -       r4 = 0x58eeb000    r5 = 0x52be9fe0    r6 = 0x52be9fdc    r7 = 0x00000000
[task 2017-09-19T11:02:53.243Z] 11:02:53     INFO -       r8 = 0x52bea000    r9 = 0x00000000   r10 = 0x6043be98    fp = 0x6043bc00
[task 2017-09-19T11:02:53.243Z] 11:02:53     INFO -       sp = 0x52be9fc0    pc = 0x563c9c9f
[task 2017-09-19T11:02:53.244Z] 11:02:53     INFO -      Found by: call frame info
[task 2017-09-19T11:02:53.244Z] 11:02:53     INFO -  19  libxul.so!mozilla::layers::ClientLayerManager::EndTransaction [ClientLayerManager.cpp:b10415064b66 : 438 + 0xb]
[task 2017-09-19T11:02:53.244Z] 11:02:53     INFO -       r4 = 0x58eeb000    r5 = 0x00000000    r6 = 0x52bea540    r7 = 0x56e03ec1
[task 2017-09-19T11:02:53.244Z] 11:02:53     INFO -       r8 = 0x52bea120    r9 = 0x54365000   r10 = 0x00000000    fp = 0x00000000
[task 2017-09-19T11:02:53.245Z] 11:02:53     INFO -       sp = 0x52bea0c8    pc = 0x563ccd75
[task 2017-09-19T11:02:53.245Z] 11:02:53     INFO -      Found by: call frame info
[task 2017-09-19T11:02:53.245Z] 11:02:53     INFO -  20  libxul.so!nsDisplayList::PaintRoot [nsDisplayList.cpp:b10415064b66 : 2348 + 0xf]
[task 2017-09-19T11:02:53.245Z] 11:02:53     INFO -       r3 = 0x00000000    r4 = 0x52bea540    r5 = 0x54365000    r6 = 0x00000001
[task 2017-09-19T11:02:53.246Z] 11:02:53     INFO -       r7 = 0x5435e000    r8 = 0x52bea120    r9 = 0x54365000   r10 = 0x00000000
[task 2017-09-19T11:02:53.246Z] 11:02:53     INFO -       fp = 0x00000000    sp = 0x52bea0e0    pc = 0x56e0724f
[task 2017-09-19T11:02:53.246Z] 11:02:53     INFO -      Found by: call frame info
[task 2017-09-19T11:02:53.246Z] 11:02:53     INFO -  21  libxul.so!nsLayoutUtils::PaintFrame [nsLayoutUtils.cpp:b10415064b66 : 3772 + 0x17]
[task 2017-09-19T11:02:53.247Z] 11:02:53     INFO -       r4 = 0x54b11780    r5 = 0x52bea440    r6 = 0x00000000    r7 = 0x00000000
[task 2017-09-19T11:02:53.247Z] 11:02:53     INFO -       r8 = 0x6de6beb7    r9 = 0x00000090   r10 = 0x52bea4b0    fp = 0x00000184
[task 2017-09-19T11:02:53.247Z] 11:02:53     INFO -       sp = 0x52bea3f8    pc = 0x56ceead3
[task 2017-09-19T11:02:53.247Z] 11:02:53     INFO -      Found by: call frame info
[task 2017-09-19T11:02:53.248Z] 11:02:53     INFO -  22  libxul.so!mozilla::PresShell::Paint [PresShell.cpp:b10415064b66 : 6455 + 0xf]
[task 2017-09-19T11:02:53.248Z] 11:02:53     INFO -       r4 = 0x58eeb000    r5 = 0x54dd2000    r6 = 0x54365000    r7 = 0x54b11780
[task 2017-09-19T11:02:53.248Z] 11:02:53     INFO -       r8 = 0x00000001    r9 = 0x52beb024   r10 = 0x00000000    fp = 0x00000000
[task 2017-09-19T11:02:53.248Z] 11:02:53     INFO -       sp = 0x52beaff0    pc = 0x56ccd3b7
[task 2017-09-19T11:02:53.248Z] 11:02:53     INFO -      Found by: call frame info
[task 2017-09-19T11:02:53.249Z] 11:02:53     INFO -  23  libxul.so!nsViewManager::ProcessPendingUpdatesPaint [nsViewManager.cpp:b10415064b66 : 480 + 0x9]
[task 2017-09-19T11:02:53.249Z] 11:02:53     INFO -       r4 = 0x54c6e680    r5 = 0x54d8edc0    r6 = 0x52beb0b4    r7 = 0x54dd30d0
[task 2017-09-19T11:02:53.249Z] 11:02:53     INFO -       r8 = 0x54dd2000    r9 = 0x56ccd199   r10 = 0x00f96376    fp = 0x52beb17c
[task 2017-09-19T11:02:53.249Z] 11:02:53     INFO -       sp = 0x52beb0b0    pc = 0x56bc699b
[task 2017-09-19T11:02:53.250Z] 11:02:53     INFO -      Found by: call frame info
[task 2017-09-19T11:02:53.250Z] 11:02:53     INFO -  24  libxul.so!nsViewManager::ProcessPendingUpdatesForView [nsViewManager.cpp:b10415064b66 : 412 + 0x7]
[task 2017-09-19T11:02:53.250Z] 11:02:53     INFO -       r4 = 0x00000000    r5 = 0x52beb0f0    r6 = 0x52beb0ec    r7 = 0x54c6e680
[task 2017-09-19T11:02:53.250Z] 11:02:53     INFO -       r8 = 0x00000001    r9 = 0x54dd30d0   r10 = 0x00f96376    fp = 0x52beb17c
[task 2017-09-19T11:02:53.251Z] 11:02:53     INFO -       sp = 0x52beb0e8    pc = 0x56bc6aa7
[task 2017-09-19T11:02:53.251Z] 11:02:53     INFO -      Found by: call frame info
[task 2017-09-19T11:02:53.251Z] 11:02:53     INFO -  25  libxul.so!nsViewManager::ProcessPendingUpdates [nsViewManager.cpp:b10415064b66 : 1102 + 0x9]
[task 2017-09-19T11:02:53.252Z] 11:02:53     INFO -       r4 = 0x54dd30d0    r5 = 0x52beb124    r6 = 0x55333120    r7 = 0x54dd30d0
[task 2017-09-19T11:02:53.252Z] 11:02:53     INFO -       r8 = 0x00000000    r9 = 0x00000000   r10 = 0x00f96376    fp = 0x52beb17c
[task 2017-09-19T11:02:53.252Z] 11:02:53     INFO -       sp = 0x52beb120    pc = 0x56bc6b03
[task 2017-09-19T11:02:53.252Z] 11:02:53     INFO -      Found by: call frame info
[task 2017-09-19T11:02:53.253Z] 11:02:53     INFO -  26  libxul.so!nsRefreshDriver::Tick [nsRefreshDriver.cpp:b10415064b66 : 2082 + 0x5]
[task 2017-09-19T11:02:53.253Z] 11:02:53     INFO -       r4 = 0x52beb1c8    r5 = 0x52beb188    r6 = 0x55333120    r7 = 0x54dd30d0
[task 2017-09-19T11:02:53.253Z] 11:02:53     INFO -       r8 = 0x00000000    r9 = 0x00000000   r10 = 0x00f96376    fp = 0x52beb17c
[task 2017-09-19T11:02:53.253Z] 11:02:53     INFO -       sp = 0x52beb138    pc = 0x56cbd38f
[task 2017-09-19T11:02:53.254Z] 11:02:53     INFO -      Found by: call frame info
[task 2017-09-19T11:02:53.254Z] 11:02:53     INFO -  27  libxul.so!mozilla::RefreshDriverTimer::TickRefreshDrivers [nsRefreshDriver.cpp:b10415064b66 : 307 + 0x11]
[task 2017-09-19T11:02:53.254Z] 11:02:53     INFO -       r4 = 0x00000000    r5 = 0x52beb2fc    r6 = 0x00000001    r7 = 0x55333120
[task 2017-09-19T11:02:53.255Z] 11:02:53     INFO -       r8 = 0xcb0611cd    r9 = 0x00055988   r10 = 0x58e0f4c0    fp = 0x52beb378
[task 2017-09-19T11:02:53.255Z] 11:02:53     INFO -       sp = 0x52beb2f0    pc = 0x56cbd769
[task 2017-09-19T11:02:53.255Z] 11:02:53     INFO -      Found by: call frame info
[task 2017-09-19T11:02:53.255Z] 11:02:53     INFO -  28  libxul.so!mozilla::RefreshDriverTimer::Tick [nsRefreshDriver.cpp:b10415064b66 : 329 + 0x13]
[task 2017-09-19T11:02:53.256Z] 11:02:53     INFO -       r4 = 0x58e0f4c0    r5 = 0x5451ccd8    r6 = 0x6b04a9b7    r7 = 0x00000090
[task 2017-09-19T11:02:53.256Z] 11:02:53     INFO -       r8 = 0xcb0611cd    r9 = 0x00055988   r10 = 0x52beb370    fp = 0x52beb378
[task 2017-09-19T11:02:53.256Z] 11:02:53     INFO -       sp = 0x52beb320    pc = 0x56cbd80d
[task 2017-09-19T11:02:53.256Z] 11:02:53     INFO -      Found by: call frame info
[task 2017-09-19T11:02:53.257Z] 11:02:53     INFO -  29  libxul.so!mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::TickRefreshDriver [nsRefreshDriver.cpp:b10415064b66 : 770 + 0xd]
[task 2017-09-19T11:02:53.257Z] 11:02:53     INFO -       r4 = 0x58e0f510    r5 = 0x58e0f4c0    r6 = 0x6b04a9b7    r7 = 0x00000090
[task 2017-09-19T11:02:53.257Z] 11:02:53     INFO -       r8 = 0xcb063238    r9 = 0x00055988   r10 = 0x52beb370    fp = 0x52beb378
[task 2017-09-19T11:02:53.257Z] 11:02:53     INFO -       sp = 0x52beb358    pc = 0x56cbd921
[task 2017-09-19T11:02:53.258Z] 11:02:53     INFO -      Found by: call frame info
[task 2017-09-19T11:02:53.258Z] 11:02:53     INFO -  30  libxul.so!mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::ParentProcessVsyncNotifier::Run [nsRefreshDriver.cpp:b10415064b66 : 529 + 0x9]
[task 2017-09-19T11:02:53.258Z] 11:02:53     INFO -       r4 = 0x5d165740    r5 = 0x52beb420    r6 = 0x52beb498    r7 = 0x00000002
[task 2017-09-19T11:02:53.258Z] 11:02:53     INFO -       r8 = 0x58db2ebc    r9 = 0x52beb3ec   r10 = 0x52beb3e8    fp = 0x52beb478
[task 2017-09-19T11:02:53.259Z] 11:02:53     INFO -       sp = 0x52beb3b0    pc = 0x56cbdaf5
[task 2017-09-19T11:02:53.259Z] 11:02:53     INFO -      Found by: call frame info
[task 2017-09-19T11:02:53.259Z] 11:02:53     INFO -  31  libxul.so!nsThread::ProcessNextEvent [nsThread.cpp:b10415064b66 : 1039 + 0x3]
[task 2017-09-19T11:02:53.260Z] 11:02:53     INFO -       r4 = 0x52d0f160    r5 = 0x52beb420    r6 = 0x52beb498    r7 = 0x00000002
[task 2017-09-19T11:02:53.260Z] 11:02:53     INFO -       r8 = 0x58db2ebc    r9 = 0x52beb3ec   r10 = 0x52beb3e8    fp = 0x52beb478
[task 2017-09-19T11:02:53.260Z] 11:02:53     INFO -       sp = 0x52beb3b8    pc = 0x55eafbef
[task 2017-09-19T11:02:53.260Z] 11:02:53     INFO -      Found by: call frame info
[task 2017-09-19T11:02:53.260Z] 11:02:53     INFO -  32  libxul.so!NS_ProcessNextEvent [nsThreadUtils.cpp:b10415064b66 : 521 + 0xb]
[task 2017-09-19T11:02:53.261Z] 11:02:53     INFO -       r4 = 0x00000000    r5 = 0x00000001    r6 = 0x52d4c060    r7 = 0x52d0f160
[task 2017-09-19T11:02:53.261Z] 11:02:53     INFO -       r8 = 0x52d13350    r9 = 0x00000000   r10 = 0x52beb9b8    fp = 0x52bebb9d
[task 2017-09-19T11:02:53.261Z] 11:02:53     INFO -       sp = 0x52beb908    pc = 0x55ead7ad
[task 2017-09-19T11:02:53.261Z] 11:02:53     INFO -      Found by: call frame info
[task 2017-09-19T11:02:53.262Z] 11:02:53     INFO -  33  libxul.so!mozilla::ipc::MessagePump::Run [MessagePump.cpp:b10415064b66 : 97 + 0x7]
[task 2017-09-19T11:02:53.262Z] 11:02:53     INFO -       r4 = 0x52d13340    r5 = 0x00000001    r6 = 0x52d4c060    r7 = 0x52d0f160
[task 2017-09-19T11:02:53.262Z] 11:02:53     INFO -       r8 = 0x52d13350    r9 = 0x00000000   r10 = 0x52beb9b8    fp = 0x52bebb9d
[task 2017-09-19T11:02:53.262Z] 11:02:53     INFO -       sp = 0x52beb918    pc = 0x560a78fd
[task 2017-09-19T11:02:53.263Z] 11:02:53     INFO -      Found by: call frame info
[task 2017-09-19T11:02:53.263Z] 11:02:53     INFO -  34  libxul.so!MessageLoop::Run [message_loop.cc:b10415064b66 : 319 + 0x5]
[task 2017-09-19T11:02:53.263Z] 11:02:53     INFO -       r4 = 0x00000000    r5 = 0x52d4c060    r6 = 0x52d0f160    r7 = 0x52beb9c4
[task 2017-09-19T11:02:53.263Z] 11:02:53     INFO -       r8 = 0x52beb9a8    r9 = 0x00000000   r10 = 0x52beb9b8    fp = 0x52bebb9d
[task 2017-09-19T11:02:53.264Z] 11:02:53     INFO -       sp = 0x52beb940    pc = 0x56094357
[task 2017-09-19T11:02:53.264Z] 11:02:53     INFO -      Found by: call frame info
[task 2017-09-19T11:02:53.264Z] 11:02:53     INFO -  35  libxul.so!nsBaseAppShell::Run [nsBaseAppShell.cpp:b10415064b66 : 158 + 0x3]
[task 2017-09-19T11:02:53.264Z] 11:02:53     INFO -       r4 = 0x00000000    r5 = 0x554b8d00    r6 = 0x52d0f160    r7 = 0x52beb9c4
[task 2017-09-19T11:02:53.265Z] 11:02:53     INFO -       r8 = 0x52beb9a8    r9 = 0x00000000   r10 = 0x52beb9b8    fp = 0x52bebb9d
[task 2017-09-19T11:02:53.265Z] 11:02:53     INFO -       sp = 0x52beb960    pc = 0x56bd77f7
[task 2017-09-19T11:02:53.265Z] 11:02:53     INFO -      Found by: call frame info
[task 2017-09-19T11:02:53.265Z] 11:02:53     INFO -  36  libxul.so!nsAppStartup::Run [nsAppStartup.cpp:b10415064b66 : 288 + 0x3]
[task 2017-09-19T11:02:53.266Z] 11:02:53     INFO -       r4 = 0x55454a60    r5 = 0x52bebab0    r6 = 0x52beb9ac    r7 = 0x52beb9c4
[task 2017-09-19T11:02:53.266Z] 11:02:53     INFO -       r8 = 0x52beb9a8    r9 = 0x00000000   r10 = 0x52beb9b8    fp = 0x52bebb9d
[task 2017-09-19T11:02:53.266Z] 11:02:53     INFO -       sp = 0x52beb970    pc = 0x5734a523
[task 2017-09-19T11:02:53.266Z] 11:02:53     INFO -      Found by: call frame info
[task 2017-09-19T11:02:53.267Z] 11:02:53     INFO -  37  libxul.so!XREMain::XRE_mainRun [nsAppRunner.cpp:b10415064b66 : 4701 + 0x3]
[task 2017-09-19T11:02:53.267Z] 11:02:53     INFO -       r4 = 0x52beb9ec    r5 = 0x52bebab0    r6 = 0x52beb9ac    r7 = 0x52beb9c4
[task 2017-09-19T11:02:53.267Z] 11:02:53     INFO -       r8 = 0x52beb9a8    r9 = 0x00000000   r10 = 0x52beb9b8    fp = 0x52bebb9d
[task 2017-09-19T11:02:53.268Z] 11:02:53     INFO -       sp = 0x52beb978    pc = 0x5738b957
[task 2017-09-19T11:02:53.268Z] 11:02:53     INFO -      Found by: call frame info
[task 2017-09-19T11:02:53.268Z] 11:02:53     INFO -  38  libxul.so!XREMain::XRE_main [nsAppRunner.cpp:b10415064b66 : 4865 + 0x5]
[task 2017-09-19T11:02:53.269Z] 11:02:53     INFO -       r4 = 0x52bebab0    r5 = 0x00000000    r6 = 0x00000000    r7 = 0x52beba70
[task 2017-09-19T11:02:53.269Z] 11:02:53     INFO -       r8 = 0x52bebbc8    r9 = 0x52beba78   r10 = 0x52d09470    fp = 0x55e8f921
[task 2017-09-19T11:02:53.269Z] 11:02:53     INFO -       sp = 0x52beba68    pc = 0x5738bd2d
[task 2017-09-19T11:02:53.269Z] 11:02:53     INFO -      Found by: call frame info
[task 2017-09-19T11:02:53.269Z] 11:02:53     INFO -  39  libxul.so!XRE_main [nsAppRunner.cpp:b10415064b66 : 4960 + 0x3]
[task 2017-09-19T11:02:53.270Z] 11:02:53     INFO -       r4 = 0x00000000    r5 = 0x52bebacc    r6 = 0x52bebab0    r7 = 0x52bebbc8
[task 2017-09-19T11:02:53.270Z] 11:02:53     INFO -       r8 = 0x52bebaf4    r9 = 0x52bebb48   r10 = 0x52d01ec0    fp = 0x00000006
[task 2017-09-19T11:02:53.270Z] 11:02:53     INFO -       sp = 0x52bebab0    pc = 0x5738beef
[task 2017-09-19T11:02:53.271Z] 11:02:53     INFO -      Found by: call frame info
[task 2017-09-19T11:02:53.271Z] 11:02:53     INFO -  40  libxul.so!GeckoStart [nsAndroidStartup.cpp:b10415064b66 : 50 + 0x3]
[task 2017-09-19T11:02:53.271Z] 11:02:53     INFO -       r4 = 0x527d9e80    r5 = 0x52d01ec0    r6 = 0x00000006    r7 = 0x527d6ae0
[task 2017-09-19T11:02:53.271Z] 11:02:53     INFO -       r8 = 0x52d01ec0    r9 = 0xffffffff   r10 = 0x22300005    fp = 0x1f500009
[task 2017-09-19T11:02:53.272Z] 11:02:53     INFO -       sp = 0x52bebbc8    pc = 0x5738d389
[task 2017-09-19T11:02:53.272Z] 11:02:53     INFO -      Found by: call frame info
[task 2017-09-19T11:02:53.272Z] 11:02:53     INFO -  41  libmozglue.so + 0x16409
[task 2017-09-19T11:02:53.272Z] 11:02:53     INFO -       r4 = 0x52d01ec0    r5 = 0x2a1e64c0    r6 = 0x00000006    r7 = 0x527d91ac
[task 2017-09-19T11:02:53.273Z] 11:02:53     INFO -       r8 = 0x52d01ec0    r9 = 0xffffffff   r10 = 0x22300005    fp = 0x1f500009
[task 2017-09-19T11:02:53.273Z] 11:02:53     INFO -       sp = 0x52bebbe8    pc = 0x5276440b
[task 2017-09-19T11:02:53.273Z] 11:02:53     INFO -      Found by: call frame info
[task 2017-09-19T11:02:53.273Z] 11:02:53     INFO -  42  libdvm.so + 0xa3dac
[task 2017-09-19T11:02:53.274Z] 11:02:53     INFO -       sp = 0x52bebbfc    pc = 0x408e1dae
[task 2017-09-19T11:02:53.274Z] 11:02:53     INFO -      Found by: stack scanning
[task 2017-09-19T11:02:53.274Z] 11:02:53     INFO -  43  dalvik-LinearAlloc (deleted) + 0x31f156
[task 2017-09-19T11:02:53.274Z] 11:02:53     INFO -       sp = 0x52bebc00    pc = 0x4c786158
[task 2017-09-19T11:02:53.275Z] 11:02:53     INFO -      Found by: stack scanning
[task 2017-09-19T11:02:53.275Z] 11:02:53     INFO -  44  libdvm.so + 0x1dc4e
[task 2017-09-19T11:02:53.275Z] 11:02:53     INFO -       sp = 0x52bebc20    pc = 0x4085bc50
[task 2017-09-19T11:02:53.275Z] 11:02:53     INFO -      Found by: stack scanning
[task 2017-09-19T11:02:53.275Z] 11:02:53     INFO -  45  libdvm.so + 0x48dc3
[task 2017-09-19T11:02:53.276Z] 11:02:53     INFO -       sp = 0x52bebc28    pc = 0x40886dc5
[task 2017-09-19T11:02:53.276Z] 11:02:53     INFO -      Found by: stack scanning
[task 2017-09-19T11:02:53.276Z] 11:02:53     INFO -  46  data@app@org.mozilla.fennec_aurora-1.apk@classes.dex + 0x5d8001
[task 2017-09-19T11:02:53.276Z] 11:02:53     INFO -       sp = 0x52bebc34    pc = 0x524d9003
[task 2017-09-19T11:02:53.277Z] 11:02:53     INFO -      Found by: stack scanning
[task 2017-09-19T11:02:53.277Z] 11:02:53     INFO -  47  dalvik-heap (deleted) + 0x296036
[task 2017-09-19T11:02:53.277Z] 11:02:53     INFO -       sp = 0x52bebc38    pc = 0x4174b038
[task 2017-09-19T11:02:53.277Z] 11:02:53     INFO -      Found by: stack scanning
[task 2017-09-19T11:02:53.278Z] 11:02:53     INFO -  48  dalvik-heap (deleted) + 0x2dbc9e
[task 2017-09-19T11:02:53.278Z] 11:02:53     INFO -       sp = 0x52bebc3c    pc = 0x41790ca0
[task 2017-09-19T11:02:53.278Z] 11:02:53     INFO -      Found by: stack scanning
[task 2017-09-19T11:02:53.278Z] 11:02:53     INFO -  49  libdvm.so + 0x4dcad
[task 2017-09-19T11:02:53.279Z] 11:02:53     INFO -       sp = 0x52bebc40    pc = 0x4088bcaf
[task 2017-09-19T11:02:53.279Z] 11:02:53     INFO -      Found by: stack scanning
[task 2017-09-19T11:02:53.279Z] 11:02:53     INFO -  50  data@app@org.mozilla.fennec_aurora-1.apk@classes.dex + 0x5d7ffd
[task 2017-09-19T11:02:53.279Z] 11:02:53     INFO -       sp = 0x52bebc48    pc = 0x524d8fff
[task 2017-09-19T11:02:53.279Z] 11:02:53     INFO -      Found by: stack scanning
[task 2017-09-19T11:02:53.280Z] 11:02:53     INFO -  51  libmozglue.so + 0x16343
[task 2017-09-19T11:02:53.280Z] 11:02:53     INFO -       sp = 0x52bebc4c    pc = 0x52764345
[task 2017-09-19T11:02:53.280Z] 11:02:53     INFO -      Found by: stack scanning
[task 2017-09-19T11:02:53.280Z] 11:02:53     INFO -  52  libmozglue.so + 0x16343
[task 2017-09-19T11:02:53.281Z] 11:02:53     INFO -       sp = 0x52bebc8c    pc = 0x52764345
[task 2017-09-19T11:02:53.281Z] 11:02:53     INFO -      Found by: stack scanning
[task 2017-09-19T11:02:53.281Z] 11:02:53     INFO -  53  libc.so!dlfree [malloc.c : 4722 + 0x7]
[task 2017-09-19T11:02:53.281Z] 11:02:53     INFO -       sp = 0x52bebc90    pc = 0x400379eb
[task 2017-09-19T11:02:53.281Z] 11:02:53     INFO -      Found by: stack scanning
[task 2017-09-19T11:02:53.282Z] 11:02:53     INFO -  54  libc.so!free [malloc_debug_common.cpp : 230 + 0x9]
[task 2017-09-19T11:02:53.282Z] 11:02:53     INFO -       r3 = 0x4006f000    r4 = 0x2a27aaf8    r5 = 0x00000000    r6 = 0x2a27aab8
[task 2017-09-19T11:02:53.282Z] 11:02:53     INFO -       r7 = 0x00000000    sp = 0x52bebca8    pc = 0x400349c1
[task 2017-09-19T11:02:53.282Z] 11:02:53     INFO -      Found by: call frame info
[task 2017-09-19T11:02:53.283Z] 11:02:53     INFO -  55  libdvm.so + 0x4f8dd
[task 2017-09-19T11:02:53.283Z] 11:02:53     INFO -       r3 = 0x514b7494    r4 = 0x2a27aaf8    r5 = 0x00000000    r6 = 0x2a27aab8
[task 2017-09-19T11:02:53.283Z] 11:02:53     INFO -       r7 = 0x00000000    sp = 0x52bebcb0    pc = 0x4088d8df
[task 2017-09-19T11:02:53.283Z] 11:02:53     INFO -      Found by: call frame info
[task 2017-09-19T11:02:53.284Z] 11:02:53     INFO -  56  dalvik-heap (deleted) + 0x5f301e
[task 2017-09-19T11:02:53.284Z] 11:02:53     INFO -       sp = 0x52bebcb4    pc = 0x41aa8020
[task 2017-09-19T11:02:53.284Z] 11:02:53     INFO -      Found by: stack scanning
[task 2017-09-19T11:02:53.284Z] 11:02:53     INFO -  57  dalvik-heap (deleted) + 0x5f301e
[task 2017-09-19T11:02:53.285Z] 11:02:53     INFO -       sp = 0x52bebcc0    pc = 0x41aa8020
[task 2017-09-19T11:02:53.285Z] 11:02:53     INFO -      Found by: stack scanning
[task 2017-09-19T11:02:53.285Z] 11:02:53     INFO -  58  dalvik-heap (deleted) + 0x5f301e
[task 2017-09-19T11:02:53.286Z] 11:02:53     INFO -       sp = 0x52bebccc    pc = 0x41aa8020
[task 2017-09-19T11:02:53.286Z] 11:02:53     INFO -      Found by: stack scanning
[task 2017-09-19T11:02:53.286Z] 11:02:53     INFO -  59  libdvm.so + 0x550db
[task 2017-09-19T11:02:53.286Z] 11:02:53     INFO -       sp = 0x52bebcd8    pc = 0x408930dd
[task 2017-09-19T11:02:53.286Z] 11:02:53     INFO -      Found by: stack scanning
[task 2017-09-19T11:02:53.287Z] 11:02:53     INFO -  60  dalvik-heap (deleted) + 0x5f301e
[task 2017-09-19T11:02:53.287Z] 11:02:53     INFO -       sp = 0x52bebcdc    pc = 0x41aa8020
[task 2017-09-19T11:02:53.287Z] 11:02:53     INFO -      Found by: stack scanning
[task 2017-09-19T11:02:53.287Z] 11:02:53     INFO -  61  dalvik-heap (deleted) + 0x5f301e
[task 2017-09-19T11:02:53.288Z] 11:02:53     INFO -       sp = 0x52bebce4    pc = 0x41aa8020
[task 2017-09-19T11:02:53.288Z] 11:02:53     INFO -      Found by: stack scanning
[task 2017-09-19T11:02:53.288Z] 11:02:53     INFO -  62  libdvm.so + 0xae19e
[task 2017-09-19T11:02:53.288Z] 11:02:53     INFO -       sp = 0x52bebce8    pc = 0x408ec1a0
[task 2017-09-19T11:02:53.289Z] 11:02:53     INFO -      Found by: stack scanning
[task 2017-09-19T11:02:53.289Z] 11:02:53     INFO -  63  dalvik-LinearAlloc (deleted) + 0x31f16a
[task 2017-09-19T11:02:53.289Z] 11:02:53     INFO -       sp = 0x52bebcf0    pc = 0x4c78616c
[task 2017-09-19T11:02:53.289Z] 11:02:53     INFO -      Found by: stack scanning
[task 2017-09-19T11:02:53.289Z] 11:02:53     INFO -  64  dalvik-heap (deleted) + 0x296036
[task 2017-09-19T11:02:53.290Z] 11:02:53     INFO -       sp = 0x52bebcf8    pc = 0x4174b038
[task 2017-09-19T11:02:53.290Z] 11:02:53     INFO -      Found by: stack scanning
[task 2017-09-19T11:02:53.290Z] 11:02:53     INFO -  65  dalvik-LinearAlloc (deleted) + 0x31f156
[task 2017-09-19T11:02:53.290Z] 11:02:53     INFO -       sp = 0x52bebd04    pc = 0x4c786158
[task 2017-09-19T11:02:53.291Z] 11:02:53     INFO -      Found by: stack scanning
[task 2017-09-19T11:02:53.291Z] 11:02:53     INFO -  66  data@app@org.mozilla.fennec_aurora-1.apk@classes.dex + 0x638a6f
[task 2017-09-19T11:02:53.291Z] 11:02:53     INFO -       sp = 0x52bebd08    pc = 0x52539a71
[task 2017-09-19T11:02:53.291Z] 11:02:53     INFO -      Found by: stack scanning
[task 2017-09-19T11:02:53.292Z] 11:02:53     INFO -  67  libdvm.so + 0x6b0b1
[task 2017-09-19T11:02:53.292Z] 11:02:53     INFO -       sp = 0x52bebd18    pc = 0x408a90b3
[task 2017-09-19T11:02:53.292Z] 11:02:53     INFO -      Found by: stack scanning
[task 2017-09-19T11:02:53.292Z] 11:02:53     INFO -  68  data@app@org.mozilla.fennec_aurora-1.apk@classes.dex + 0x638a6f
[task 2017-09-19T11:02:53.292Z] 11:02:53     INFO -       sp = 0x52bebd1c    pc = 0x52539a71
[task 2017-09-19T11:02:53.293Z] 11:02:53     INFO -      Found by: stack scanning
[task 2017-09-19T11:02:53.293Z] 11:02:53     INFO -  69  data@app@org.mozilla.fennec_aurora-1.apk@classes.dex + 0x139302
[task 2017-09-19T11:02:53.293Z] 11:02:53     INFO -       sp = 0x52bebd20    pc = 0x5203a304
[task 2017-09-19T11:02:53.293Z] 11:02:53     INFO -      Found by: stack scanning
[task 2017-09-19T11:02:53.294Z] 11:02:53     INFO -  70  dalvik-heap (deleted) + 0x296036
[task 2017-09-19T11:02:53.294Z] 11:02:53     INFO -       sp = 0x52bebd24    pc = 0x4174b038
[task 2017-09-19T11:02:53.294Z] 11:02:53     INFO -      Found by: stack scanning
[task 2017-09-19T11:02:53.294Z] 11:02:53     INFO -  71  data@app@org.mozilla.fennec_aurora-1.apk@classes.dex + 0x638a6f
[task 2017-09-19T11:02:53.295Z] 11:02:53     INFO -       sp = 0x52bebd28    pc = 0x52539a71
[task 2017-09-19T11:02:53.295Z] 11:02:53     INFO -      Found by: stack scanning
[task 2017-09-19T11:02:53.295Z] 11:02:53     INFO -  72  data@app@org.mozilla.fennec_aurora-1.apk@classes.dex + 0x783ffe
[task 2017-09-19T11:02:53.295Z] 11:02:53     INFO -       sp = 0x52bebd2c    pc = 0x52685000
[task 2017-09-19T11:02:53.296Z] 11:02:53     INFO -      Found by: stack scanning
[task 2017-09-19T11:02:53.296Z] 11:02:53     INFO -  73  dalvik-LinearAlloc (deleted) + 0x31f156
[task 2017-09-19T11:02:53.296Z] 11:02:53     INFO -       sp = 0x52bebd38    pc = 0x4c786158
[task 2017-09-19T11:02:53.296Z] 11:02:53     INFO -      Found by: stack scanning
[task 2017-09-19T11:02:53.297Z] 11:02:53     INFO -  74  libdvm.so + 0xa9c86
[task 2017-09-19T11:02:53.297Z] 11:02:53     INFO -       sp = 0x52bebd50    pc = 0x408e7c88
[task 2017-09-19T11:02:53.297Z] 11:02:53     INFO -      Found by: stack scanning
[task 2017-09-19T11:02:53.297Z] 11:02:53     INFO -  75  dalvik-heap (deleted) + 0x2dbc9e
[task 2017-09-19T11:02:53.298Z] 11:02:53     INFO -       sp = 0x52bebd54    pc = 0x41790ca0
[task 2017-09-19T11:02:53.298Z] 11:02:53     INFO -      Found by: stack scanning
[task 2017-09-19T11:02:53.298Z] 11:02:53     INFO -  76  libdvm.so + 0x385e3
[task 2017-09-19T11:02:53.298Z] 11:02:53     INFO -       sp = 0x52bebd58    pc = 0x408765e5
[task 2017-09-19T11:02:53.298Z] 11:02:53     INFO -      Found by: stack scanning
[task 2017-09-19T11:02:53.299Z] 11:02:53     INFO -  77  dalvik-LinearAlloc (deleted) + 0x31f156
[task 2017-09-19T11:02:53.299Z] 11:02:53     INFO -       sp = 0x52bebd64    pc = 0x4c786158
[task 2017-09-19T11:02:53.299Z] 11:02:53     INFO -      Found by: stack scanning
[task 2017-09-19T11:02:53.299Z] 11:02:53     INFO -  78  dalvik-LinearAlloc (deleted) + 0x31f156
[task 2017-09-19T11:02:53.300Z] 11:02:53     INFO -       sp = 0x52bebd68    pc = 0x4c786158
[task 2017-09-19T11:02:53.300Z] 11:02:53     INFO -      Found by: stack scanning
[task 2017-09-19T11:02:53.300Z] 11:02:53     INFO -  79  libdvm.so + 0x385d7
[task 2017-09-19T11:02:53.300Z] 11:02:53     INFO -       sp = 0x52bebd6c    pc = 0x408765d9
[task 2017-09-19T11:02:53.300Z] 11:02:53     INFO -      Found by: stack scanning
[task 2017-09-19T11:02:53.301Z] 11:02:53     INFO -  80  libdvm.so + 0xae19e
[task 2017-09-19T11:02:53.301Z] 11:02:53     INFO -       sp = 0x52bebd70    pc = 0x408ec1a0
[task 2017-09-19T11:02:53.301Z] 11:02:53     INFO -      Found by: stack scanning
[task 2017-09-19T11:02:53.301Z] 11:02:53     INFO -  81  libdvm.so + 0x4f699
[task 2017-09-19T11:02:53.302Z] 11:02:53     INFO -       sp = 0x52bebd78    pc = 0x4088d69b
[task 2017-09-19T11:02:53.302Z] 11:02:53     INFO -      Found by: stack scanning
[task 2017-09-19T11:02:53.302Z] 11:02:53     INFO -  82  data@app@org.mozilla.fennec_aurora-1.apk@classes.dex + 0x3b4b68
[task 2017-09-19T11:02:53.302Z] 11:02:53     INFO -       sp = 0x52bebd84    pc = 0x522b5b6a
[task 2017-09-19T11:02:53.302Z] 11:02:53     INFO -      Found by: stack scanning
[task 2017-09-19T11:02:53.303Z] 11:02:53     INFO -  83  dalvik-heap (deleted) + 0x296036
[task 2017-09-19T11:02:53.303Z] 11:02:53     INFO -       sp = 0x52bebd90    pc = 0x4174b038
[task 2017-09-19T11:02:53.303Z] 11:02:53     INFO -      Found by: stack scanning
[task 2017-09-19T11:02:53.303Z] 11:02:53     INFO -  84  libdvm.so + 0x1ddbe
[task 2017-09-19T11:02:53.304Z] 11:02:53     INFO -       sp = 0x52bebd94    pc = 0x4085bdc0
[task 2017-09-19T11:02:53.304Z] 11:02:53     INFO -      Found by: stack scanning
[task 2017-09-19T11:02:53.304Z] 11:02:53     INFO -  85  libdvm.so + 0x27062
[task 2017-09-19T11:02:53.304Z] 11:02:53     INFO -       sp = 0x52bebda0    pc = 0x40865064
[task 2017-09-19T11:02:53.305Z] 11:02:53     INFO -      Found by: stack scanning
[task 2017-09-19T11:02:53.305Z] 11:02:53     INFO -  86  libdvm.so + 0x2de9a
[task 2017-09-19T11:02:53.305Z] 11:02:53     INFO -       sp = 0x52bebdac    pc = 0x4086be9c
[task 2017-09-19T11:02:53.305Z] 11:02:53     INFO -      Found by: stack scanning
[task 2017-09-19T11:02:53.305Z] 11:02:53     INFO -  87  dalvik-LinearAlloc (deleted) + 0x3073d6
[task 2017-09-19T11:02:53.306Z] 11:02:53     INFO -       sp = 0x52bebdc0    pc = 0x4c76e3d8
[task 2017-09-19T11:02:53.306Z] 11:02:53     INFO -      Found by: stack scanning
[task 2017-09-19T11:02:53.306Z] 11:02:53     INFO -  88  dalvik-heap (deleted) + 0x2dbc9e
[task 2017-09-19T11:02:53.306Z] 11:02:53     INFO -       sp = 0x52bebdc4    pc = 0x41790ca0
[task 2017-09-19T11:02:53.307Z] 11:02:53     INFO -      Found by: stack scanning
[task 2017-09-19T11:02:53.307Z] 11:02:53     INFO -  89  libdvm.so + 0x2b582
[task 2017-09-19T11:02:53.307Z] 11:02:53     INFO -       sp = 0x52bebdc8    pc = 0x40869584
[task 2017-09-19T11:02:53.307Z] 11:02:53     INFO -      Found by: stack scanning
[task 2017-09-19T11:02:53.308Z] 11:02:53     INFO -  90  data@app@org.mozilla.fennec_aurora-1.apk@classes.dex + 0x5d7493
[task 2017-09-19T11:02:53.308Z] 11:02:53     INFO -       sp = 0x52bebe40    pc = 0x524d8495
[task 2017-09-19T11:02:53.308Z] 11:02:53     INFO -      Found by: stack scanning
[task 2017-09-19T11:02:53.308Z] 11:02:53     INFO -  91  dalvik-LinearAlloc (deleted) + 0x3073d6
[task 2017-09-19T11:02:53.308Z] 11:02:53     INFO -       sp = 0x52bebe4c    pc = 0x4c76e3d8
[task 2017-09-19T11:02:53.309Z] 11:02:53     INFO -      Found by: stack scanning
[task 2017-09-19T11:02:53.309Z] 11:02:53     INFO -  92  libdvm.so + 0x5fcbf
[task 2017-09-19T11:02:53.309Z] 11:02:53     INFO -       sp = 0x52bebe58    pc = 0x4089dcc1
[task 2017-09-19T11:02:53.309Z] 11:02:53     INFO -      Found by: stack scanning
[task 2017-09-19T11:02:53.310Z] 11:02:53     INFO -  93  dalvik-LinearAlloc (deleted) + 0x3073d6
[task 2017-09-19T11:02:53.310Z] 11:02:53     INFO -       sp = 0x52bebe60    pc = 0x4c76e3d8
[task 2017-09-19T11:02:53.310Z] 11:02:53     INFO -      Found by: stack scanning
[task 2017-09-19T11:02:53.310Z] 11:02:53     INFO -  94  dalvik-heap (deleted) + 0x2dbc9e
[task 2017-09-19T11:02:53.310Z] 11:02:53     INFO -       sp = 0x52bebe64    pc = 0x41790ca0
[task 2017-09-19T11:02:53.311Z] 11:02:53     INFO -      Found by: stack scanning
[task 2017-09-19T11:02:53.311Z] 11:02:53     INFO -  95  libdvm.so + 0xae19e
[task 2017-09-19T11:02:53.311Z] 11:02:53     INFO -       sp = 0x52bebe6c    pc = 0x408ec1a0
[task 2017-09-19T11:02:53.311Z] 11:02:53     INFO -      Found by: stack scanning
[task 2017-09-19T11:02:53.312Z] 11:02:53     INFO -  96  libdvm.so + 0xae4aa
[task 2017-09-19T11:02:53.312Z] 11:02:53     INFO -       sp = 0x52bebe74    pc = 0x408ec4ac
[task 2017-09-19T11:02:53.312Z] 11:02:53     INFO -      Found by: stack scanning
[task 2017-09-19T11:02:53.312Z] 11:02:53     INFO -  97  libdvm.so + 0xae4a6
[task 2017-09-19T11:02:53.312Z] 11:02:53     INFO -       sp = 0x52bebe78    pc = 0x408ec4a8
[task 2017-09-19T11:02:53.313Z] 11:02:53     INFO -      Found by: stack scanning
[task 2017-09-19T11:02:53.313Z] 11:02:53     INFO -  98  libdvm.so + 0x5fce9
[task 2017-09-19T11:02:53.313Z] 11:02:53     INFO -       sp = 0x52bebe88    pc = 0x4089dceb
[task 2017-09-19T11:02:53.313Z] 11:02:53     INFO -      Found by: stack scanning
[task 2017-09-19T11:02:53.314Z] 11:02:53     INFO -  99  libdvm.so + 0x54a71
[task 2017-09-19T11:02:53.314Z] 11:02:53     INFO -       sp = 0x52bebea4    pc = 0x40892a73
[task 2017-09-19T11:02:53.314Z] 11:02:53     INFO -      Found by: stack scanning
[task 2017-09-19T11:02:53.314Z] 11:02:53     INFO -  100  libdvm.so + 0x549cf
[task 2017-09-19T11:02:53.314Z] 11:02:53     INFO -       sp = 0x52bebedc    pc = 0x408929d1
[task 2017-09-19T11:02:53.315Z] 11:02:53     INFO -      Found by: stack scanning
[task 2017-09-19T11:02:53.315Z] 11:02:53     INFO -  101  libc.so!__thread_entry [pthread_create.cpp : 92 + 0x6]
[task 2017-09-19T11:02:53.315Z] 11:02:53     INFO -       sp = 0x52bebee8    pc = 0x40033a5c
[task 2017-09-19T11:02:53.315Z] 11:02:53     INFO -      Found by: stack scanning
[task 2017-09-19T11:02:53.316Z] 11:02:53     INFO -  102  libc.so!pthread_create [pthread_create.cpp : 201 + 0x16]
[task 2017-09-19T11:02:53.316Z] 11:02:53     INFO -       r3 = 0x2a1e7f70    r4 = 0x00000002    r5 = 0x00100000    r6 = 0x2a1e7f70
[task 2017-09-19T11:02:53.316Z] 11:02:53     INFO -       r7 = 0x00000078    sp = 0x52bebf00    pc = 0x40033bd8
[task 2017-09-19T11:02:53.316Z] 11:02:53     INFO -      Found by: call frame info

Flags: needinfo?(xidorn+moz)

Steve Fink [:sfink] [:s:]

Reporter

Comment 11

•

7 years ago

(In reply to Xidorn Quan [:xidorn] UTC+10 from comment #4)
> Actually, I don't see any hazard on Gecko_AppendMozBorderColors at all on
> m-c. Maybe some changes to the analyzer in bug 1400442 would make it harder
> to track the relation here and lead to an extra hazard alarm?

There's no hazard because it is explicitly whitelisted, both before and after my big analysis landing an hour ago. The intention was to leave this bug (blocking bug 1356458) as a record that the analysis *would* report a hazard here if it weren't whitelisted. I was expecting someone to give me an explanation of why this is a false positive and close this bug, in which case I would update the comment by the whitelisting and call it good.

But this outcome is better! Well, once it works. Please remove the whitelisting in js/src/devtools/rootAnalysis/analyzeHeapWrites.js, to ensure the analysis is happy with it. (I'm guessing it'll need some additional tweaks, since the analysis special-cases the previous mBorderColors management with pattern-matching.) Search for "bug 1400438". https://hg.mozilla.org/integration/mozilla-inbound/file/e4ac2e4268c75afeb6c3428bf0e7957287f2bd9f/js/src/devtools/rootAnalysis/analyzeHeapWrites.js#l481

Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)

Comment 12

•

7 years ago

backout bugherder

https://hg.mozilla.org/mozilla-central/rev/7d8bac06b727

Status: NEW → RESOLVED

Closed: 7 years ago

status-firefox57: --- → fixed

Resolution: --- → FIXED

Target Milestone: --- → mozilla57

Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)

Comment 13

•

7 years ago

Grr, Bugherder messed up.

Status: RESOLVED → REOPENED

status-firefox57: fixed → affected

Resolution: FIXED → ---

Target Milestone: mozilla57 → ---

Comment hidden (mozreview-request)

Comment on attachment 8909239 [details]
Bug 1400438 - Use array instead of linked list for -moz-border-*-colors.

Review request updated; see interdiff: https://reviewboard.mozilla.org/r/180832/diff/2-3/

Xidorn Quan [:xidorn] UTC+11

Assignee

Comment 15

•

7 years ago

Comment on attachment 8909239 [details]
Bug 1400438 - Use array instead of linked list for -moz-border-*-colors.

Request a re-review for the change in DrawBorderSidesCompositeColors and the new crashtest.

Flags: needinfo?(xidorn+moz)

Attachment #8909239 - Flags: review+ → review?(matt.woodrow)

Matt Woodrow (:mattwoodrow)

Comment 16

•

7 years ago

mozreview-review

Comment on attachment 8909239 [details]
Bug 1400438 - Use array instead of linked list for -moz-border-*-colors.

https://reviewboard.mozilla.org/r/180832/#review187022

Attachment #8909239 - Flags: review?(matt.woodrow) → review+

Xidorn Quan [:xidorn] UTC+11

Assignee

Comment 17

•

7 years ago

Attached file Servo PR — Details

Mozilla Autoland

Comment 18

•

7 years ago

We're sorry, Autoland could not rebase your commits for you automatically. Please manually rebase your commits and try again.

hg error in cmd: hg rebase -s 8aee7c42eda9 -d 5b56ebe80e22: rebasing 421543:8aee7c42eda9 "Bug 1400438 - Use array instead of linked list for -moz-border-*-colors. r=heycam,mattwoodrow" (tip)
merging js/src/devtools/rootAnalysis/analyzeHeapWrites.js
merging layout/painting/nsCSSRendering.cpp
merging layout/style/ServoBindings.cpp
warning: conflicts while merging js/src/devtools/rootAnalysis/analyzeHeapWrites.js! (edit, then use 'hg resolve --mark')
unresolved conflicts (see hg resolve, then hg rebase --continue)

Pulsebot

Comment 19

•

7 years ago

Pushed by xquan@mozilla.com:
https://hg.mozilla.org/integration/autoland/rev/61a277705d59
Use array instead of linked list for -moz-border-*-colors. r=heycam,mattwoodrow

Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)

Comment 20

•

7 years ago

Backed out for heap write hazard:

servo part: https://hg.mozilla.org/integration/autoland/rev/0a26b0e8ffeb6a26e0c2149091a6942e6920fb58
gecko part: https://hg.mozilla.org/integration/autoland/rev/ff6c67a5c98680051727e4e9aac42fd28ca59119

Push with failure: https://treeherder.mozilla.org/#/jobs?repo=autoland&revision=61a277705d59e27daefc3acd3a54a8798277da07&filter-resultStatus=testfailed&filter-resultStatus=busted&filter-resultStatus=exception&filter-resultStatus=retry&filter-resultStatus=usercancel&filter-resultStatus=runnable
Failure log: https://treeherder.mozilla.org/logviewer.html#?job_id=132222086&repo=autoland

[0.00s] Loading types...
[24.00s] Starting analysis...
[30.34s] Found 250 roots.
[34.95s] #90 Analyzing Gecko_CopyMozBorderColors ...
Error: Field write nsTArrayHeader.mLength
Location: _ZN13nsTArray_baseI27nsTArrayInfallibleAllocator25nsTArray_CopyWithMemutilsE9ShiftDataIS0_EEvmmmmm$void nsTArray_base<Alloc, Copy>::ShiftData(nsTArray_base<Alloc, Copy>::index_type, nsTArray_base<Alloc, Copy>::size_type, nsTArray_base<Alloc, Copy>::size_type, nsTArray_base<Alloc, Copy>::size_type, size_t) [with ActualAlloc = nsTArrayInfallibleAllocator; Alloc = nsTArrayInfallibleAllocator; Copy = nsTArray_CopyWithMemutils; nsTArray_base<Alloc, Copy>::index_type = long unsigned int; nsTArray_base<Alloc, Copy>::size_type = long unsigned int; size_t = long unsigned int] @ obj-analyzed/dist/include/nsTArray-inl.h#259 ### SafeArguments: aStart aNewLen
Stack Trace:
_ZN13nsTArray_ImplIj27nsTArrayInfallibleAllocatorE16RemoveElementsAtEmm$void nsTArray_Impl<E, Alloc>::RemoveElementsAt(nsTArray_Impl<E, Alloc>::index_type, nsTArray_Impl<E, Alloc>::size_type) [with E = unsigned int; Alloc = nsTArrayInfallibleAllocator; nsTArray_Impl<E, Alloc>::index_type = long unsigned int; nsTArray_Impl<E, Alloc>::size_type = long unsigned int] @ obj-analyzed/dist/include/nsTArray.h#2062 ### SafeArguments: aStart
_ZN13nsTArray_ImplIj27nsTArrayInfallibleAllocatorE5ClearEv$void nsTArray_Impl<E, Alloc>::Clear() [with E = unsigned int; Alloc = nsTArrayInfallibleAllocator] @ obj-analyzed/dist/include/nsTArray.h#1738
_ZN13nsStyleBorder17ClearBorderColorsEN7mozilla4SideE$void nsStyleBorder::ClearBorderColors(uint32) @ obj-analyzed/dist/include/nsStyleStruct.h#1162 ### SafeArguments: this
Gecko_CopyMozBorderColors @ layout/style/ServoBindings.cpp#1267 ### SafeArguments: aDest


[36.18s] Completed analysis, found 1/100 allowed errors

Flags: needinfo?(xidorn+moz)

Xidorn Quan [:xidorn] UTC+11

Assignee

Comment 21

•

7 years ago

I believe this new hazard is a false positive, but I have no idea how to fix it.

sfink, any idea?

Here Gecko_CopyMozBorderColors has a safe argument aDest, which is an nsStyleBorder. nsStyleBorder has a UniquePtr referring to nsBorderColors, and there is an array of nsTArray. The function nsStyleBorder::ClearBorderColors clears one of the nsTArray when the pointer is non-null.

I can't see why this is unsafe, and I believe the analyzer is supposed to handle this situation. Actually, I see that nsTArray_Impl::RemoveElementsAt is in the heapWhitelist. I have no idea what's the problem here.

Flags: needinfo?(xidorn+moz) → needinfo?(sphink)

Steve Fink [:sfink] [:s:]

Reporter

Comment 22

•

7 years ago

I think you should land this with whitelist entries for Gecko_CopyMozBorderColors and whatever else is affected, and file a separate bug for the analysis problem.

The analysis understands UniquePtr. I looked into this briefly. With the previous setup, I had to teach the analysis specifically about the border color ownership model. I was hoping this wouldn't be necessary with the switch to nsTArray, but when I skimmed it, it seemed like it probably would. I think the problem might have been that even though the memory containing the nsStyleBorder is safe, and the analysis knows enough to know that the contained nsTArray is safe, and that extends to the array contents, but it sounds like those contents may point to other memory?

But I agree, it's a false positive since it sounds like all of this stuff is exclusively owned by the nsStyleBorder, so it'd be better to land now and fix the analysis later.

Flags: needinfo?(sphink)

Xidorn Quan [:xidorn] UTC+11

Assignee

Comment 23

•

7 years ago

Well... I guess I can avoid this hazard by just inline the whole Gecko_CopyMozBorderColors into Servo side...

Comment hidden (mozreview-request)

Comment on attachment 8909239 [details]
Bug 1400438 - Use array instead of linked list for -moz-border-*-colors.

Review request updated; see interdiff: https://reviewboard.mozilla.org/r/180832/diff/3-4/

Xidorn Quan [:xidorn] UTC+11

Assignee

Comment 25

•

7 years ago

Comment on attachment 8909239 [details]
Bug 1400438 - Use array instead of linked list for -moz-border-*-colors.

Request re-review for the new function copy_moz_border_colors_from in gecko.mako.rs, which is basically a Rust rewrite of the updated Gecko_CopyMozBorderColors in previous revision of patch.

Attachment #8909239 - Flags: review+ → review?(cam)

Cameron McCormack (:heycam)

Comment 26

•

7 years ago

Comment on attachment 8909239 [details]
Bug 1400438 - Use array instead of linked list for -moz-border-*-colors.

copy_moz_border_colors_from looks fine, thanks.

Attachment #8909239 - Flags: review?(cam) → review+

Pulsebot

Comment 27

•

7 years ago

Pushed by xquan@mozilla.com:
https://hg.mozilla.org/integration/autoland/rev/0f882496ac42
Use array instead of linked list for -moz-border-*-colors. r=heycam,mattwoodrow

Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)

Comment 28

•

7 years ago

bugherder

https://hg.mozilla.org/mozilla-central/rev/0f882496ac42

Status: REOPENED → RESOLVED

Closed: 7 years ago → 7 years ago

status-firefox57: affected → fixed

Resolution: --- → FIXED

Target Milestone: --- → mozilla57

Bug 1400438 - Use array instead of linked list for -moz-border-*-colors. 7 years ago Xidorn Quan [:xidorn] UTC+11 59 bytes, text/x-review-board-request	heycam : review+ mattwoodrow : review+	Details
Servo PR 7 years ago Xidorn Quan [:xidorn] UTC+11 41 bytes, text/x-github-pull-request		Details \| Review