Closed Bug 1418997 Opened 7 years ago Closed 7 years ago

AddressSanitizer: use-after-poison [@ IsFrameModified] with READ of size 2

Categories

(Core :: Web Painting, defect, P1)

Product:
Core
Component:
Web Painting
Version:
52 Branch
Type:
defect

Tracking

()

Status:
RESOLVED FIXED
Tracking Flags:
Tracking Status
firefox-esr52 --- wontfix
firefox57 --- wontfix
firefox58 --- wontfix
firefox59 --- wontfix

People

(Reporter: jkratzer, Assigned: mattwoodrow)

References

(Blocks 2 open bugs)

Details

(5 keywords)

Attachments

(2 files)

trigger.html
11.84 KB, text/html
Details
prefs.js
9.90 KB, application/javascript
Details
Found while fuzzing mozilla-central rev dd08f8b19cc3. I don't have a reproducible testcase at this time but will update when one becomes available. ==14405==ERROR: AddressSanitizer: use-after-poison on address 0x6250026a391e at pc 0x7f2a15bc965c bp 0x7fffbf0a6e30 sp 0x7fffbf0a6e28 READ of size 2 at 0x6250026a391e thread T0 (file:// Content) #0 0x7f2a15bc965b in IsFrameModified /builds/worker/workspace/build/src/layout/generic/nsIFrame.h:4137:35 #1 0x7f2a15bc965b in IsAnyAncestorModified /builds/worker/workspace/build/src/layout/painting/RetainedDisplayListBuilder.cpp:71 #2 0x7f2a15bc965b in RetainedDisplayListBuilder::MergeDisplayLists(nsDisplayList*, nsDisplayList*, nsDisplayList*, mozilla::Maybe<mozilla::ActiveScrolledRoot const*>&) /builds/worker/workspace/build/src/layout/painting/RetainedDisplayListBuilder.cpp:464 #3 0x7f2a15bc7a27 in RetainedDisplayListBuilder::MergeDisplayLists(nsDisplayList*, nsDisplayList*, nsDisplayList*, mozilla::Maybe<mozilla::ActiveScrolledRoot const*>&) /builds/worker/workspace/build/src/layout/painting/RetainedDisplayListBuilder.cpp:468:13 #4 0x7f2a15bcc8d5 in RetainedDisplayListBuilder::AttemptPartialUpdate(unsigned int) /builds/worker/workspace/build/src/layout/painting/RetainedDisplayListBuilder.cpp:868:5 #5 0x7f2a15415f3a in nsLayoutUtils::PaintFrame(gfxContext*, nsIFrame*, nsRegion const&, unsigned int, nsDisplayListBuilderMode, nsLayoutUtils::PaintFrameFlags) /builds/worker/workspace/build/src/layout/base/nsLayoutUtils.cpp:3827:35 #6 0x7f2a1530bca4 in mozilla::PresShell::Paint(nsView*, nsRegion const&, unsigned int) /builds/worker/workspace/build/src/layout/base/PresShell.cpp:6506:5 #7 0x7f2a14aca286 in nsViewManager::ProcessPendingUpdatesPaint(nsIWidget*) /builds/worker/workspace/build/src/view/nsViewManager.cpp:480:19 #8 0x7f2a14ac912b in nsViewManager::ProcessPendingUpdatesForView(nsView*, bool) /builds/worker/workspace/build/src/view/nsViewManager.cpp:412:33 #9 0x7f2a14acc965 in nsViewManager::ProcessPendingUpdates() /builds/worker/workspace/build/src/view/nsViewManager.cpp:1102:5 #10 0x7f2a152677e5 in nsRefreshDriver::Tick(long, mozilla::TimeStamp) /builds/worker/workspace/build/src/layout/base/nsRefreshDriver.cpp:2027:11 #11 0x7f2a15272c7b in TickDriver /builds/worker/workspace/build/src/layout/base/nsRefreshDriver.cpp:336:13 #12 0x7f2a15272c7b in mozilla::RefreshDriverTimer::TickRefreshDrivers(long, mozilla::TimeStamp, nsTArray<RefPtr<nsRefreshDriver> >&) /builds/worker/workspace/build/src/layout/base/nsRefreshDriver.cpp:306 #13 0x7f2a15272976 in mozilla::RefreshDriverTimer::Tick(long, mozilla::TimeStamp) /builds/worker/workspace/build/src/layout/base/nsRefreshDriver.cpp:328:5 #14 0x7f2a15274ecb in RunRefreshDrivers /builds/worker/workspace/build/src/layout/base/nsRefreshDriver.cpp:769:5 #15 0x7f2a15274ecb in mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::TickRefreshDriver(mozilla::TimeStamp) /builds/worker/workspace/build/src/layout/base/nsRefreshDriver.cpp:682 #16 0x7f2a15274ad6 in mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::NotifyVsync(mozilla::TimeStamp) /builds/worker/workspace/build/src/layout/base/nsRefreshDriver.cpp:583:9 #17 0x7f2a15ac5c42 in mozilla::layout::VsyncChild::RecvNotify(mozilla::TimeStamp const&) /builds/worker/workspace/build/src/layout/ipc/VsyncChild.cpp:68:16 #18 0x7f2a0f5b94f1 in mozilla::layout::PVsyncChild::OnMessageReceived(IPC::Message const&) /builds/worker/workspace/build/src/obj-firefox/ipc/ipdl/PVsyncChild.cpp:155:20 #19 0x7f2a0f485a78 in mozilla::ipc::PBackgroundChild::OnMessageReceived(IPC::Message const&) /builds/worker/workspace/build/src/obj-firefox/ipc/ipdl/PBackgroundChild.cpp:1815:28 #20 0x7f2a0f0dc389 in mozilla::ipc::MessageChannel::DispatchAsyncMessage(IPC::Message const&) /builds/worker/workspace/build/src/ipc/glue/MessageChannel.cpp:2119:25 #21 0x7f2a0f0d939f in mozilla::ipc::MessageChannel::DispatchMessage(IPC::Message&&) /builds/worker/workspace/build/src/ipc/glue/MessageChannel.cpp:2049:17 #22 0x7f2a0f0daad4 in mozilla::ipc::MessageChannel::RunMessage(mozilla::ipc::MessageChannel::MessageTask&) /builds/worker/workspace/build/src/ipc/glue/MessageChannel.cpp:1895:5 #23 0x7f2a0f0db128 in mozilla::ipc::MessageChannel::MessageTask::Run() /builds/worker/workspace/build/src/ipc/glue/MessageChannel.cpp:1928:15 #24 0x7f2a0e2ee246 in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:1037:14 #25 0x7f2a0e308bc8 in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/workspace/build/src/xpcom/threads/nsThreadUtils.cpp:513:10 #26 0x7f2a0e2ecd0e in SpinEventLoopUntil<mozilla::ProcessFailureBehavior::ReportToCaller, (lambda at /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:800:22)> /builds/worker/workspace/build/src/xpcom/threads/nsThreadUtils.h:323:25 #27 0x7f2a0e2ecd0e in nsThread::Shutdown() /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:800 #28 0x7f2a1359063a in mozilla::MediaStreamGraphShutdownThreadRunnable::Run() /builds/worker/workspace/build/src/dom/media/GraphDriver.cpp:147:14 #29 0x7f2a0e2cb63b in mozilla::EventTargetWrapper::Runner::Run() /builds/worker/workspace/build/src/xpcom/threads/AbstractThread.cpp:150:32 #30 0x7f2a0e2c8911 in mozilla::SchedulerGroup::Runnable::Run() /builds/worker/workspace/build/src/xpcom/threads/SchedulerGroup.cpp:396:25 #31 0x7f2a0e2ee246 in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:1037:14 #32 0x7f2a0e308bc8 in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/workspace/build/src/xpcom/threads/nsThreadUtils.cpp:513:10 #33 0x7f2a0e2ecd0e in SpinEventLoopUntil<mozilla::ProcessFailureBehavior::ReportToCaller, (lambda at /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:800:22)> /builds/worker/workspace/build/src/xpcom/threads/nsThreadUtils.h:323:25 #34 0x7f2a0e2ecd0e in nsThread::Shutdown() /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:800 #35 0x7f2a1359063a in mozilla::MediaStreamGraphShutdownThreadRunnable::Run() /builds/worker/workspace/build/src/dom/media/GraphDriver.cpp:147:14 #36 0x7f2a0e2cb63b in mozilla::EventTargetWrapper::Runner::Run() /builds/worker/workspace/build/src/xpcom/threads/AbstractThread.cpp:150:32 #37 0x7f2a0e2c8911 in mozilla::SchedulerGroup::Runnable::Run() /builds/worker/workspace/build/src/xpcom/threads/SchedulerGroup.cpp:396:25 #38 0x7f2a0e2ee246 in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:1037:14 #39 0x7f2a0e308bc8 in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/workspace/build/src/xpcom/threads/nsThreadUtils.cpp:513:10 #40 0x7f2a0e2ecd0e in SpinEventLoopUntil<mozilla::ProcessFailureBehavior::ReportToCaller, (lambda at /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:800:22)> /builds/worker/workspace/build/src/xpcom/threads/nsThreadUtils.h:323:25 #41 0x7f2a0e2ecd0e in nsThread::Shutdown() /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:800 #42 0x7f2a1359063a in mozilla::MediaStreamGraphShutdownThreadRunnable::Run() /builds/worker/workspace/build/src/dom/media/GraphDriver.cpp:147:14 #43 0x7f2a0e2cb63b in mozilla::EventTargetWrapper::Runner::Run() /builds/worker/workspace/build/src/xpcom/threads/AbstractThread.cpp:150:32 #44 0x7f2a0e2c8911 in mozilla::SchedulerGroup::Runnable::Run() /builds/worker/workspace/build/src/xpcom/threads/SchedulerGroup.cpp:396:25 #45 0x7f2a0e2ee246 in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:1037:14 #46 0x7f2a0e308bc8 in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/workspace/build/src/xpcom/threads/nsThreadUtils.cpp:513:10 #47 0x7f2a0e2ecd0e in SpinEventLoopUntil<mozilla::ProcessFailureBehavior::ReportToCaller, (lambda at /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:800:22)> /builds/worker/workspace/build/src/xpcom/threads/nsThreadUtils.h:323:25 #48 0x7f2a0e2ecd0e in nsThread::Shutdown() /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:800 #49 0x7f2a1359063a in mozilla::MediaStreamGraphShutdownThreadRunnable::Run() /builds/worker/workspace/build/src/dom/media/GraphDriver.cpp:147:14 #50 0x7f2a0e2cb63b in mozilla::EventTargetWrapper::Runner::Run() /builds/worker/workspace/build/src/xpcom/threads/AbstractThread.cpp:150:32 #51 0x7f2a0e2c8911 in mozilla::SchedulerGroup::Runnable::Run() /builds/worker/workspace/build/src/xpcom/threads/SchedulerGroup.cpp:396:25 #52 0x7f2a0e2ee246 in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:1037:14 #53 0x7f2a0e308bc8 in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/workspace/build/src/xpcom/threads/nsThreadUtils.cpp:513:10 #54 0x7f2a0e2ecd0e in SpinEventLoopUntil<mozilla::ProcessFailureBehavior::ReportToCaller, (lambda at /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:800:22)> /builds/worker/workspace/build/src/xpcom/threads/nsThreadUtils.h:323:25 #55 0x7f2a0e2ecd0e in nsThread::Shutdown() /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:800 #56 0x7f2a1359063a in mozilla::MediaStreamGraphShutdownThreadRunnable::Run() /builds/worker/workspace/build/src/dom/media/GraphDriver.cpp:147:14 #57 0x7f2a0e2cb63b in mozilla::EventTargetWrapper::Runner::Run() /builds/worker/workspace/build/src/xpcom/threads/AbstractThread.cpp:150:32 #58 0x7f2a0e2c8911 in mozilla::SchedulerGroup::Runnable::Run() /builds/worker/workspace/build/src/xpcom/threads/SchedulerGroup.cpp:396:25 #59 0x7f2a0e2ee246 in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:1037:14 #60 0x7f2a0e308bc8 in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/workspace/build/src/xpcom/threads/nsThreadUtils.cpp:513:10 #61 0x7f2a0e2ecd0e in SpinEventLoopUntil<mozilla::ProcessFailureBehavior::ReportToCaller, (lambda at /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:800:22)> /builds/worker/workspace/build/src/xpcom/threads/nsThreadUtils.h:323:25 #62 0x7f2a0e2ecd0e in nsThread::Shutdown() /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:800 #63 0x7f2a1359063a in mozilla::MediaStreamGraphShutdownThreadRunnable::Run() /builds/worker/workspace/build/src/dom/media/GraphDriver.cpp:147:14 #64 0x7f2a0e2cb63b in mozilla::EventTargetWrapper::Runner::Run() /builds/worker/workspace/build/src/xpcom/threads/AbstractThread.cpp:150:32 #65 0x7f2a0e2c8911 in mozilla::SchedulerGroup::Runnable::Run() /builds/worker/workspace/build/src/xpcom/threads/SchedulerGroup.cpp:396:25 #66 0x7f2a0e2ee246 in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:1037:14 #67 0x7f2a0e308bc8 in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/workspace/build/src/xpcom/threads/nsThreadUtils.cpp:513:10 #68 0x7f2a0e2ecd0e in SpinEventLoopUntil<mozilla::ProcessFailureBehavior::ReportToCaller, (lambda at /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:800:22)> /builds/worker/workspace/build/src/xpcom/threads/nsThreadUtils.h:323:25 #69 0x7f2a0e2ecd0e in nsThread::Shutdown() /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:800 #70 0x7f2a1359063a in mozilla::MediaStreamGraphShutdownThreadRunnable::Run() /builds/worker/workspace/build/src/dom/media/GraphDriver.cpp:147:14 #71 0x7f2a0e2cb63b in mozilla::EventTargetWrapper::Runner::Run() /builds/worker/workspace/build/src/xpcom/threads/AbstractThread.cpp:150:32 #72 0x7f2a0e2c8911 in mozilla::SchedulerGroup::Runnable::Run() /builds/worker/workspace/build/src/xpcom/threads/SchedulerGroup.cpp:396:25 #73 0x7f2a0e2ee246 in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:1037:14 #74 0x7f2a0e308bc8 in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/workspace/build/src/xpcom/threads/nsThreadUtils.cpp:513:10 #75 0x7f2a0e2ecd0e in SpinEventLoopUntil<mozilla::ProcessFailureBehavior::ReportToCaller, (lambda at /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:800:22)> /builds/worker/workspace/build/src/xpcom/threads/nsThreadUtils.h:323:25 #76 0x7f2a0e2ecd0e in nsThread::Shutdown() /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:800 #77 0x7f2a1359063a in mozilla::MediaStreamGraphShutdownThreadRunnable::Run() /builds/worker/workspace/build/src/dom/media/GraphDriver.cpp:147:14 #78 0x7f2a0e2cb63b in mozilla::EventTargetWrapper::Runner::Run() /builds/worker/workspace/build/src/xpcom/threads/AbstractThread.cpp:150:32 #79 0x7f2a0e2c8911 in mozilla::SchedulerGroup::Runnable::Run() /builds/worker/workspace/build/src/xpcom/threads/SchedulerGroup.cpp:396:25 #80 0x7f2a0e2ee246 in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:1037:14 #81 0x7f2a0e308bc8 in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/workspace/build/src/xpcom/threads/nsThreadUtils.cpp:513:10 #82 0x7f2a0e2ecd0e in SpinEventLoopUntil<mozilla::ProcessFailureBehavior::ReportToCaller, (lambda at /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:800:22)> /builds/worker/workspace/build/src/xpcom/threads/nsThreadUtils.h:323:25 #83 0x7f2a0e2ecd0e in nsThread::Shutdown() /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:800 #84 0x7f2a1359063a in mozilla::MediaStreamGraphShutdownThreadRunnable::Run() /builds/worker/workspace/build/src/dom/media/GraphDriver.cpp:147:14 #85 0x7f2a0e2cb63b in mozilla::EventTargetWrapper::Runner::Run() /builds/worker/workspace/build/src/xpcom/threads/AbstractThread.cpp:150:32 #86 0x7f2a0e2c8911 in mozilla::SchedulerGroup::Runnable::Run() /builds/worker/workspace/build/src/xpcom/threads/SchedulerGroup.cpp:396:25 #87 0x7f2a0e2ee246 in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:1037:14 #88 0x7f2a0e308bc8 in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/workspace/build/src/xpcom/threads/nsThreadUtils.cpp:513:10 #89 0x7f2a0e2ecd0e in SpinEventLoopUntil<mozilla::ProcessFailureBehavior::ReportToCaller, (lambda at /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:800:22)> /builds/worker/workspace/build/src/xpcom/threads/nsThreadUtils.h:323:25 #90 0x7f2a0e2ecd0e in nsThread::Shutdown() /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:800 #91 0x7f2a1359063a in mozilla::MediaStreamGraphShutdownThreadRunnable::Run() /builds/worker/workspace/build/src/dom/media/GraphDriver.cpp:147:14 #92 0x7f2a0e2cb63b in mozilla::EventTargetWrapper::Runner::Run() /builds/worker/workspace/build/src/xpcom/threads/AbstractThread.cpp:150:32 #93 0x7f2a0e2c8911 in mozilla::SchedulerGroup::Runnable::Run() /builds/worker/workspace/build/src/xpcom/threads/SchedulerGroup.cpp:396:25 #94 0x7f2a0e2ee246 in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:1037:14 #95 0x7f2a0e308bc8 in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/workspace/build/src/xpcom/threads/nsThreadUtils.cpp:513:10 #96 0x7f2a0e2ecd0e in SpinEventLoopUntil<mozilla::ProcessFailureBehavior::ReportToCaller, (lambda at /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:800:22)> /builds/worker/workspace/build/src/xpcom/threads/nsThreadUtils.h:323:25 #97 0x7f2a0e2ecd0e in nsThread::Shutdown() /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:800 #98 0x7f2a1359063a in mozilla::MediaStreamGraphShutdownThreadRunnable::Run() /builds/worker/workspace/build/src/dom/media/GraphDriver.cpp:147:14 #99 0x7f2a0e2cb63b in mozilla::EventTargetWrapper::Runner::Run() /builds/worker/workspace/build/src/xpcom/threads/AbstractThread.cpp:150:32 #100 0x7f2a0e2c8911 in mozilla::SchedulerGroup::Runnable::Run() /builds/worker/workspace/build/src/xpcom/threads/SchedulerGroup.cpp:396:25 #101 0x7f2a0e2ee246 in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:1037:14 #102 0x7f2a0e308bc8 in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/workspace/build/src/xpcom/threads/nsThreadUtils.cpp:513:10 #103 0x7f2a0e2ecd0e in SpinEventLoopUntil<mozilla::ProcessFailureBehavior::ReportToCaller, (lambda at /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:800:22)> /builds/worker/workspace/build/src/xpcom/threads/nsThreadUtils.h:323:25 #104 0x7f2a0e2ecd0e in nsThread::Shutdown() /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:800 #105 0x7f2a1359063a in mozilla::MediaStreamGraphShutdownThreadRunnable::Run() /builds/worker/workspace/build/src/dom/media/GraphDriver.cpp:147:14 #106 0x7f2a0e2cb63b in mozilla::EventTargetWrapper::Runner::Run() /builds/worker/workspace/build/src/xpcom/threads/AbstractThread.cpp:150:32 #107 0x7f2a0e2c8911 in mozilla::SchedulerGroup::Runnable::Run() /builds/worker/workspace/build/src/xpcom/threads/SchedulerGroup.cpp:396:25 #108 0x7f2a0e2ee246 in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:1037:14 #109 0x7f2a0e308bc8 in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/workspace/build/src/xpcom/threads/nsThreadUtils.cpp:513:10 #110 0x7f2a0e2ecd0e in SpinEventLoopUntil<mozilla::ProcessFailureBehavior::ReportToCaller, (lambda at /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:800:22)> /builds/worker/workspace/build/src/xpcom/threads/nsThreadUtils.h:323:25 #111 0x7f2a0e2ecd0e in nsThread::Shutdown() /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:800 #112 0x7f2a1359063a in mozilla::MediaStreamGraphShutdownThreadRunnable::Run() /builds/worker/workspace/build/src/dom/media/GraphDriver.cpp:147:14 #113 0x7f2a0e2cb63b in mozilla::EventTargetWrapper::Runner::Run() /builds/worker/workspace/build/src/xpcom/threads/AbstractThread.cpp:150:32 #114 0x7f2a0e2c8911 in mozilla::SchedulerGroup::Runnable::Run() /builds/worker/workspace/build/src/xpcom/threads/SchedulerGroup.cpp:396:25 #115 0x7f2a0e2ee246 in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:1037:14 #116 0x7f2a0e308bc8 in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/workspace/build/src/xpcom/threads/nsThreadUtils.cpp:513:10 #117 0x7f2a0e2ecd0e in SpinEventLoopUntil<mozilla::ProcessFailureBehavior::ReportToCaller, (lambda at /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:800:22)> /builds/worker/workspace/build/src/xpcom/threads/nsThreadUtils.h:323:25 #118 0x7f2a0e2ecd0e in nsThread::Shutdown() /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:800 #119 0x7f2a1359063a in mozilla::MediaStreamGraphShutdownThreadRunnable::Run() /builds/worker/workspace/build/src/dom/media/GraphDriver.cpp:147:14 #120 0x7f2a0e2cb63b in mozilla::EventTargetWrapper::Runner::Run() /builds/worker/workspace/build/src/xpcom/threads/AbstractThread.cpp:150:32 #121 0x7f2a0e2c8911 in mozilla::SchedulerGroup::Runnable::Run() /builds/worker/workspace/build/src/xpcom/threads/SchedulerGroup.cpp:396:25 #122 0x7f2a0e2ee246 in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:1037:14 #123 0x7f2a0e308bc8 in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/workspace/build/src/xpcom/threads/nsThreadUtils.cpp:513:10 #124 0x7f2a0e2ecd0e in SpinEventLoopUntil<mozilla::ProcessFailureBehavior::ReportToCaller, (lambda at /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:800:22)> /builds/worker/workspace/build/src/xpcom/threads/nsThreadUtils.h:323:25 #125 0x7f2a0e2ecd0e in nsThread::Shutdown() /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:800 #126 0x7f2a1359063a in mozilla::MediaStreamGraphShutdownThreadRunnable::Run() /builds/worker/workspace/build/src/dom/media/GraphDriver.cpp:147:14 #127 0x7f2a0e2cb63b in mozilla::EventTargetWrapper::Runner::Run() /builds/worker/workspace/build/src/xpcom/threads/AbstractThread.cpp:150:32 #128 0x7f2a0e2c8911 in mozilla::SchedulerGroup::Runnable::Run() /builds/worker/workspace/build/src/xpcom/threads/SchedulerGroup.cpp:396:25 #129 0x7f2a0e2ee246 in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:1037:14 #130 0x7f2a0e308bc8 in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/workspace/build/src/xpcom/threads/nsThreadUtils.cpp:513:10 #131 0x7f2a0e2ecd0e in SpinEventLoopUntil<mozilla::ProcessFailureBehavior::ReportToCaller, (lambda at /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:800:22)> /builds/worker/workspace/build/src/xpcom/threads/nsThreadUtils.h:323:25 #132 0x7f2a0e2ecd0e in nsThread::Shutdown() /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:800 #133 0x7f2a1359063a in mozilla::MediaStreamGraphShutdownThreadRunnable::Run() /builds/worker/workspace/build/src/dom/media/GraphDriver.cpp:147:14 #134 0x7f2a0e2cb63b in mozilla::EventTargetWrapper::Runner::Run() /builds/worker/workspace/build/src/xpcom/threads/AbstractThread.cpp:150:32 #135 0x7f2a0e2c8911 in mozilla::SchedulerGroup::Runnable::Run() /builds/worker/workspace/build/src/xpcom/threads/SchedulerGroup.cpp:396:25 #136 0x7f2a0e2ee246 in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:1037:14 #137 0x7f2a0e308bc8 in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/workspace/build/src/xpcom/threads/nsThreadUtils.cpp:513:10 #138 0x7f2a0e2ecd0e in SpinEventLoopUntil<mozilla::ProcessFailureBehavior::ReportToCaller, (lambda at /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:800:22)> /builds/worker/workspace/build/src/xpcom/threads/nsThreadUtils.h:323:25 #139 0x7f2a0e2ecd0e in nsThread::Shutdown() /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:800 #140 0x7f2a1359063a in mozilla::MediaStreamGraphShutdownThreadRunnable::Run() /builds/worker/workspace/build/src/dom/media/GraphDriver.cpp:147:14 #141 0x7f2a0e2cb63b in mozilla::EventTargetWrapper::Runner::Run() /builds/worker/workspace/build/src/xpcom/threads/AbstractThread.cpp:150:32 #142 0x7f2a0e2c8911 in mozilla::SchedulerGroup::Runnable::Run() /builds/worker/workspace/build/src/xpcom/threads/SchedulerGroup.cpp:396:25 #143 0x7f2a0e2ee246 in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:1037:14 #144 0x7f2a0e308bc8 in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/workspace/build/src/xpcom/threads/nsThreadUtils.cpp:513:10 #145 0x7f2a0e2ecd0e in SpinEventLoopUntil<mozilla::ProcessFailureBehavior::ReportToCaller, (lambda at /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:800:22)> /builds/worker/workspace/build/src/xpcom/threads/nsThreadUtils.h:323:25 #146 0x7f2a0e2ecd0e in nsThread::Shutdown() /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:800 #147 0x7f2a1359063a in mozilla::MediaStreamGraphShutdownThreadRunnable::Run() /builds/worker/workspace/build/src/dom/media/GraphDriver.cpp:147:14 #148 0x7f2a0e2cb63b in mozilla::EventTargetWrapper::Runner::Run() /builds/worker/workspace/build/src/xpcom/threads/AbstractThread.cpp:150:32 #149 0x7f2a0e2c8911 in mozilla::SchedulerGroup::Runnable::Run() /builds/worker/workspace/build/src/xpcom/threads/SchedulerGroup.cpp:396:25 #150 0x7f2a0e2ee246 in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:1037:14 #151 0x7f2a0e308bc8 in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/workspace/build/src/xpcom/threads/nsThreadUtils.cpp:513:10 #152 0x7f2a0e2ecd0e in SpinEventLoopUntil<mozilla::ProcessFailureBehavior::ReportToCaller, (lambda at /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:800:22)> /builds/worker/workspace/build/src/xpcom/threads/nsThreadUtils.h:323:25 #153 0x7f2a0e2ecd0e in nsThread::Shutdown() /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:800 #154 0x7f2a1359063a in mozilla::MediaStreamGraphShutdownThreadRunnable::Run() /builds/worker/workspace/build/src/dom/media/GraphDriver.cpp:147:14 #155 0x7f2a0e2cb63b in mozilla::EventTargetWrapper::Runner::Run() /builds/worker/workspace/build/src/xpcom/threads/AbstractThread.cpp:150:32 #156 0x7f2a0e2c8911 in mozilla::SchedulerGroup::Runnable::Run() /builds/worker/workspace/build/src/xpcom/threads/SchedulerGroup.cpp:396:25 #157 0x7f2a0e2ee246 in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:1037:14 #158 0x7f2a0e308bc8 in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/workspace/build/src/xpcom/threads/nsThreadUtils.cpp:513:10 #159 0x7f2a0e2ecd0e in SpinEventLoopUntil<mozilla::ProcessFailureBehavior::ReportToCaller, (lambda at /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:800:22)> /builds/worker/workspace/build/src/xpcom/threads/nsThreadUtils.h:323:25 #160 0x7f2a0e2ecd0e in nsThread::Shutdown() /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:800 #161 0x7f2a1359063a in mozilla::MediaStreamGraphShutdownThreadRunnable::Run() /builds/worker/workspace/build/src/dom/media/GraphDriver.cpp:147:14 #162 0x7f2a0e2cb63b in mozilla::EventTargetWrapper::Runner::Run() /builds/worker/workspace/build/src/xpcom/threads/AbstractThread.cpp:150:32 #163 0x7f2a0e2c8911 in mozilla::SchedulerGroup::Runnable::Run() /builds/worker/workspace/build/src/xpcom/threads/SchedulerGroup.cpp:396:25 #164 0x7f2a0e2ee246 in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:1037:14 #165 0x7f2a0e308bc8 in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/workspace/build/src/xpcom/threads/nsThreadUtils.cpp:513:10 #166 0x7f2a0e2ecd0e in SpinEventLoopUntil<mozilla::ProcessFailureBehavior::ReportToCaller, (lambda at /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:800:22)> /builds/worker/workspace/build/src/xpcom/threads/nsThreadUtils.h:323:25 #167 0x7f2a0e2ecd0e in nsThread::Shutdown() /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:800 #168 0x7f2a1359063a in mozilla::MediaStreamGraphShutdownThreadRunnable::Run() /builds/worker/workspace/build/src/dom/media/GraphDriver.cpp:147:14 #169 0x7f2a0e2cb63b in mozilla::EventTargetWrapper::Runner::Run() /builds/worker/workspace/build/src/xpcom/threads/AbstractThread.cpp:150:32 #170 0x7f2a0e2c8911 in mozilla::SchedulerGroup::Runnable::Run() /builds/worker/workspace/build/src/xpcom/threads/SchedulerGroup.cpp:396:25 #171 0x7f2a0e2ee246 in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:1037:14 #172 0x7f2a0e308bc8 in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/workspace/build/src/xpcom/threads/nsThreadUtils.cpp:513:10 #173 0x7f2a0e2ecd0e in SpinEventLoopUntil<mozilla::ProcessFailureBehavior::ReportToCaller, (lambda at /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:800:22)> /builds/worker/workspace/build/src/xpcom/threads/nsThreadUtils.h:323:25 #174 0x7f2a0e2ecd0e in nsThread::Shutdown() /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:800 #175 0x7f2a1359063a in mozilla::MediaStreamGraphShutdownThreadRunnable::Run() /builds/worker/workspace/build/src/dom/media/GraphDriver.cpp:147:14 #176 0x7f2a0e2cb63b in mozilla::EventTargetWrapper::Runner::Run() /builds/worker/workspace/build/src/xpcom/threads/AbstractThread.cpp:150:32 #177 0x7f2a0e2c8911 in mozilla::SchedulerGroup::Runnable::Run() /builds/worker/workspace/build/src/xpcom/threads/SchedulerGroup.cpp:396:25 #178 0x7f2a0e2ee246 in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:1037:14 #179 0x7f2a0e308bc8 in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/workspace/build/src/xpcom/threads/nsThreadUtils.cpp:513:10 #180 0x7f2a0e2ecd0e in SpinEventLoopUntil<mozilla::ProcessFailureBehavior::ReportToCaller, (lambda at /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:800:22)> /builds/worker/workspace/build/src/xpcom/threads/nsThreadUtils.h:323:25 #181 0x7f2a0e2ecd0e in nsThread::Shutdown() /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:800 #182 0x7f2a1359063a in mozilla::MediaStreamGraphShutdownThreadRunnable::Run() /builds/worker/workspace/build/src/dom/media/GraphDriver.cpp:147:14 #183 0x7f2a0e2cb63b in mozilla::EventTargetWrapper::Runner::Run() /builds/worker/workspace/build/src/xpcom/threads/AbstractThread.cpp:150:32 #184 0x7f2a0e2c8911 in mozilla::SchedulerGroup::Runnable::Run() /builds/worker/workspace/build/src/xpcom/threads/SchedulerGroup.cpp:396:25 #185 0x7f2a0e2ee246 in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:1037:14 #186 0x7f2a0e308bc8 in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/workspace/build/src/xpcom/threads/nsThreadUtils.cpp:513:10 #187 0x7f2a0e2ecd0e in SpinEventLoopUntil<mozilla::ProcessFailureBehavior::ReportToCaller, (lambda at /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:800:22)> /builds/worker/workspace/build/src/xpcom/threads/nsThreadUtils.h:323:25 #188 0x7f2a0e2ecd0e in nsThread::Shutdown() /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:800 #189 0x7f2a1359063a in mozilla::MediaStreamGraphShutdownThreadRunnable::Run() /builds/worker/workspace/build/src/dom/media/GraphDriver.cpp:147:14 #190 0x7f2a0e2cb63b in mozilla::EventTargetWrapper::Runner::Run() /builds/worker/workspace/build/src/xpcom/threads/AbstractThread.cpp:150:32 #191 0x7f2a0e2c8911 in mozilla::SchedulerGroup::Runnable::Run() /builds/worker/workspace/build/src/xpcom/threads/SchedulerGroup.cpp:396:25 #192 0x7f2a0e2ee246 in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:1037:14 #193 0x7f2a0e308bc8 in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/workspace/build/src/xpcom/threads/nsThreadUtils.cpp:513:10 #194 0x7f2a0e2ecd0e in SpinEventLoopUntil<mozilla::ProcessFailureBehavior::ReportToCaller, (lambda at /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:800:22)> /builds/worker/workspace/build/src/xpcom/threads/nsThreadUtils.h:323:25 #195 0x7f2a0e2ecd0e in nsThread::Shutdown() /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:800 #196 0x7f2a1359063a in mozilla::MediaStreamGraphShutdownThreadRunnable::Run() /builds/worker/workspace/build/src/dom/media/GraphDriver.cpp:147:14 #197 0x7f2a0e2cb63b in mozilla::EventTargetWrapper::Runner::Run() /builds/worker/workspace/build/src/xpcom/threads/AbstractThread.cpp:150:32 #198 0x7f2a0e2c8911 in mozilla::SchedulerGroup::Runnable::Run() /builds/worker/workspace/build/src/xpcom/threads/SchedulerGroup.cpp:396:25 #199 0x7f2a0e2ee246 in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:1037:14 #200 0x7f2a0e308bc8 in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/workspace/build/src/xpcom/threads/nsThreadUtils.cpp:513:10 #201 0x7f2a0e2ecd0e in SpinEventLoopUntil<mozilla::ProcessFailureBehavior::ReportToCaller, (lambda at /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:800:22)> /builds/worker/workspace/build/src/xpcom/threads/nsThreadUtils.h:323:25 #202 0x7f2a0e2ecd0e in nsThread::Shutdown() /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:800 #203 0x7f2a1359063a in mozilla::MediaStreamGraphShutdownThreadRunnable::Run() /builds/worker/workspace/build/src/dom/media/GraphDriver.cpp:147:14 #204 0x7f2a0e2cb63b in mozilla::EventTargetWrapper::Runner::Run() /builds/worker/workspace/build/src/xpcom/threads/AbstractThread.cpp:150:32 #205 0x7f2a0e2c8911 in mozilla::SchedulerGroup::Runnable::Run() /builds/worker/workspace/build/src/xpcom/threads/SchedulerGroup.cpp:396:25 #206 0x7f2a0e2ee246 in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:1037:14 #207 0x7f2a0e308bc8 in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/workspace/build/src/xpcom/threads/nsThreadUtils.cpp:513:10 #208 0x7f2a0e2ecd0e in SpinEventLoopUntil<mozilla::ProcessFailureBehavior::ReportToCaller, (lambda at /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:800:22)> /builds/worker/workspace/build/src/xpcom/threads/nsThreadUtils.h:323:25 #209 0x7f2a0e2ecd0e in nsThread::Shutdown() /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:800 #210 0x7f2a1359063a in mozilla::MediaStreamGraphShutdownThreadRunnable::Run() /builds/worker/workspace/build/src/dom/media/GraphDriver.cpp:147:14 #211 0x7f2a0e2cb63b in mozilla::EventTargetWrapper::Runner::Run() /builds/worker/workspace/build/src/xpcom/threads/AbstractThread.cpp:150:32 #212 0x7f2a0e2c8911 in mozilla::SchedulerGroup::Runnable::Run() /builds/worker/workspace/build/src/xpcom/threads/SchedulerGroup.cpp:396:25 #213 0x7f2a0e2ee246 in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:1037:14 #214 0x7f2a0e308bc8 in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/workspace/build/src/xpcom/threads/nsThreadUtils.cpp:513:10 #215 0x7f2a0e2ecd0e in SpinEventLoopUntil<mozilla::ProcessFailureBehavior::ReportToCaller, (lambda at /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:800:22)> /builds/worker/workspace/build/src/xpcom/threads/nsThreadUtils.h:323:25 #216 0x7f2a0e2ecd0e in nsThread::Shutdown() /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:800 #217 0x7f2a1359063a in mozilla::MediaStreamGraphShutdownThreadRunnable::Run() /builds/worker/workspace/build/src/dom/media/GraphDriver.cpp:147:14 #218 0x7f2a0e2cb63b in mozilla::EventTargetWrapper::Runner::Run() /builds/worker/workspace/build/src/xpcom/threads/AbstractThread.cpp:150:32 #219 0x7f2a0e2c8911 in mozilla::SchedulerGroup::Runnable::Run() /builds/worker/workspace/build/src/xpcom/threads/SchedulerGroup.cpp:396:25 #220 0x7f2a0e2ee246 in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:1037:14 #221 0x7f2a0e308bc8 in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/workspace/build/src/xpcom/threads/nsThreadUtils.cpp:513:10 #222 0x7f2a0e2ecd0e in SpinEventLoopUntil<mozilla::ProcessFailureBehavior::ReportToCaller, (lambda at /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:800:22)> /builds/worker/workspace/build/src/xpcom/threads/nsThreadUtils.h:323:25 #223 0x7f2a0e2ecd0e in nsThread::Shutdown() /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:800 #224 0x7f2a1359063a in mozilla::MediaStreamGraphShutdownThreadRunnable::Run() /builds/worker/workspace/build/src/dom/media/GraphDriver.cpp:147:14 #225 0x7f2a0e2cb63b in mozilla::EventTargetWrapper::Runner::Run() /builds/worker/workspace/build/src/xpcom/threads/AbstractThread.cpp:150:32 #226 0x7f2a0e2c8911 in mozilla::SchedulerGroup::Runnable::Run() /builds/worker/workspace/build/src/xpcom/threads/SchedulerGroup.cpp:396:25 #227 0x7f2a0e2ee246 in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:1037:14 #228 0x7f2a0e308bc8 in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/workspace/build/src/xpcom/threads/nsThreadUtils.cpp:513:10 #229 0x7f2a0e2ecd0e in SpinEventLoopUntil<mozilla::ProcessFailureBehavior::ReportToCaller, (lambda at /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:800:22)> /builds/worker/workspace/build/src/xpcom/threads/nsThreadUtils.h:323:25 #230 0x7f2a0e2ecd0e in nsThread::Shutdown() /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:800 #231 0x7f2a1359063a in mozilla::MediaStreamGraphShutdownThreadRunnable::Run() /builds/worker/workspace/build/src/dom/media/GraphDriver.cpp:147:14 #232 0x7f2a0e2cb63b in mozilla::EventTargetWrapper::Runner::Run() /builds/worker/workspace/build/src/xpcom/threads/AbstractThread.cpp:150:32 #233 0x7f2a0e2c8911 in mozilla::SchedulerGroup::Runnable::Run() /builds/worker/workspace/build/src/xpcom/threads/SchedulerGroup.cpp:396:25 #234 0x7f2a0e2ee246 in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:1037:14 #235 0x7f2a0e308bc8 in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/workspace/build/src/xpcom/threads/nsThreadUtils.cpp:513:10 #236 0x7f2a0e2ecd0e in SpinEventLoopUntil<mozilla::ProcessFailureBehavior::ReportToCaller, (lambda at /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:800:22)> /builds/worker/workspace/build/src/xpcom/threads/nsThreadUtils.h:323:25 #237 0x7f2a0e2ecd0e in nsThread::Shutdown() /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:800 #238 0x7f2a1359063a in mozilla::MediaStreamGraphShutdownThreadRunnable::Run() /builds/worker/workspace/build/src/dom/media/GraphDriver.cpp:147:14 #239 0x7f2a0e2cb63b in mozilla::EventTargetWrapper::Runner::Run() /builds/worker/workspace/build/src/xpcom/threads/AbstractThread.cpp:150:32 #240 0x7f2a0e2c8911 in mozilla::SchedulerGroup::Runnable::Run() /builds/worker/workspace/build/src/xpcom/threads/SchedulerGroup.cpp:396:25 #241 0x7f2a0e2ee246 in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:1037:14 #242 0x7f2a0e308bc8 in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/workspace/build/src/xpcom/threads/nsThreadUtils.cpp:513:10 #243 0x7f2a0e2ecd0e in SpinEventLoopUntil<mozilla::ProcessFailureBehavior::ReportToCaller, (lambda at /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:800:22)> /builds/worker/workspace/build/src/xpcom/threads/nsThreadUtils.h:323:25 #244 0x7f2a0e2ecd0e in nsThread::Shutdown() /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:800 #245 0x7f2a1359063a in mozilla::MediaStreamGraphShutdownThreadRunnable::Run() /builds/worker/workspace/build/src/dom/media/GraphDriver.cpp:147:14 #246 0x7f2a0e2cb63b in mozilla::EventTargetWrapper::Runner::Run() /builds/worker/workspace/build/src/xpcom/threads/AbstractThread.cpp:150:32 #247 0x7f2a0e2c8911 in mozilla::SchedulerGroup::Runnable::Run() /builds/worker/workspace/build/src/xpcom/threads/SchedulerGroup.cpp:396:25 #248 0x7f2a0e2ee246 in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:1037:14 #249 0x7f2a0e308bc8 in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/workspace/build/src/xpcom/threads/nsThreadUtils.cpp:513:10 #250 0x7f2a0e2ecd0e in SpinEventLoopUntil<mozilla::ProcessFailureBehavior::ReportToCaller, (lambda at /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:800:22)> /builds/worker/workspace/build/src/xpcom/threads/nsThreadUtils.h:323:25 #251 0x7f2a0e2ecd0e in nsThread::Shutdown() /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:800 #252 0x7f2a1359063a in mozilla::MediaStreamGraphShutdownThreadRunnable::Run() /builds/worker/workspace/build/src/dom/media/GraphDriver.cpp:147:14 #253 0x7f2a0e2cb63b in mozilla::EventTargetWrapper::Runner::Run() /builds/worker/workspace/build/src/xpcom/threads/AbstractThread.cpp:150:32 #254 0x7f2a0e2c8911 in mozilla::SchedulerGroup::Runnable::Run() /builds/worker/workspace/build/src/xpcom/threads/SchedulerGroup.cpp:396:25 #255 0x7f2a0e2ee246 in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:1037:14 #256 0x7f2a0e308bc8 in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/workspace/build/src/xpcom/threads/nsThreadUtils.cpp:513:10 #257 0x7f2a0e2ecd0e in SpinEventLoopUntil<mozilla::ProcessFailureBehavior::ReportToCaller, (lambda at /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:800:22)> /builds/worker/workspace/build/src/xpcom/threads/nsThreadUtils.h:323:25 #258 0x7f2a0e2ecd0e in nsThread::Shutdown() /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:800 #259 0x7f2a1359063a in mozilla::MediaStreamGraphShutdownThreadRunnable::Run() /builds/worker/workspace/build/src/dom/media/GraphDriver.cpp:147:14 #260 0x7f2a0e2cb63b in mozilla::EventTargetWrapper::Runner::Run() /builds/worker/workspace/build/src/xpcom/threads/AbstractThread.cpp:150:32 #261 0x7f2a0e2c8911 in mozilla::SchedulerGroup::Runnable::Run() /builds/worker/workspace/build/src/xpcom/threads/SchedulerGroup.cpp:396:25 #262 0x7f2a0e2ee246 in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:1037:14 #263 0x7f2a0e308bc8 in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/workspace/build/src/xpcom/threads/nsThreadUtils.cpp:513:10 #264 0x7f2a0e2ecd0e in SpinEventLoopUntil<mozilla::ProcessFailureBehavior::ReportToCaller, (lambda at /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:800:22)> /builds/worker/workspace/build/src/xpcom/threads/nsThreadUtils.h:323:25 #265 0x7f2a0e2ecd0e in nsThread::Shutdown() /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:800 #266 0x7f2a1359063a in mozilla::MediaStreamGraphShutdownThreadRunnable::Run() /builds/worker/workspace/build/src/dom/media/GraphDriver.cpp:147:14 #267 0x7f2a0e2cb63b in mozilla::EventTargetWrapper::Runner::Run() /builds/worker/workspace/build/src/xpcom/threads/AbstractThread.cpp:150:32 #268 0x7f2a0e2c8911 in mozilla::SchedulerGroup::Runnable::Run() /builds/worker/workspace/build/src/xpcom/threads/SchedulerGroup.cpp:396:25 #269 0x7f2a0e2ee246 in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:1037:14 #270 0x7f2a0e308bc8 in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/workspace/build/src/xpcom/threads/nsThreadUtils.cpp:513:10 #271 0x7f2a0e2ecd0e in SpinEventLoopUntil<mozilla::ProcessFailureBehavior::ReportToCaller, (lambda at /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:800:22)> /builds/worker/workspace/build/src/xpcom/threads/nsThreadUtils.h:323:25 #272 0x7f2a0e2ecd0e in nsThread::Shutdown() /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:800 #273 0x7f2a1359063a in mozilla::MediaStreamGraphShutdownThreadRunnable::Run() /builds/worker/workspace/build/src/dom/media/GraphDriver.cpp:147:14 #274 0x7f2a0e2cb63b in mozilla::EventTargetWrapper::Runner::Run() /builds/worker/workspace/build/src/xpcom/threads/AbstractThread.cpp:150:32 #275 0x7f2a0e2c8911 in mozilla::SchedulerGroup::Runnable::Run() /builds/worker/workspace/build/src/xpcom/threads/SchedulerGroup.cpp:396:25 #276 0x7f2a0e2ee246 in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:1037:14 #277 0x7f2a0e308bc8 in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/workspace/build/src/xpcom/threads/nsThreadUtils.cpp:513:10 #278 0x7f2a0e2ecd0e in SpinEventLoopUntil<mozilla::ProcessFailureBehavior::ReportToCaller, (lambda at /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:800:22)> /builds/worker/workspace/build/src/xpcom/threads/nsThreadUtils.h:323:25 #279 0x7f2a0e2ecd0e in nsThread::Shutdown() /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:800 #280 0x7f2a1359063a in mozilla::MediaStreamGraphShutdownThreadRunnable::Run() /builds/worker/workspace/build/src/dom/media/GraphDriver.cpp:147:14 #281 0x7f2a0e2cb63b in mozilla::EventTargetWrapper::Runner::Run() /builds/worker/workspace/build/src/xpcom/threads/AbstractThread.cpp:150:32 #282 0x7f2a0e2c8911 in mozilla::SchedulerGroup::Runnable::Run() /builds/worker/workspace/build/src/xpcom/threads/SchedulerGroup.cpp:396:25 #283 0x7f2a0e2ee246 in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:1037:14 #284 0x7f2a0e308bc8 in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/workspace/build/src/xpcom/threads/nsThreadUtils.cpp:513:10 #285 0x7f2a0e2ecd0e in SpinEventLoopUntil<mozilla::ProcessFailureBehavior::ReportToCaller, (lambda at /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:800:22)> /builds/worker/workspace/build/src/xpcom/threads/nsThreadUtils.h:323:25 #286 0x7f2a0e2ecd0e in nsThread::Shutdown() /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:800 #287 0x7f2a1359063a in mozilla::MediaStreamGraphShutdownThreadRunnable::Run() /builds/worker/workspace/build/src/dom/media/GraphDriver.cpp:147:14 #288 0x7f2a0e2cb63b in mozilla::EventTargetWrapper::Runner::Run() /builds/worker/workspace/build/src/xpcom/threads/AbstractThread.cpp:150:32 #289 0x7f2a0e2c8911 in mozilla::SchedulerGroup::Runnable::Run() /builds/worker/workspace/build/src/xpcom/threads/SchedulerGroup.cpp:396:25 #290 0x7f2a0e2ee246 in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:1037:14 #291 0x7f2a0e308bc8 in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/workspace/build/src/xpcom/threads/nsThreadUtils.cpp:513:10 #292 0x7f2a0e2ecd0e in SpinEventLoopUntil<mozilla::ProcessFailureBehavior::ReportToCaller, (lambda at /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:800:22)> /builds/worker/workspace/build/src/xpcom/threads/nsThreadUtils.h:323:25 #293 0x7f2a0e2ecd0e in nsThread::Shutdown() /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:800 #294 0x7f2a1359063a in mozilla::MediaStreamGraphShutdownThreadRunnable::Run() /builds/worker/workspace/build/src/dom/media/GraphDriver.cpp:147:14 #295 0x7f2a0e2cb63b in mozilla::EventTargetWrapper::Runner::Run() /builds/worker/workspace/build/src/xpcom/threads/AbstractThread.cpp:150:32 0x6250026a391e is located 6174 bytes inside of 8192-byte region [0x6250026a2100,0x6250026a4100) allocated by thread T0 (file:// Content) here: #0 0x4bbc8c in malloc /builds/worker/workspace/moz-toolchain/src/llvm/projects/compiler-rt/lib/asan/asan_malloc_linux.cc:64:3 #1 0x7f2a0e2a1973 in AllocateChunk /builds/worker/workspace/build/src/obj-firefox/dist/include/mozilla/ArenaAllocator.h:193:15 #2 0x7f2a0e2a1973 in InternalAllocate /builds/worker/workspace/build/src/obj-firefox/dist/include/mozilla/ArenaAllocator.h:228 #3 0x7f2a0e2a1973 in Allocate /builds/worker/workspace/build/src/obj-firefox/dist/include/mozilla/ArenaAllocator.h:75 #4 0x7f2a0e2a1973 in mozilla::ArenaAllocator<8192ul, 8ul>::Allocate(unsigned long) /builds/worker/workspace/build/src/obj-firefox/dist/include/mozilla/ArenaAllocator.h:80 #5 0x7f2a15758ecc in AllocateByFrameID /builds/worker/workspace/build/src/layout/base/nsPresArena.h:39:12 #6 0x7f2a15758ecc in AllocateFrame /builds/worker/workspace/build/src/obj-firefox/dist/include/nsIPresShell.h:205 #7 0x7f2a15758ecc in operator new /builds/worker/workspace/build/src/layout/generic/nsTextFrame.cpp:4680 #8 0x7f2a15758ecc in NS_NewContinuingTextFrame(nsIPresShell*, nsStyleContext*) /builds/worker/workspace/build/src/layout/generic/nsTextFrame.cpp:4677 #9 0x7f2a153ac2fb in nsCSSFrameConstructor::CreateContinuingFrame(nsPresContext*, nsIFrame*, nsContainerFrame*, bool) /builds/worker/workspace/build/src/layout/base/nsCSSFrameConstructor.cpp:9183:16 #10 0x7f2a15357584 in CreateContinuation(nsIFrame*, nsIFrame**, bool) /builds/worker/workspace/build/src/layout/base/nsBidiPresUtils.cpp:653:5 #11 0x7f2a15354788 in EnsureBidiContinuation /builds/worker/workspace/build/src/layout/base/nsBidiPresUtils.cpp:1865:10 #12 0x7f2a15354788 in nsBidiPresUtils::ResolveParagraph(BidiParagraphData*) /builds/worker/workspace/build/src/layout/base/nsBidiPresUtils.cpp:924 #13 0x7f2a1535253c in ResolveParagraphWithinBlock /builds/worker/workspace/build/src/layout/base/nsBidiPresUtils.cpp:1347:3 #14 0x7f2a1535253c in nsBidiPresUtils::TraverseFrames(nsBlockInFlowLineIterator*, nsIFrame*, BidiParagraphData*) /builds/worker/workspace/build/src/layout/base/nsBidiPresUtils.cpp:1255 #15 0x7f2a1534ea06 in nsBidiPresUtils::Resolve(nsBlockFrame*) /builds/worker/workspace/build/src/layout/base/nsBidiPresUtils.cpp:752:5 #16 0x7f2a15502a69 in ResolveBidi /builds/worker/workspace/build/src/layout/generic/nsBlockFrame.cpp:7526:10 #17 0x7f2a15502a69 in nsBlockFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) /builds/worker/workspace/build/src/layout/generic/nsBlockFrame.cpp:1189 #18 0x7f2a155602fc in nsContainerFrame::ReflowChild(nsIFrame*, nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, mozilla::WritingMode const&, mozilla::LogicalPoint const&, nsSize const&, unsigned int, nsReflowStatus&, nsOverflowContinuationTracker*) /builds/worker/workspace/build/src/layout/generic/nsContainerFrame.cpp:934:14 #19 0x7f2a1555eb84 in nsCanvasFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) /builds/worker/workspace/build/src/layout/generic/nsCanvasFrame.cpp:757:5 #20 0x7f2a155602fc in nsContainerFrame::ReflowChild(nsIFrame*, nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, mozilla::WritingMode const&, mozilla::LogicalPoint const&, nsSize const&, unsigned int, nsReflowStatus&, nsOverflowContinuationTracker*) /builds/worker/workspace/build/src/layout/generic/nsContainerFrame.cpp:934:14 #21 0x7f2a1562a718 in nsHTMLScrollFrame::ReflowScrolledFrame(mozilla::ScrollReflowInput*, bool, bool, mozilla::ReflowOutput*, bool) /builds/worker/workspace/build/src/layout/generic/nsGfxScrollFrame.cpp:552:3 #22 0x7f2a1562bdce in nsHTMLScrollFrame::ReflowContents(mozilla::ScrollReflowInput*, mozilla::ReflowOutput const&) /builds/worker/workspace/build/src/layout/generic/nsGfxScrollFrame.cpp:664:3 #23 0x7f2a1562f0d9 in nsHTMLScrollFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) /builds/worker/workspace/build/src/layout/generic/nsGfxScrollFrame.cpp:1041:3 #24 0x7f2a154e9aef in nsContainerFrame::ReflowChild(nsIFrame*, nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, int, int, unsigned int, nsReflowStatus&, nsOverflowContinuationTracker*) /builds/worker/workspace/build/src/layout/generic/nsContainerFrame.cpp:978:14 #25 0x7f2a154e83bb in mozilla::ViewportFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) /builds/worker/workspace/build/src/layout/generic/ViewportFrame.cpp:336:7 #26 0x7f2a152de9ce in mozilla::PresShell::DoReflow(nsIFrame*, bool) /builds/worker/workspace/build/src/layout/base/PresShell.cpp:9022:11 #27 0x7f2a152f3f82 in mozilla::PresShell::ProcessReflowCommands(bool) /builds/worker/workspace/build/src/layout/base/PresShell.cpp:9195:24 #28 0x7f2a152f2f98 in mozilla::PresShell::DoFlushPendingNotifications(mozilla::ChangesToFlush) /builds/worker/workspace/build/src/layout/base/PresShell.cpp:4268:11 #29 0x7f2a11133f30 in FlushPendingNotifications /builds/worker/workspace/build/src/obj-firefox/dist/include/nsIPresShell.h:571:5 #30 0x7f2a11133f30 in nsDocument::FlushPendingNotifications(mozilla::FlushType, mozilla::FlushTarget) /builds/worker/workspace/build/src/dom/base/nsDocument.cpp:8547 #31 0x7f2a10e1f713 in FlushPendingNotifications /builds/worker/workspace/build/src/dom/base/nsGlobalWindowInner.cpp:6450:11 #32 0x7f2a10e1f713 in nsGlobalWindowInner::ScrollBy(mozilla::dom::ScrollToOptions const&) /builds/worker/workspace/build/src/dom/base/nsGlobalWindowInner.cpp:3506 #33 0x7f2a1241099a in mozilla::dom::WindowBinding::scrollBy(JSContext*, JS::Handle<JSObject*>, nsGlobalWindowInner*, JSJitMethodCallArgs const&) /builds/worker/workspace/build/src/obj-firefox/dom/bindings/WindowBinding.cpp:3460:13 #34 0x7f2a12407d35 in mozilla::dom::WindowBinding::genericMethod(JSContext*, unsigned int, JS::Value*) /builds/worker/workspace/build/src/obj-firefox/dom/bindings/WindowBinding.cpp:15333:13 #35 0x7f2a1912cdf0 in CallJSNative /builds/worker/workspace/build/src/js/src/jscntxtinlines.h:291:15 #36 0x7f2a1912cdf0 in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct) /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:473 #37 0x7f2a1911830b in CallFromStack /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:528:12 #38 0x7f2a1911830b in Interpret(JSContext*, js::RunState&) /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:3098 #39 0x7f2a191003ca in js::RunScript(JSContext*, js::RunState&) /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:423:12 #40 0x7f2a1912fd10 in js::ExecuteKernel(JSContext*, JS::Handle<JSScript*>, JSObject&, JS::Value const&, js::AbstractFramePtr, JS::Value*) /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:706:15 #41 0x7f2a19181f05 in EvalKernel(JSContext*, JS::Handle<JS::Value>, EvalType, js::AbstractFramePtr, JS::Handle<JSObject*>, unsigned char*, JS::MutableHandle<JS::Value>) /builds/worker/workspace/build/src/js/src/builtin/Eval.cpp:323:12 #42 0x7f2a19180663 in js::IndirectEval(JSContext*, unsigned int, JS::Value*) /builds/worker/workspace/build/src/js/src/builtin/Eval.cpp:416:12 SUMMARY: AddressSanitizer: use-after-poison /builds/worker/workspace/build/src/layout/generic/nsIFrame.h:4137:35 in IsFrameModified Shadow bytes around the buggy address: 0x0c4a804cc6d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0c4a804cc6e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0c4a804cc6f0: 00 00 00 00 00 00 00 00 00 00 00 f7 f7 f7 f7 f7 0x0c4a804cc700: f7 f7 f7 f7 f7 00 00 00 00 00 00 00 00 00 00 00 0x0c4a804cc710: 00 00 00 00 00 00 00 f7 f7 f7 f7 f7 f7 f7 f7 f7 =>0x0c4a804cc720: f7 f7 f7[f7]f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 0x0c4a804cc730: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 00 00 00 00 00 00 0x0c4a804cc740: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0c4a804cc750: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0c4a804cc760: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0c4a804cc770: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Heap right redzone: fb Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack partial redzone: f4 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb ==14405==ABORTING
Group: core-security → layout-core-security
I've managed to get a reproducible testcase. I will update shortly once it's finished reducing.
Component: Layout → Layout: Web Painting
Attached file trigger.html —
The attached testcase is not fully reduced but should trigger reliably.
Attached file prefs.js —
Prefs required to reproduce issue.
Testcase requires the fuzzPriv extension in order to reproduce: https://github.com/MozillaSecurity/domfuzz/tree/master/dom/extension
Looking at the stack this is likely mitigated by framepoisoning, which would make it not a sec-high bug. In that case I'd expect to see a non-ASAN crash though.
This crashes non-ASAN builds too. On Windows at least, it brings down the entire process too (not just the content process). INFO: Last good revision: 9a8f2342fb3116d23989087e026448d38a3768c5 (2015-10-27) INFO: First bad revision: fc706d376f0658e560a59c3dd520437b18e8c4a4 (2015-10-28) INFO: Pushlog: https://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=9a8f2342fb3116d23989087e026448d38a3768c5&tochange=fc706d376f0658e560a59c3dd520437b18e8c4a4
Has Regression Range: --- → yes
status-firefox57: --- → wontfix
status-firefox58: --- → affected
status-firefox59: --- → affected
status-firefox-esr52: --- → affected
Assignee: nobody → matt.woodrow
Priority: -- → P1
What's the crash stack for those older builds Ryan? The crash in comment 0 is within retained-dl code, which didn't exist in 2015.
I can't get this to reproduce on OSX or linux (even with the extension installed).
The stack overflow crashes in comment 8 looks like a different issue to me, compared to the stack in comment 0. I can't reproduce this in Nightly on Linux. Rolling back to rev dd08f8b19cc3 makes it crash though, with the same stack as in comment 0. We're using a nsHTMLCanvasFrame that's been destroyed. It was returned from nsDisplayPerspective::FrameForInvalidation. Matt, did we fix anything recently in relation to that?
Flags: needinfo?(matt.woodrow)
> I can't reproduce this in Nightly on Linux. ... and by Nightly I mean a local ASAN build from mozilla-central tip.
Probably bug 1418722? Similar stack, and the same cause.
Flags: needinfo?(matt.woodrow)
Status: NEW → RESOLVED
Closed: 7 years ago
Resolution: --- → FIXED
Group: layout-core-security → core-security-release
Group: core-security-release
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: