Closed Bug 1418997 Opened 7 years ago Closed 6 years ago

AddressSanitizer: use-after-poison [@ IsFrameModified] with READ of size 2

Categories

(Core :: Web Painting, defect, P1)

Product:
Core
Component:
Web Painting
Version:
52 Branch
Type:
defect

Tracking

()

Status:
RESOLVED FIXED
Tracking Flags:
Tracking Status
firefox-esr52 --- wontfix
firefox57 --- wontfix
firefox58 --- wontfix
firefox59 --- wontfix

People

(Reporter: jkratzer, Assigned: mattwoodrow)

References

(Blocks 2 open bugs)

Details

(5 keywords)

Attachments

(2 files)

trigger.html
11.84 KB, text/html
Details
prefs.js
9.90 KB, application/javascript
Details 
Found while fuzzing mozilla-central rev dd08f8b19cc3.  I don't have a reproducible testcase at this time but will update when one becomes available.

==14405==ERROR: AddressSanitizer: use-after-poison on address 0x6250026a391e at pc 0x7f2a15bc965c bp 0x7fffbf0a6e30 sp 0x7fffbf0a6e28
READ of size 2 at 0x6250026a391e thread T0 (file:// Content)
    #0 0x7f2a15bc965b in IsFrameModified /builds/worker/workspace/build/src/layout/generic/nsIFrame.h:4137:35
    #1 0x7f2a15bc965b in IsAnyAncestorModified /builds/worker/workspace/build/src/layout/painting/RetainedDisplayListBuilder.cpp:71
    #2 0x7f2a15bc965b in RetainedDisplayListBuilder::MergeDisplayLists(nsDisplayList*, nsDisplayList*, nsDisplayList*, mozilla::Maybe<mozilla::ActiveScrolledRoot const*>&) /builds/worker/workspace/build/src/layout/painting/RetainedDisplayListBuilder.cpp:464
    #3 0x7f2a15bc7a27 in RetainedDisplayListBuilder::MergeDisplayLists(nsDisplayList*, nsDisplayList*, nsDisplayList*, mozilla::Maybe<mozilla::ActiveScrolledRoot const*>&) /builds/worker/workspace/build/src/layout/painting/RetainedDisplayListBuilder.cpp:468:13
    #4 0x7f2a15bcc8d5 in RetainedDisplayListBuilder::AttemptPartialUpdate(unsigned int) /builds/worker/workspace/build/src/layout/painting/RetainedDisplayListBuilder.cpp:868:5
    #5 0x7f2a15415f3a in nsLayoutUtils::PaintFrame(gfxContext*, nsIFrame*, nsRegion const&, unsigned int, nsDisplayListBuilderMode, nsLayoutUtils::PaintFrameFlags) /builds/worker/workspace/build/src/layout/base/nsLayoutUtils.cpp:3827:35
    #6 0x7f2a1530bca4 in mozilla::PresShell::Paint(nsView*, nsRegion const&, unsigned int) /builds/worker/workspace/build/src/layout/base/PresShell.cpp:6506:5
    #7 0x7f2a14aca286 in nsViewManager::ProcessPendingUpdatesPaint(nsIWidget*) /builds/worker/workspace/build/src/view/nsViewManager.cpp:480:19
    #8 0x7f2a14ac912b in nsViewManager::ProcessPendingUpdatesForView(nsView*, bool) /builds/worker/workspace/build/src/view/nsViewManager.cpp:412:33
    #9 0x7f2a14acc965 in nsViewManager::ProcessPendingUpdates() /builds/worker/workspace/build/src/view/nsViewManager.cpp:1102:5
    #10 0x7f2a152677e5 in nsRefreshDriver::Tick(long, mozilla::TimeStamp) /builds/worker/workspace/build/src/layout/base/nsRefreshDriver.cpp:2027:11
    #11 0x7f2a15272c7b in TickDriver /builds/worker/workspace/build/src/layout/base/nsRefreshDriver.cpp:336:13
    #12 0x7f2a15272c7b in mozilla::RefreshDriverTimer::TickRefreshDrivers(long, mozilla::TimeStamp, nsTArray<RefPtr<nsRefreshDriver> >&) /builds/worker/workspace/build/src/layout/base/nsRefreshDriver.cpp:306
    #13 0x7f2a15272976 in mozilla::RefreshDriverTimer::Tick(long, mozilla::TimeStamp) /builds/worker/workspace/build/src/layout/base/nsRefreshDriver.cpp:328:5
    #14 0x7f2a15274ecb in RunRefreshDrivers /builds/worker/workspace/build/src/layout/base/nsRefreshDriver.cpp:769:5
    #15 0x7f2a15274ecb in mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::TickRefreshDriver(mozilla::TimeStamp) /builds/worker/workspace/build/src/layout/base/nsRefreshDriver.cpp:682
    #16 0x7f2a15274ad6 in mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::NotifyVsync(mozilla::TimeStamp) /builds/worker/workspace/build/src/layout/base/nsRefreshDriver.cpp:583:9
    #17 0x7f2a15ac5c42 in mozilla::layout::VsyncChild::RecvNotify(mozilla::TimeStamp const&) /builds/worker/workspace/build/src/layout/ipc/VsyncChild.cpp:68:16
    #18 0x7f2a0f5b94f1 in mozilla::layout::PVsyncChild::OnMessageReceived(IPC::Message const&) /builds/worker/workspace/build/src/obj-firefox/ipc/ipdl/PVsyncChild.cpp:155:20
    #19 0x7f2a0f485a78 in mozilla::ipc::PBackgroundChild::OnMessageReceived(IPC::Message const&) /builds/worker/workspace/build/src/obj-firefox/ipc/ipdl/PBackgroundChild.cpp:1815:28
    #20 0x7f2a0f0dc389 in mozilla::ipc::MessageChannel::DispatchAsyncMessage(IPC::Message const&) /builds/worker/workspace/build/src/ipc/glue/MessageChannel.cpp:2119:25
    #21 0x7f2a0f0d939f in mozilla::ipc::MessageChannel::DispatchMessage(IPC::Message&&) /builds/worker/workspace/build/src/ipc/glue/MessageChannel.cpp:2049:17
    #22 0x7f2a0f0daad4 in mozilla::ipc::MessageChannel::RunMessage(mozilla::ipc::MessageChannel::MessageTask&) /builds/worker/workspace/build/src/ipc/glue/MessageChannel.cpp:1895:5
    #23 0x7f2a0f0db128 in mozilla::ipc::MessageChannel::MessageTask::Run() /builds/worker/workspace/build/src/ipc/glue/MessageChannel.cpp:1928:15
    #24 0x7f2a0e2ee246 in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:1037:14
    #25 0x7f2a0e308bc8 in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/workspace/build/src/xpcom/threads/nsThreadUtils.cpp:513:10
    #26 0x7f2a0e2ecd0e in SpinEventLoopUntil<mozilla::ProcessFailureBehavior::ReportToCaller, (lambda at /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:800:22)> /builds/worker/workspace/build/src/xpcom/threads/nsThreadUtils.h:323:25
    #27 0x7f2a0e2ecd0e in nsThread::Shutdown() /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:800
    #28 0x7f2a1359063a in mozilla::MediaStreamGraphShutdownThreadRunnable::Run() /builds/worker/workspace/build/src/dom/media/GraphDriver.cpp:147:14
    #29 0x7f2a0e2cb63b in mozilla::EventTargetWrapper::Runner::Run() /builds/worker/workspace/build/src/xpcom/threads/AbstractThread.cpp:150:32
    #30 0x7f2a0e2c8911 in mozilla::SchedulerGroup::Runnable::Run() /builds/worker/workspace/build/src/xpcom/threads/SchedulerGroup.cpp:396:25
    #31 0x7f2a0e2ee246 in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:1037:14
    #32 0x7f2a0e308bc8 in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/workspace/build/src/xpcom/threads/nsThreadUtils.cpp:513:10
    #33 0x7f2a0e2ecd0e in SpinEventLoopUntil<mozilla::ProcessFailureBehavior::ReportToCaller, (lambda at /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:800:22)> /builds/worker/workspace/build/src/xpcom/threads/nsThreadUtils.h:323:25
    #34 0x7f2a0e2ecd0e in nsThread::Shutdown() /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:800
    #35 0x7f2a1359063a in mozilla::MediaStreamGraphShutdownThreadRunnable::Run() /builds/worker/workspace/build/src/dom/media/GraphDriver.cpp:147:14
    #36 0x7f2a0e2cb63b in mozilla::EventTargetWrapper::Runner::Run() /builds/worker/workspace/build/src/xpcom/threads/AbstractThread.cpp:150:32
    #37 0x7f2a0e2c8911 in mozilla::SchedulerGroup::Runnable::Run() /builds/worker/workspace/build/src/xpcom/threads/SchedulerGroup.cpp:396:25
    #38 0x7f2a0e2ee246 in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:1037:14
    #39 0x7f2a0e308bc8 in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/workspace/build/src/xpcom/threads/nsThreadUtils.cpp:513:10
    #40 0x7f2a0e2ecd0e in SpinEventLoopUntil<mozilla::ProcessFailureBehavior::ReportToCaller, (lambda at /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:800:22)> /builds/worker/workspace/build/src/xpcom/threads/nsThreadUtils.h:323:25
    #41 0x7f2a0e2ecd0e in nsThread::Shutdown() /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:800
    #42 0x7f2a1359063a in mozilla::MediaStreamGraphShutdownThreadRunnable::Run() /builds/worker/workspace/build/src/dom/media/GraphDriver.cpp:147:14
    #43 0x7f2a0e2cb63b in mozilla::EventTargetWrapper::Runner::Run() /builds/worker/workspace/build/src/xpcom/threads/AbstractThread.cpp:150:32
    #44 0x7f2a0e2c8911 in mozilla::SchedulerGroup::Runnable::Run() /builds/worker/workspace/build/src/xpcom/threads/SchedulerGroup.cpp:396:25
    #45 0x7f2a0e2ee246 in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:1037:14
    #46 0x7f2a0e308bc8 in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/workspace/build/src/xpcom/threads/nsThreadUtils.cpp:513:10
    #47 0x7f2a0e2ecd0e in SpinEventLoopUntil<mozilla::ProcessFailureBehavior::ReportToCaller, (lambda at /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:800:22)> /builds/worker/workspace/build/src/xpcom/threads/nsThreadUtils.h:323:25
    #48 0x7f2a0e2ecd0e in nsThread::Shutdown() /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:800
    #49 0x7f2a1359063a in mozilla::MediaStreamGraphShutdownThreadRunnable::Run() /builds/worker/workspace/build/src/dom/media/GraphDriver.cpp:147:14
    #50 0x7f2a0e2cb63b in mozilla::EventTargetWrapper::Runner::Run() /builds/worker/workspace/build/src/xpcom/threads/AbstractThread.cpp:150:32
    #51 0x7f2a0e2c8911 in mozilla::SchedulerGroup::Runnable::Run() /builds/worker/workspace/build/src/xpcom/threads/SchedulerGroup.cpp:396:25
    #52 0x7f2a0e2ee246 in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:1037:14
    #53 0x7f2a0e308bc8 in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/workspace/build/src/xpcom/threads/nsThreadUtils.cpp:513:10
    #54 0x7f2a0e2ecd0e in SpinEventLoopUntil<mozilla::ProcessFailureBehavior::ReportToCaller, (lambda at /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:800:22)> /builds/worker/workspace/build/src/xpcom/threads/nsThreadUtils.h:323:25
    #55 0x7f2a0e2ecd0e in nsThread::Shutdown() /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:800
    #56 0x7f2a1359063a in mozilla::MediaStreamGraphShutdownThreadRunnable::Run() /builds/worker/workspace/build/src/dom/media/GraphDriver.cpp:147:14
    #57 0x7f2a0e2cb63b in mozilla::EventTargetWrapper::Runner::Run() /builds/worker/workspace/build/src/xpcom/threads/AbstractThread.cpp:150:32
    #58 0x7f2a0e2c8911 in mozilla::SchedulerGroup::Runnable::Run() /builds/worker/workspace/build/src/xpcom/threads/SchedulerGroup.cpp:396:25
    #59 0x7f2a0e2ee246 in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:1037:14
    #60 0x7f2a0e308bc8 in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/workspace/build/src/xpcom/threads/nsThreadUtils.cpp:513:10
    #61 0x7f2a0e2ecd0e in SpinEventLoopUntil<mozilla::ProcessFailureBehavior::ReportToCaller, (lambda at /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:800:22)> /builds/worker/workspace/build/src/xpcom/threads/nsThreadUtils.h:323:25
    #62 0x7f2a0e2ecd0e in nsThread::Shutdown() /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:800
    #63 0x7f2a1359063a in mozilla::MediaStreamGraphShutdownThreadRunnable::Run() /builds/worker/workspace/build/src/dom/media/GraphDriver.cpp:147:14
    #64 0x7f2a0e2cb63b in mozilla::EventTargetWrapper::Runner::Run() /builds/worker/workspace/build/src/xpcom/threads/AbstractThread.cpp:150:32
    #65 0x7f2a0e2c8911 in mozilla::SchedulerGroup::Runnable::Run() /builds/worker/workspace/build/src/xpcom/threads/SchedulerGroup.cpp:396:25
    #66 0x7f2a0e2ee246 in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:1037:14
    #67 0x7f2a0e308bc8 in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/workspace/build/src/xpcom/threads/nsThreadUtils.cpp:513:10
    #68 0x7f2a0e2ecd0e in SpinEventLoopUntil<mozilla::ProcessFailureBehavior::ReportToCaller, (lambda at /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:800:22)> /builds/worker/workspace/build/src/xpcom/threads/nsThreadUtils.h:323:25
    #69 0x7f2a0e2ecd0e in nsThread::Shutdown() /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:800
    #70 0x7f2a1359063a in mozilla::MediaStreamGraphShutdownThreadRunnable::Run() /builds/worker/workspace/build/src/dom/media/GraphDriver.cpp:147:14
    #71 0x7f2a0e2cb63b in mozilla::EventTargetWrapper::Runner::Run() /builds/worker/workspace/build/src/xpcom/threads/AbstractThread.cpp:150:32
    #72 0x7f2a0e2c8911 in mozilla::SchedulerGroup::Runnable::Run() /builds/worker/workspace/build/src/xpcom/threads/SchedulerGroup.cpp:396:25
    #73 0x7f2a0e2ee246 in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:1037:14
    #74 0x7f2a0e308bc8 in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/workspace/build/src/xpcom/threads/nsThreadUtils.cpp:513:10
    #75 0x7f2a0e2ecd0e in SpinEventLoopUntil<mozilla::ProcessFailureBehavior::ReportToCaller, (lambda at /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:800:22)> /builds/worker/workspace/build/src/xpcom/threads/nsThreadUtils.h:323:25
    #76 0x7f2a0e2ecd0e in nsThread::Shutdown() /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:800
    #77 0x7f2a1359063a in mozilla::MediaStreamGraphShutdownThreadRunnable::Run() /builds/worker/workspace/build/src/dom/media/GraphDriver.cpp:147:14
    #78 0x7f2a0e2cb63b in mozilla::EventTargetWrapper::Runner::Run() /builds/worker/workspace/build/src/xpcom/threads/AbstractThread.cpp:150:32
    #79 0x7f2a0e2c8911 in mozilla::SchedulerGroup::Runnable::Run() /builds/worker/workspace/build/src/xpcom/threads/SchedulerGroup.cpp:396:25
    #80 0x7f2a0e2ee246 in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:1037:14
    #81 0x7f2a0e308bc8 in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/workspace/build/src/xpcom/threads/nsThreadUtils.cpp:513:10
    #82 0x7f2a0e2ecd0e in SpinEventLoopUntil<mozilla::ProcessFailureBehavior::ReportToCaller, (lambda at /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:800:22)> /builds/worker/workspace/build/src/xpcom/threads/nsThreadUtils.h:323:25
    #83 0x7f2a0e2ecd0e in nsThread::Shutdown() /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:800
    #84 0x7f2a1359063a in mozilla::MediaStreamGraphShutdownThreadRunnable::Run() /builds/worker/workspace/build/src/dom/media/GraphDriver.cpp:147:14
    #85 0x7f2a0e2cb63b in mozilla::EventTargetWrapper::Runner::Run() /builds/worker/workspace/build/src/xpcom/threads/AbstractThread.cpp:150:32
    #86 0x7f2a0e2c8911 in mozilla::SchedulerGroup::Runnable::Run() /builds/worker/workspace/build/src/xpcom/threads/SchedulerGroup.cpp:396:25
    #87 0x7f2a0e2ee246 in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:1037:14
    #88 0x7f2a0e308bc8 in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/workspace/build/src/xpcom/threads/nsThreadUtils.cpp:513:10
    #89 0x7f2a0e2ecd0e in SpinEventLoopUntil<mozilla::ProcessFailureBehavior::ReportToCaller, (lambda at /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:800:22)> /builds/worker/workspace/build/src/xpcom/threads/nsThreadUtils.h:323:25
    #90 0x7f2a0e2ecd0e in nsThread::Shutdown() /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:800
    #91 0x7f2a1359063a in mozilla::MediaStreamGraphShutdownThreadRunnable::Run() /builds/worker/workspace/build/src/dom/media/GraphDriver.cpp:147:14
    #92 0x7f2a0e2cb63b in mozilla::EventTargetWrapper::Runner::Run() /builds/worker/workspace/build/src/xpcom/threads/AbstractThread.cpp:150:32
    #93 0x7f2a0e2c8911 in mozilla::SchedulerGroup::Runnable::Run() /builds/worker/workspace/build/src/xpcom/threads/SchedulerGroup.cpp:396:25
    #94 0x7f2a0e2ee246 in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:1037:14
    #95 0x7f2a0e308bc8 in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/workspace/build/src/xpcom/threads/nsThreadUtils.cpp:513:10
    #96 0x7f2a0e2ecd0e in SpinEventLoopUntil<mozilla::ProcessFailureBehavior::ReportToCaller, (lambda at /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:800:22)> /builds/worker/workspace/build/src/xpcom/threads/nsThreadUtils.h:323:25
    #97 0x7f2a0e2ecd0e in nsThread::Shutdown() /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:800
    #98 0x7f2a1359063a in mozilla::MediaStreamGraphShutdownThreadRunnable::Run() /builds/worker/workspace/build/src/dom/media/GraphDriver.cpp:147:14
    #99 0x7f2a0e2cb63b in mozilla::EventTargetWrapper::Runner::Run() /builds/worker/workspace/build/src/xpcom/threads/AbstractThread.cpp:150:32
    #100 0x7f2a0e2c8911 in mozilla::SchedulerGroup::Runnable::Run() /builds/worker/workspace/build/src/xpcom/threads/SchedulerGroup.cpp:396:25
    #101 0x7f2a0e2ee246 in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:1037:14
    #102 0x7f2a0e308bc8 in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/workspace/build/src/xpcom/threads/nsThreadUtils.cpp:513:10
    #103 0x7f2a0e2ecd0e in SpinEventLoopUntil<mozilla::ProcessFailureBehavior::ReportToCaller, (lambda at /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:800:22)> /builds/worker/workspace/build/src/xpcom/threads/nsThreadUtils.h:323:25
    #104 0x7f2a0e2ecd0e in nsThread::Shutdown() /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:800
    #105 0x7f2a1359063a in mozilla::MediaStreamGraphShutdownThreadRunnable::Run() /builds/worker/workspace/build/src/dom/media/GraphDriver.cpp:147:14
    #106 0x7f2a0e2cb63b in mozilla::EventTargetWrapper::Runner::Run() /builds/worker/workspace/build/src/xpcom/threads/AbstractThread.cpp:150:32
    #107 0x7f2a0e2c8911 in mozilla::SchedulerGroup::Runnable::Run() /builds/worker/workspace/build/src/xpcom/threads/SchedulerGroup.cpp:396:25
    #108 0x7f2a0e2ee246 in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:1037:14
    #109 0x7f2a0e308bc8 in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/workspace/build/src/xpcom/threads/nsThreadUtils.cpp:513:10
    #110 0x7f2a0e2ecd0e in SpinEventLoopUntil<mozilla::ProcessFailureBehavior::ReportToCaller, (lambda at /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:800:22)> /builds/worker/workspace/build/src/xpcom/threads/nsThreadUtils.h:323:25
    #111 0x7f2a0e2ecd0e in nsThread::Shutdown() /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:800
    #112 0x7f2a1359063a in mozilla::MediaStreamGraphShutdownThreadRunnable::Run() /builds/worker/workspace/build/src/dom/media/GraphDriver.cpp:147:14
    #113 0x7f2a0e2cb63b in mozilla::EventTargetWrapper::Runner::Run() /builds/worker/workspace/build/src/xpcom/threads/AbstractThread.cpp:150:32
    #114 0x7f2a0e2c8911 in mozilla::SchedulerGroup::Runnable::Run() /builds/worker/workspace/build/src/xpcom/threads/SchedulerGroup.cpp:396:25
    #115 0x7f2a0e2ee246 in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:1037:14
    #116 0x7f2a0e308bc8 in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/workspace/build/src/xpcom/threads/nsThreadUtils.cpp:513:10
    #117 0x7f2a0e2ecd0e in SpinEventLoopUntil<mozilla::ProcessFailureBehavior::ReportToCaller, (lambda at /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:800:22)> /builds/worker/workspace/build/src/xpcom/threads/nsThreadUtils.h:323:25
    #118 0x7f2a0e2ecd0e in nsThread::Shutdown() /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:800
    #119 0x7f2a1359063a in mozilla::MediaStreamGraphShutdownThreadRunnable::Run() /builds/worker/workspace/build/src/dom/media/GraphDriver.cpp:147:14
    #120 0x7f2a0e2cb63b in mozilla::EventTargetWrapper::Runner::Run() /builds/worker/workspace/build/src/xpcom/threads/AbstractThread.cpp:150:32
    #121 0x7f2a0e2c8911 in mozilla::SchedulerGroup::Runnable::Run() /builds/worker/workspace/build/src/xpcom/threads/SchedulerGroup.cpp:396:25
    #122 0x7f2a0e2ee246 in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:1037:14
    #123 0x7f2a0e308bc8 in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/workspace/build/src/xpcom/threads/nsThreadUtils.cpp:513:10
    #124 0x7f2a0e2ecd0e in SpinEventLoopUntil<mozilla::ProcessFailureBehavior::ReportToCaller, (lambda at /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:800:22)> /builds/worker/workspace/build/src/xpcom/threads/nsThreadUtils.h:323:25
    #125 0x7f2a0e2ecd0e in nsThread::Shutdown() /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:800
    #126 0x7f2a1359063a in mozilla::MediaStreamGraphShutdownThreadRunnable::Run() /builds/worker/workspace/build/src/dom/media/GraphDriver.cpp:147:14
    #127 0x7f2a0e2cb63b in mozilla::EventTargetWrapper::Runner::Run() /builds/worker/workspace/build/src/xpcom/threads/AbstractThread.cpp:150:32
    #128 0x7f2a0e2c8911 in mozilla::SchedulerGroup::Runnable::Run() /builds/worker/workspace/build/src/xpcom/threads/SchedulerGroup.cpp:396:25
    #129 0x7f2a0e2ee246 in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:1037:14
    #130 0x7f2a0e308bc8 in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/workspace/build/src/xpcom/threads/nsThreadUtils.cpp:513:10
    #131 0x7f2a0e2ecd0e in SpinEventLoopUntil<mozilla::ProcessFailureBehavior::ReportToCaller, (lambda at /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:800:22)> /builds/worker/workspace/build/src/xpcom/threads/nsThreadUtils.h:323:25
    #132 0x7f2a0e2ecd0e in nsThread::Shutdown() /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:800
    #133 0x7f2a1359063a in mozilla::MediaStreamGraphShutdownThreadRunnable::Run() /builds/worker/workspace/build/src/dom/media/GraphDriver.cpp:147:14
    #134 0x7f2a0e2cb63b in mozilla::EventTargetWrapper::Runner::Run() /builds/worker/workspace/build/src/xpcom/threads/AbstractThread.cpp:150:32
    #135 0x7f2a0e2c8911 in mozilla::SchedulerGroup::Runnable::Run() /builds/worker/workspace/build/src/xpcom/threads/SchedulerGroup.cpp:396:25
    #136 0x7f2a0e2ee246 in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:1037:14
    #137 0x7f2a0e308bc8 in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/workspace/build/src/xpcom/threads/nsThreadUtils.cpp:513:10
    #138 0x7f2a0e2ecd0e in SpinEventLoopUntil<mozilla::ProcessFailureBehavior::ReportToCaller, (lambda at /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:800:22)> /builds/worker/workspace/build/src/xpcom/threads/nsThreadUtils.h:323:25
    #139 0x7f2a0e2ecd0e in nsThread::Shutdown() /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:800
    #140 0x7f2a1359063a in mozilla::MediaStreamGraphShutdownThreadRunnable::Run() /builds/worker/workspace/build/src/dom/media/GraphDriver.cpp:147:14
    #141 0x7f2a0e2cb63b in mozilla::EventTargetWrapper::Runner::Run() /builds/worker/workspace/build/src/xpcom/threads/AbstractThread.cpp:150:32
    #142 0x7f2a0e2c8911 in mozilla::SchedulerGroup::Runnable::Run() /builds/worker/workspace/build/src/xpcom/threads/SchedulerGroup.cpp:396:25
    #143 0x7f2a0e2ee246 in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:1037:14
    #144 0x7f2a0e308bc8 in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/workspace/build/src/xpcom/threads/nsThreadUtils.cpp:513:10
    #145 0x7f2a0e2ecd0e in SpinEventLoopUntil<mozilla::ProcessFailureBehavior::ReportToCaller, (lambda at /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:800:22)> /builds/worker/workspace/build/src/xpcom/threads/nsThreadUtils.h:323:25
    #146 0x7f2a0e2ecd0e in nsThread::Shutdown() /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:800
    #147 0x7f2a1359063a in mozilla::MediaStreamGraphShutdownThreadRunnable::Run() /builds/worker/workspace/build/src/dom/media/GraphDriver.cpp:147:14
    #148 0x7f2a0e2cb63b in mozilla::EventTargetWrapper::Runner::Run() /builds/worker/workspace/build/src/xpcom/threads/AbstractThread.cpp:150:32
    #149 0x7f2a0e2c8911 in mozilla::SchedulerGroup::Runnable::Run() /builds/worker/workspace/build/src/xpcom/threads/SchedulerGroup.cpp:396:25
    #150 0x7f2a0e2ee246 in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:1037:14
    #151 0x7f2a0e308bc8 in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/workspace/build/src/xpcom/threads/nsThreadUtils.cpp:513:10
    #152 0x7f2a0e2ecd0e in SpinEventLoopUntil<mozilla::ProcessFailureBehavior::ReportToCaller, (lambda at /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:800:22)> /builds/worker/workspace/build/src/xpcom/threads/nsThreadUtils.h:323:25
    #153 0x7f2a0e2ecd0e in nsThread::Shutdown() /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:800
    #154 0x7f2a1359063a in mozilla::MediaStreamGraphShutdownThreadRunnable::Run() /builds/worker/workspace/build/src/dom/media/GraphDriver.cpp:147:14
    #155 0x7f2a0e2cb63b in mozilla::EventTargetWrapper::Runner::Run() /builds/worker/workspace/build/src/xpcom/threads/AbstractThread.cpp:150:32
    #156 0x7f2a0e2c8911 in mozilla::SchedulerGroup::Runnable::Run() /builds/worker/workspace/build/src/xpcom/threads/SchedulerGroup.cpp:396:25
    #157 0x7f2a0e2ee246 in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:1037:14
    #158 0x7f2a0e308bc8 in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/workspace/build/src/xpcom/threads/nsThreadUtils.cpp:513:10
    #159 0x7f2a0e2ecd0e in SpinEventLoopUntil<mozilla::ProcessFailureBehavior::ReportToCaller, (lambda at /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:800:22)> /builds/worker/workspace/build/src/xpcom/threads/nsThreadUtils.h:323:25
    #160 0x7f2a0e2ecd0e in nsThread::Shutdown() /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:800
    #161 0x7f2a1359063a in mozilla::MediaStreamGraphShutdownThreadRunnable::Run() /builds/worker/workspace/build/src/dom/media/GraphDriver.cpp:147:14
    #162 0x7f2a0e2cb63b in mozilla::EventTargetWrapper::Runner::Run() /builds/worker/workspace/build/src/xpcom/threads/AbstractThread.cpp:150:32
    #163 0x7f2a0e2c8911 in mozilla::SchedulerGroup::Runnable::Run() /builds/worker/workspace/build/src/xpcom/threads/SchedulerGroup.cpp:396:25
    #164 0x7f2a0e2ee246 in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:1037:14
    #165 0x7f2a0e308bc8 in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/workspace/build/src/xpcom/threads/nsThreadUtils.cpp:513:10
    #166 0x7f2a0e2ecd0e in SpinEventLoopUntil<mozilla::ProcessFailureBehavior::ReportToCaller, (lambda at /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:800:22)> /builds/worker/workspace/build/src/xpcom/threads/nsThreadUtils.h:323:25
    #167 0x7f2a0e2ecd0e in nsThread::Shutdown() /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:800
    #168 0x7f2a1359063a in mozilla::MediaStreamGraphShutdownThreadRunnable::Run() /builds/worker/workspace/build/src/dom/media/GraphDriver.cpp:147:14
    #169 0x7f2a0e2cb63b in mozilla::EventTargetWrapper::Runner::Run() /builds/worker/workspace/build/src/xpcom/threads/AbstractThread.cpp:150:32
    #170 0x7f2a0e2c8911 in mozilla::SchedulerGroup::Runnable::Run() /builds/worker/workspace/build/src/xpcom/threads/SchedulerGroup.cpp:396:25
    #171 0x7f2a0e2ee246 in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:1037:14
    #172 0x7f2a0e308bc8 in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/workspace/build/src/xpcom/threads/nsThreadUtils.cpp:513:10
    #173 0x7f2a0e2ecd0e in SpinEventLoopUntil<mozilla::ProcessFailureBehavior::ReportToCaller, (lambda at /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:800:22)> /builds/worker/workspace/build/src/xpcom/threads/nsThreadUtils.h:323:25
    #174 0x7f2a0e2ecd0e in nsThread::Shutdown() /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:800
    #175 0x7f2a1359063a in mozilla::MediaStreamGraphShutdownThreadRunnable::Run() /builds/worker/workspace/build/src/dom/media/GraphDriver.cpp:147:14
    #176 0x7f2a0e2cb63b in mozilla::EventTargetWrapper::Runner::Run() /builds/worker/workspace/build/src/xpcom/threads/AbstractThread.cpp:150:32
    #177 0x7f2a0e2c8911 in mozilla::SchedulerGroup::Runnable::Run() /builds/worker/workspace/build/src/xpcom/threads/SchedulerGroup.cpp:396:25
    #178 0x7f2a0e2ee246 in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:1037:14
    #179 0x7f2a0e308bc8 in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/workspace/build/src/xpcom/threads/nsThreadUtils.cpp:513:10
    #180 0x7f2a0e2ecd0e in SpinEventLoopUntil<mozilla::ProcessFailureBehavior::ReportToCaller, (lambda at /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:800:22)> /builds/worker/workspace/build/src/xpcom/threads/nsThreadUtils.h:323:25
    #181 0x7f2a0e2ecd0e in nsThread::Shutdown() /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:800
    #182 0x7f2a1359063a in mozilla::MediaStreamGraphShutdownThreadRunnable::Run() /builds/worker/workspace/build/src/dom/media/GraphDriver.cpp:147:14
    #183 0x7f2a0e2cb63b in mozilla::EventTargetWrapper::Runner::Run() /builds/worker/workspace/build/src/xpcom/threads/AbstractThread.cpp:150:32
    #184 0x7f2a0e2c8911 in mozilla::SchedulerGroup::Runnable::Run() /builds/worker/workspace/build/src/xpcom/threads/SchedulerGroup.cpp:396:25
    #185 0x7f2a0e2ee246 in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:1037:14
    #186 0x7f2a0e308bc8 in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/workspace/build/src/xpcom/threads/nsThreadUtils.cpp:513:10
    #187 0x7f2a0e2ecd0e in SpinEventLoopUntil<mozilla::ProcessFailureBehavior::ReportToCaller, (lambda at /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:800:22)> /builds/worker/workspace/build/src/xpcom/threads/nsThreadUtils.h:323:25
    #188 0x7f2a0e2ecd0e in nsThread::Shutdown() /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:800
    #189 0x7f2a1359063a in mozilla::MediaStreamGraphShutdownThreadRunnable::Run() /builds/worker/workspace/build/src/dom/media/GraphDriver.cpp:147:14
    #190 0x7f2a0e2cb63b in mozilla::EventTargetWrapper::Runner::Run() /builds/worker/workspace/build/src/xpcom/threads/AbstractThread.cpp:150:32
    #191 0x7f2a0e2c8911 in mozilla::SchedulerGroup::Runnable::Run() /builds/worker/workspace/build/src/xpcom/threads/SchedulerGroup.cpp:396:25
    #192 0x7f2a0e2ee246 in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:1037:14
    #193 0x7f2a0e308bc8 in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/workspace/build/src/xpcom/threads/nsThreadUtils.cpp:513:10
    #194 0x7f2a0e2ecd0e in SpinEventLoopUntil<mozilla::ProcessFailureBehavior::ReportToCaller, (lambda at /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:800:22)> /builds/worker/workspace/build/src/xpcom/threads/nsThreadUtils.h:323:25
    #195 0x7f2a0e2ecd0e in nsThread::Shutdown() /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:800
    #196 0x7f2a1359063a in mozilla::MediaStreamGraphShutdownThreadRunnable::Run() /builds/worker/workspace/build/src/dom/media/GraphDriver.cpp:147:14
    #197 0x7f2a0e2cb63b in mozilla::EventTargetWrapper::Runner::Run() /builds/worker/workspace/build/src/xpcom/threads/AbstractThread.cpp:150:32
    #198 0x7f2a0e2c8911 in mozilla::SchedulerGroup::Runnable::Run() /builds/worker/workspace/build/src/xpcom/threads/SchedulerGroup.cpp:396:25
    #199 0x7f2a0e2ee246 in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:1037:14
    #200 0x7f2a0e308bc8 in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/workspace/build/src/xpcom/threads/nsThreadUtils.cpp:513:10
    #201 0x7f2a0e2ecd0e in SpinEventLoopUntil<mozilla::ProcessFailureBehavior::ReportToCaller, (lambda at /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:800:22)> /builds/worker/workspace/build/src/xpcom/threads/nsThreadUtils.h:323:25
    #202 0x7f2a0e2ecd0e in nsThread::Shutdown() /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:800
    #203 0x7f2a1359063a in mozilla::MediaStreamGraphShutdownThreadRunnable::Run() /builds/worker/workspace/build/src/dom/media/GraphDriver.cpp:147:14
    #204 0x7f2a0e2cb63b in mozilla::EventTargetWrapper::Runner::Run() /builds/worker/workspace/build/src/xpcom/threads/AbstractThread.cpp:150:32
    #205 0x7f2a0e2c8911 in mozilla::SchedulerGroup::Runnable::Run() /builds/worker/workspace/build/src/xpcom/threads/SchedulerGroup.cpp:396:25
    #206 0x7f2a0e2ee246 in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:1037:14
    #207 0x7f2a0e308bc8 in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/workspace/build/src/xpcom/threads/nsThreadUtils.cpp:513:10
    #208 0x7f2a0e2ecd0e in SpinEventLoopUntil<mozilla::ProcessFailureBehavior::ReportToCaller, (lambda at /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:800:22)> /builds/worker/workspace/build/src/xpcom/threads/nsThreadUtils.h:323:25
    #209 0x7f2a0e2ecd0e in nsThread::Shutdown() /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:800
    #210 0x7f2a1359063a in mozilla::MediaStreamGraphShutdownThreadRunnable::Run() /builds/worker/workspace/build/src/dom/media/GraphDriver.cpp:147:14
    #211 0x7f2a0e2cb63b in mozilla::EventTargetWrapper::Runner::Run() /builds/worker/workspace/build/src/xpcom/threads/AbstractThread.cpp:150:32
    #212 0x7f2a0e2c8911 in mozilla::SchedulerGroup::Runnable::Run() /builds/worker/workspace/build/src/xpcom/threads/SchedulerGroup.cpp:396:25
    #213 0x7f2a0e2ee246 in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:1037:14
    #214 0x7f2a0e308bc8 in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/workspace/build/src/xpcom/threads/nsThreadUtils.cpp:513:10
    #215 0x7f2a0e2ecd0e in SpinEventLoopUntil<mozilla::ProcessFailureBehavior::ReportToCaller, (lambda at /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:800:22)> /builds/worker/workspace/build/src/xpcom/threads/nsThreadUtils.h:323:25
    #216 0x7f2a0e2ecd0e in nsThread::Shutdown() /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:800
    #217 0x7f2a1359063a in mozilla::MediaStreamGraphShutdownThreadRunnable::Run() /builds/worker/workspace/build/src/dom/media/GraphDriver.cpp:147:14
    #218 0x7f2a0e2cb63b in mozilla::EventTargetWrapper::Runner::Run() /builds/worker/workspace/build/src/xpcom/threads/AbstractThread.cpp:150:32
    #219 0x7f2a0e2c8911 in mozilla::SchedulerGroup::Runnable::Run() /builds/worker/workspace/build/src/xpcom/threads/SchedulerGroup.cpp:396:25
    #220 0x7f2a0e2ee246 in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:1037:14
    #221 0x7f2a0e308bc8 in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/workspace/build/src/xpcom/threads/nsThreadUtils.cpp:513:10
    #222 0x7f2a0e2ecd0e in SpinEventLoopUntil<mozilla::ProcessFailureBehavior::ReportToCaller, (lambda at /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:800:22)> /builds/worker/workspace/build/src/xpcom/threads/nsThreadUtils.h:323:25
    #223 0x7f2a0e2ecd0e in nsThread::Shutdown() /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:800
    #224 0x7f2a1359063a in mozilla::MediaStreamGraphShutdownThreadRunnable::Run() /builds/worker/workspace/build/src/dom/media/GraphDriver.cpp:147:14
    #225 0x7f2a0e2cb63b in mozilla::EventTargetWrapper::Runner::Run() /builds/worker/workspace/build/src/xpcom/threads/AbstractThread.cpp:150:32
    #226 0x7f2a0e2c8911 in mozilla::SchedulerGroup::Runnable::Run() /builds/worker/workspace/build/src/xpcom/threads/SchedulerGroup.cpp:396:25
    #227 0x7f2a0e2ee246 in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:1037:14
    #228 0x7f2a0e308bc8 in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/workspace/build/src/xpcom/threads/nsThreadUtils.cpp:513:10
    #229 0x7f2a0e2ecd0e in SpinEventLoopUntil<mozilla::ProcessFailureBehavior::ReportToCaller, (lambda at /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:800:22)> /builds/worker/workspace/build/src/xpcom/threads/nsThreadUtils.h:323:25
    #230 0x7f2a0e2ecd0e in nsThread::Shutdown() /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:800
    #231 0x7f2a1359063a in mozilla::MediaStreamGraphShutdownThreadRunnable::Run() /builds/worker/workspace/build/src/dom/media/GraphDriver.cpp:147:14
    #232 0x7f2a0e2cb63b in mozilla::EventTargetWrapper::Runner::Run() /builds/worker/workspace/build/src/xpcom/threads/AbstractThread.cpp:150:32
    #233 0x7f2a0e2c8911 in mozilla::SchedulerGroup::Runnable::Run() /builds/worker/workspace/build/src/xpcom/threads/SchedulerGroup.cpp:396:25
    #234 0x7f2a0e2ee246 in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:1037:14
    #235 0x7f2a0e308bc8 in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/workspace/build/src/xpcom/threads/nsThreadUtils.cpp:513:10
    #236 0x7f2a0e2ecd0e in SpinEventLoopUntil<mozilla::ProcessFailureBehavior::ReportToCaller, (lambda at /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:800:22)> /builds/worker/workspace/build/src/xpcom/threads/nsThreadUtils.h:323:25
    #237 0x7f2a0e2ecd0e in nsThread::Shutdown() /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:800
    #238 0x7f2a1359063a in mozilla::MediaStreamGraphShutdownThreadRunnable::Run() /builds/worker/workspace/build/src/dom/media/GraphDriver.cpp:147:14
    #239 0x7f2a0e2cb63b in mozilla::EventTargetWrapper::Runner::Run() /builds/worker/workspace/build/src/xpcom/threads/AbstractThread.cpp:150:32
    #240 0x7f2a0e2c8911 in mozilla::SchedulerGroup::Runnable::Run() /builds/worker/workspace/build/src/xpcom/threads/SchedulerGroup.cpp:396:25
    #241 0x7f2a0e2ee246 in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:1037:14
    #242 0x7f2a0e308bc8 in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/workspace/build/src/xpcom/threads/nsThreadUtils.cpp:513:10
    #243 0x7f2a0e2ecd0e in SpinEventLoopUntil<mozilla::ProcessFailureBehavior::ReportToCaller, (lambda at /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:800:22)> /builds/worker/workspace/build/src/xpcom/threads/nsThreadUtils.h:323:25
    #244 0x7f2a0e2ecd0e in nsThread::Shutdown() /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:800
    #245 0x7f2a1359063a in mozilla::MediaStreamGraphShutdownThreadRunnable::Run() /builds/worker/workspace/build/src/dom/media/GraphDriver.cpp:147:14
    #246 0x7f2a0e2cb63b in mozilla::EventTargetWrapper::Runner::Run() /builds/worker/workspace/build/src/xpcom/threads/AbstractThread.cpp:150:32
    #247 0x7f2a0e2c8911 in mozilla::SchedulerGroup::Runnable::Run() /builds/worker/workspace/build/src/xpcom/threads/SchedulerGroup.cpp:396:25
    #248 0x7f2a0e2ee246 in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:1037:14
    #249 0x7f2a0e308bc8 in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/workspace/build/src/xpcom/threads/nsThreadUtils.cpp:513:10
    #250 0x7f2a0e2ecd0e in SpinEventLoopUntil<mozilla::ProcessFailureBehavior::ReportToCaller, (lambda at /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:800:22)> /builds/worker/workspace/build/src/xpcom/threads/nsThreadUtils.h:323:25
    #251 0x7f2a0e2ecd0e in nsThread::Shutdown() /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:800
    #252 0x7f2a1359063a in mozilla::MediaStreamGraphShutdownThreadRunnable::Run() /builds/worker/workspace/build/src/dom/media/GraphDriver.cpp:147:14
    #253 0x7f2a0e2cb63b in mozilla::EventTargetWrapper::Runner::Run() /builds/worker/workspace/build/src/xpcom/threads/AbstractThread.cpp:150:32
    #254 0x7f2a0e2c8911 in mozilla::SchedulerGroup::Runnable::Run() /builds/worker/workspace/build/src/xpcom/threads/SchedulerGroup.cpp:396:25
    #255 0x7f2a0e2ee246 in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:1037:14
    #256 0x7f2a0e308bc8 in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/workspace/build/src/xpcom/threads/nsThreadUtils.cpp:513:10
    #257 0x7f2a0e2ecd0e in SpinEventLoopUntil<mozilla::ProcessFailureBehavior::ReportToCaller, (lambda at /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:800:22)> /builds/worker/workspace/build/src/xpcom/threads/nsThreadUtils.h:323:25
    #258 0x7f2a0e2ecd0e in nsThread::Shutdown() /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:800
    #259 0x7f2a1359063a in mozilla::MediaStreamGraphShutdownThreadRunnable::Run() /builds/worker/workspace/build/src/dom/media/GraphDriver.cpp:147:14
    #260 0x7f2a0e2cb63b in mozilla::EventTargetWrapper::Runner::Run() /builds/worker/workspace/build/src/xpcom/threads/AbstractThread.cpp:150:32
    #261 0x7f2a0e2c8911 in mozilla::SchedulerGroup::Runnable::Run() /builds/worker/workspace/build/src/xpcom/threads/SchedulerGroup.cpp:396:25
    #262 0x7f2a0e2ee246 in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:1037:14
    #263 0x7f2a0e308bc8 in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/workspace/build/src/xpcom/threads/nsThreadUtils.cpp:513:10
    #264 0x7f2a0e2ecd0e in SpinEventLoopUntil<mozilla::ProcessFailureBehavior::ReportToCaller, (lambda at /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:800:22)> /builds/worker/workspace/build/src/xpcom/threads/nsThreadUtils.h:323:25
    #265 0x7f2a0e2ecd0e in nsThread::Shutdown() /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:800
    #266 0x7f2a1359063a in mozilla::MediaStreamGraphShutdownThreadRunnable::Run() /builds/worker/workspace/build/src/dom/media/GraphDriver.cpp:147:14
    #267 0x7f2a0e2cb63b in mozilla::EventTargetWrapper::Runner::Run() /builds/worker/workspace/build/src/xpcom/threads/AbstractThread.cpp:150:32
    #268 0x7f2a0e2c8911 in mozilla::SchedulerGroup::Runnable::Run() /builds/worker/workspace/build/src/xpcom/threads/SchedulerGroup.cpp:396:25
    #269 0x7f2a0e2ee246 in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:1037:14
    #270 0x7f2a0e308bc8 in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/workspace/build/src/xpcom/threads/nsThreadUtils.cpp:513:10
    #271 0x7f2a0e2ecd0e in SpinEventLoopUntil<mozilla::ProcessFailureBehavior::ReportToCaller, (lambda at /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:800:22)> /builds/worker/workspace/build/src/xpcom/threads/nsThreadUtils.h:323:25
    #272 0x7f2a0e2ecd0e in nsThread::Shutdown() /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:800
    #273 0x7f2a1359063a in mozilla::MediaStreamGraphShutdownThreadRunnable::Run() /builds/worker/workspace/build/src/dom/media/GraphDriver.cpp:147:14
    #274 0x7f2a0e2cb63b in mozilla::EventTargetWrapper::Runner::Run() /builds/worker/workspace/build/src/xpcom/threads/AbstractThread.cpp:150:32
    #275 0x7f2a0e2c8911 in mozilla::SchedulerGroup::Runnable::Run() /builds/worker/workspace/build/src/xpcom/threads/SchedulerGroup.cpp:396:25
    #276 0x7f2a0e2ee246 in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:1037:14
    #277 0x7f2a0e308bc8 in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/workspace/build/src/xpcom/threads/nsThreadUtils.cpp:513:10
    #278 0x7f2a0e2ecd0e in SpinEventLoopUntil<mozilla::ProcessFailureBehavior::ReportToCaller, (lambda at /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:800:22)> /builds/worker/workspace/build/src/xpcom/threads/nsThreadUtils.h:323:25
    #279 0x7f2a0e2ecd0e in nsThread::Shutdown() /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:800
    #280 0x7f2a1359063a in mozilla::MediaStreamGraphShutdownThreadRunnable::Run() /builds/worker/workspace/build/src/dom/media/GraphDriver.cpp:147:14
    #281 0x7f2a0e2cb63b in mozilla::EventTargetWrapper::Runner::Run() /builds/worker/workspace/build/src/xpcom/threads/AbstractThread.cpp:150:32
    #282 0x7f2a0e2c8911 in mozilla::SchedulerGroup::Runnable::Run() /builds/worker/workspace/build/src/xpcom/threads/SchedulerGroup.cpp:396:25
    #283 0x7f2a0e2ee246 in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:1037:14
    #284 0x7f2a0e308bc8 in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/workspace/build/src/xpcom/threads/nsThreadUtils.cpp:513:10
    #285 0x7f2a0e2ecd0e in SpinEventLoopUntil<mozilla::ProcessFailureBehavior::ReportToCaller, (lambda at /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:800:22)> /builds/worker/workspace/build/src/xpcom/threads/nsThreadUtils.h:323:25
    #286 0x7f2a0e2ecd0e in nsThread::Shutdown() /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:800
    #287 0x7f2a1359063a in mozilla::MediaStreamGraphShutdownThreadRunnable::Run() /builds/worker/workspace/build/src/dom/media/GraphDriver.cpp:147:14
    #288 0x7f2a0e2cb63b in mozilla::EventTargetWrapper::Runner::Run() /builds/worker/workspace/build/src/xpcom/threads/AbstractThread.cpp:150:32
    #289 0x7f2a0e2c8911 in mozilla::SchedulerGroup::Runnable::Run() /builds/worker/workspace/build/src/xpcom/threads/SchedulerGroup.cpp:396:25
    #290 0x7f2a0e2ee246 in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:1037:14
    #291 0x7f2a0e308bc8 in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/workspace/build/src/xpcom/threads/nsThreadUtils.cpp:513:10
    #292 0x7f2a0e2ecd0e in SpinEventLoopUntil<mozilla::ProcessFailureBehavior::ReportToCaller, (lambda at /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:800:22)> /builds/worker/workspace/build/src/xpcom/threads/nsThreadUtils.h:323:25
    #293 0x7f2a0e2ecd0e in nsThread::Shutdown() /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:800
    #294 0x7f2a1359063a in mozilla::MediaStreamGraphShutdownThreadRunnable::Run() /builds/worker/workspace/build/src/dom/media/GraphDriver.cpp:147:14
    #295 0x7f2a0e2cb63b in mozilla::EventTargetWrapper::Runner::Run() /builds/worker/workspace/build/src/xpcom/threads/AbstractThread.cpp:150:32

0x6250026a391e is located 6174 bytes inside of 8192-byte region [0x6250026a2100,0x6250026a4100)
allocated by thread T0 (file:// Content) here:
    #0 0x4bbc8c in malloc /builds/worker/workspace/moz-toolchain/src/llvm/projects/compiler-rt/lib/asan/asan_malloc_linux.cc:64:3
    #1 0x7f2a0e2a1973 in AllocateChunk /builds/worker/workspace/build/src/obj-firefox/dist/include/mozilla/ArenaAllocator.h:193:15
    #2 0x7f2a0e2a1973 in InternalAllocate /builds/worker/workspace/build/src/obj-firefox/dist/include/mozilla/ArenaAllocator.h:228
    #3 0x7f2a0e2a1973 in Allocate /builds/worker/workspace/build/src/obj-firefox/dist/include/mozilla/ArenaAllocator.h:75
    #4 0x7f2a0e2a1973 in mozilla::ArenaAllocator<8192ul, 8ul>::Allocate(unsigned long) /builds/worker/workspace/build/src/obj-firefox/dist/include/mozilla/ArenaAllocator.h:80
    #5 0x7f2a15758ecc in AllocateByFrameID /builds/worker/workspace/build/src/layout/base/nsPresArena.h:39:12
    #6 0x7f2a15758ecc in AllocateFrame /builds/worker/workspace/build/src/obj-firefox/dist/include/nsIPresShell.h:205
    #7 0x7f2a15758ecc in operator new /builds/worker/workspace/build/src/layout/generic/nsTextFrame.cpp:4680
    #8 0x7f2a15758ecc in NS_NewContinuingTextFrame(nsIPresShell*, nsStyleContext*) /builds/worker/workspace/build/src/layout/generic/nsTextFrame.cpp:4677
    #9 0x7f2a153ac2fb in nsCSSFrameConstructor::CreateContinuingFrame(nsPresContext*, nsIFrame*, nsContainerFrame*, bool) /builds/worker/workspace/build/src/layout/base/nsCSSFrameConstructor.cpp:9183:16
    #10 0x7f2a15357584 in CreateContinuation(nsIFrame*, nsIFrame**, bool) /builds/worker/workspace/build/src/layout/base/nsBidiPresUtils.cpp:653:5
    #11 0x7f2a15354788 in EnsureBidiContinuation /builds/worker/workspace/build/src/layout/base/nsBidiPresUtils.cpp:1865:10
    #12 0x7f2a15354788 in nsBidiPresUtils::ResolveParagraph(BidiParagraphData*) /builds/worker/workspace/build/src/layout/base/nsBidiPresUtils.cpp:924
    #13 0x7f2a1535253c in ResolveParagraphWithinBlock /builds/worker/workspace/build/src/layout/base/nsBidiPresUtils.cpp:1347:3
    #14 0x7f2a1535253c in nsBidiPresUtils::TraverseFrames(nsBlockInFlowLineIterator*, nsIFrame*, BidiParagraphData*) /builds/worker/workspace/build/src/layout/base/nsBidiPresUtils.cpp:1255
    #15 0x7f2a1534ea06 in nsBidiPresUtils::Resolve(nsBlockFrame*) /builds/worker/workspace/build/src/layout/base/nsBidiPresUtils.cpp:752:5
    #16 0x7f2a15502a69 in ResolveBidi /builds/worker/workspace/build/src/layout/generic/nsBlockFrame.cpp:7526:10
    #17 0x7f2a15502a69 in nsBlockFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) /builds/worker/workspace/build/src/layout/generic/nsBlockFrame.cpp:1189
    #18 0x7f2a155602fc in nsContainerFrame::ReflowChild(nsIFrame*, nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, mozilla::WritingMode const&, mozilla::LogicalPoint const&, nsSize const&, unsigned int, nsReflowStatus&, nsOverflowContinuationTracker*) /builds/worker/workspace/build/src/layout/generic/nsContainerFrame.cpp:934:14
    #19 0x7f2a1555eb84 in nsCanvasFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) /builds/worker/workspace/build/src/layout/generic/nsCanvasFrame.cpp:757:5
    #20 0x7f2a155602fc in nsContainerFrame::ReflowChild(nsIFrame*, nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, mozilla::WritingMode const&, mozilla::LogicalPoint const&, nsSize const&, unsigned int, nsReflowStatus&, nsOverflowContinuationTracker*) /builds/worker/workspace/build/src/layout/generic/nsContainerFrame.cpp:934:14
    #21 0x7f2a1562a718 in nsHTMLScrollFrame::ReflowScrolledFrame(mozilla::ScrollReflowInput*, bool, bool, mozilla::ReflowOutput*, bool) /builds/worker/workspace/build/src/layout/generic/nsGfxScrollFrame.cpp:552:3
    #22 0x7f2a1562bdce in nsHTMLScrollFrame::ReflowContents(mozilla::ScrollReflowInput*, mozilla::ReflowOutput const&) /builds/worker/workspace/build/src/layout/generic/nsGfxScrollFrame.cpp:664:3
    #23 0x7f2a1562f0d9 in nsHTMLScrollFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) /builds/worker/workspace/build/src/layout/generic/nsGfxScrollFrame.cpp:1041:3
    #24 0x7f2a154e9aef in nsContainerFrame::ReflowChild(nsIFrame*, nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, int, int, unsigned int, nsReflowStatus&, nsOverflowContinuationTracker*) /builds/worker/workspace/build/src/layout/generic/nsContainerFrame.cpp:978:14
    #25 0x7f2a154e83bb in mozilla::ViewportFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) /builds/worker/workspace/build/src/layout/generic/ViewportFrame.cpp:336:7
    #26 0x7f2a152de9ce in mozilla::PresShell::DoReflow(nsIFrame*, bool) /builds/worker/workspace/build/src/layout/base/PresShell.cpp:9022:11
    #27 0x7f2a152f3f82 in mozilla::PresShell::ProcessReflowCommands(bool) /builds/worker/workspace/build/src/layout/base/PresShell.cpp:9195:24
    #28 0x7f2a152f2f98 in mozilla::PresShell::DoFlushPendingNotifications(mozilla::ChangesToFlush) /builds/worker/workspace/build/src/layout/base/PresShell.cpp:4268:11
    #29 0x7f2a11133f30 in FlushPendingNotifications /builds/worker/workspace/build/src/obj-firefox/dist/include/nsIPresShell.h:571:5
    #30 0x7f2a11133f30 in nsDocument::FlushPendingNotifications(mozilla::FlushType, mozilla::FlushTarget) /builds/worker/workspace/build/src/dom/base/nsDocument.cpp:8547
    #31 0x7f2a10e1f713 in FlushPendingNotifications /builds/worker/workspace/build/src/dom/base/nsGlobalWindowInner.cpp:6450:11
    #32 0x7f2a10e1f713 in nsGlobalWindowInner::ScrollBy(mozilla::dom::ScrollToOptions const&) /builds/worker/workspace/build/src/dom/base/nsGlobalWindowInner.cpp:3506
    #33 0x7f2a1241099a in mozilla::dom::WindowBinding::scrollBy(JSContext*, JS::Handle<JSObject*>, nsGlobalWindowInner*, JSJitMethodCallArgs const&) /builds/worker/workspace/build/src/obj-firefox/dom/bindings/WindowBinding.cpp:3460:13
    #34 0x7f2a12407d35 in mozilla::dom::WindowBinding::genericMethod(JSContext*, unsigned int, JS::Value*) /builds/worker/workspace/build/src/obj-firefox/dom/bindings/WindowBinding.cpp:15333:13
    #35 0x7f2a1912cdf0 in CallJSNative /builds/worker/workspace/build/src/js/src/jscntxtinlines.h:291:15
    #36 0x7f2a1912cdf0 in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct) /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:473
    #37 0x7f2a1911830b in CallFromStack /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:528:12
    #38 0x7f2a1911830b in Interpret(JSContext*, js::RunState&) /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:3098
    #39 0x7f2a191003ca in js::RunScript(JSContext*, js::RunState&) /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:423:12
    #40 0x7f2a1912fd10 in js::ExecuteKernel(JSContext*, JS::Handle<JSScript*>, JSObject&, JS::Value const&, js::AbstractFramePtr, JS::Value*) /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:706:15
    #41 0x7f2a19181f05 in EvalKernel(JSContext*, JS::Handle<JS::Value>, EvalType, js::AbstractFramePtr, JS::Handle<JSObject*>, unsigned char*, JS::MutableHandle<JS::Value>) /builds/worker/workspace/build/src/js/src/builtin/Eval.cpp:323:12
    #42 0x7f2a19180663 in js::IndirectEval(JSContext*, unsigned int, JS::Value*) /builds/worker/workspace/build/src/js/src/builtin/Eval.cpp:416:12

SUMMARY: AddressSanitizer: use-after-poison /builds/worker/workspace/build/src/layout/generic/nsIFrame.h:4137:35 in IsFrameModified
Shadow bytes around the buggy address:
  0x0c4a804cc6d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c4a804cc6e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c4a804cc6f0: 00 00 00 00 00 00 00 00 00 00 00 f7 f7 f7 f7 f7
  0x0c4a804cc700: f7 f7 f7 f7 f7 00 00 00 00 00 00 00 00 00 00 00
  0x0c4a804cc710: 00 00 00 00 00 00 00 f7 f7 f7 f7 f7 f7 f7 f7 f7
=>0x0c4a804cc720: f7 f7 f7[f7]f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
  0x0c4a804cc730: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 00 00 00 00 00 00
  0x0c4a804cc740: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c4a804cc750: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c4a804cc760: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c4a804cc770: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Heap right redzone:      fb
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack partial redzone:   f4
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==14405==ABORTING
Group: core-security → layout-core-security
I've managed to get a reproducible testcase.  I will update shortly once it's finished reducing.
Component: Layout → Layout: Web Painting
Attached file trigger.html — 
The attached testcase is not fully reduced but should trigger reliably.
Attached file prefs.js — 
Prefs required to reproduce issue.
Testcase requires the fuzzPriv extension in order to reproduce:

https://github.com/MozillaSecurity/domfuzz/tree/master/dom/extension
Looking at the stack this is likely mitigated by framepoisoning, which would make it not a sec-high bug. In that case I'd expect to see a non-ASAN crash though.
This crashes non-ASAN builds too. On Windows at least, it brings down the entire process too (not just the content process).

INFO: Last good revision: 9a8f2342fb3116d23989087e026448d38a3768c5 (2015-10-27)
INFO: First bad revision: fc706d376f0658e560a59c3dd520437b18e8c4a4 (2015-10-28)
INFO: Pushlog:
https://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=9a8f2342fb3116d23989087e026448d38a3768c5&tochange=fc706d376f0658e560a59c3dd520437b18e8c4a4
Has Regression Range: --- → yes
status-firefox57: --- → wontfix
status-firefox58: --- → affected
status-firefox59: --- → affected
status-firefox-esr52: --- → affected
Assignee: nobody → matt.woodrow
Priority: -- → P1
What's the crash stack for those older builds Ryan?

The crash in comment 0 is within retained-dl code, which didn't exist in 2015.
I can't get this to reproduce on OSX or linux (even with the extension installed).
The stack overflow crashes in comment 8 looks like a different issue to me,
compared to the stack in comment 0.

I can't reproduce this in Nightly on Linux.  Rolling back to rev dd08f8b19cc3
makes it crash though, with the same stack as in comment 0.
We're using a nsHTMLCanvasFrame that's been destroyed.
It was returned from nsDisplayPerspective::FrameForInvalidation.

Matt, did we fix anything recently in relation to that?
Flags: needinfo?(matt.woodrow)
> I can't reproduce this in Nightly on Linux.

... and by Nightly I mean a local ASAN build from mozilla-central tip.
Probably bug 1418722? Similar stack, and the same cause.
Flags: needinfo?(matt.woodrow)
Status: NEW → RESOLVED
Closed: 6 years ago
Resolution: --- → FIXED
Group: layout-core-security → core-security-release
Group: core-security-release
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: