1419608 - AddressSanitizer: stack-use-after-scope /builds/worker/workspace/build/src/obj-firefox/dist/include/mozilla/Maybe.h:224:32 in isSome

Status: RESOLVED FIXED

(Core :: Graphics: ImageLib, defect)

Description

[Christian Holler (:decoder)]

I got the following failure in multiple places when I tried to land Clang 6 for ASan:

REFTEST TEST-LOAD | file:///builds/worker/workspace/build/tests/reftest/tests/dom/media/test/crashtests/1411322.html | 590 / 3491 (16%)
=================================================================
==1050==ERROR: AddressSanitizer: stack-use-after-scope on address 0x7ffff57d5950 at pc 0x7fcd9fca8f11 bp 0x7ffff57d5890 sp 0x7ffff57d5888
READ of size 1 at 0x7ffff57d5950 thread T0 (Web Content)
    #0 0x7fcd9fca8f10 in isSome /builds/worker/workspace/build/src/obj-firefox/dist/include/mozilla/Maybe.h:224:32
    #1 0x7fcd9fca8f10 in operator bool /builds/worker/workspace/build/src/obj-firefox/dist/include/mozilla/Maybe.h:223
    #2 0x7fcd9fca8f10 in imgMemoryReporter::ReportSurfaces(nsIHandleReportCallback*, nsISupports*, nsTSubstring<char> const&, mozilla::image::ImageMemoryCounter const&) /builds/worker/workspace/build/src/image/imgLoader.cpp:320
    #3 0x7fcd9fca6020 in imgMemoryReporter::ReportImage(nsIHandleReportCallback*, nsISupports*, char const*, mozilla::image::ImageMemoryCounter const&) /builds/worker/workspace/build/src/image/imgLoader.cpp:272:5
    #4 0x7fcd9fca568d in imgMemoryReporter::ReportCounterArray(nsIHandleReportCallback*, nsISupports*, nsTArray<mozilla::image::ImageMemoryCounter>&, char const*, bool) /builds/worker/workspace/build/src/image/imgLoader.cpp:232:9
    #5 0x7fcd9fc81c12 in imgMemoryReporter::CollectReports(nsIHandleReportCallback*, nsISupports*, bool) /builds/worker/workspace/build/src/image/imgLoader.cpp:109:5
    #6 0x7fcd9cfe5419 in operator() /builds/worker/workspace/build/src/xpcom/base/nsMemoryReporterManager.cpp:1777:17
    #7 0x7fcd9cfe5419 in mozilla::detail::RunnableFunction<nsMemoryReporterManager::DispatchReporter(nsIMemoryReporter*, bool, nsIHandleReportCallback*, nsISupports*, bool)::$_0>::Run() /builds/worker/workspace/build/src/obj-firefox/dist/include/nsThreadUtils.h:529
    #8 0x7fcd9d117cd4 in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:1037:14
    #9 0x7fcd9d133850 in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/workspace/build/src/xpcom/threads/nsThreadUtils.cpp:513:10
    #10 0x7fcd9df911ca in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) /builds/worker/workspace/build/src/ipc/glue/MessagePump.cpp:97:21
    #11 0x7fcd9deedbd9 in RunInternal /builds/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:326:10
    #12 0x7fcd9deedbd9 in RunHandler /builds/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:319
    #13 0x7fcd9deedbd9 in MessageLoop::Run() /builds/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:299
    #14 0x7fcda42ab91a in nsBaseAppShell::Run() /builds/worker/workspace/build/src/widget/nsBaseAppShell.cpp:159:27
    #15 0x7fcda89c0acb in XRE_RunAppShell() /builds/worker/workspace/build/src/toolkit/xre/nsEmbedFunctions.cpp:877:22
    #16 0x7fcd9deedbd9 in RunInternal /builds/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:326:10
    #17 0x7fcd9deedbd9 in RunHandler /builds/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:319
    #18 0x7fcd9deedbd9 in MessageLoop::Run() /builds/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:299
    #19 0x7fcda89c04d7 in XRE_InitChildProcess(int, char**, XREChildData const*) /builds/worker/workspace/build/src/toolkit/xre/nsEmbedFunctions.cpp:703:34
    #20 0x4ee9f5 in content_process_main /builds/worker/workspace/build/src/browser/app/../../ipc/contentproc/plugin-container.cpp:63:30
    #21 0x4ee9f5 in main /builds/worker/workspace/build/src/browser/app/nsBrowserApp.cpp:280
    #22 0x7fcdbba3582f in __libc_start_main /build/glibc-bfm8X4/glibc-2.23/csu/../csu/libc-start.c:291
    #23 0x41e078 in _start (/builds/worker/workspace/build/application/firefox/firefox+0x41e078)
Address 0x7ffff57d5950 is located in stack of thread T0 (Web Content) at offset 176 in frame
    #0 0x7fcd9fca729f in imgMemoryReporter::ReportSurfaces(nsIHandleReportCallback*, nsISupports*, nsTSubstring<char> const&, mozilla::image::ImageMemoryCounter const&) /builds/worker/workspace/build/src/image/imgLoader.cpp:281
  This frame has 3 object(s):
    [32, 120) 'surfacePathPrefix' (line 283)
    [160, 192) 'ref.tmp' (line 318) <== Memory access at offset 176 is inside this variable
    [224, 376) 'aspect' (line 329)
HINT: this may be a false positive if your program uses some custom stack unwind mechanism or swapcontext
      (longjmp and C++ exceptions *are* supported)
SUMMARY: AddressSanitizer: stack-use-after-scope /builds/worker/workspace/build/src/obj-firefox/dist/include/mozilla/Maybe.h:224:32 in isSome
Shadow bytes around the buggy address:
  0x10007eaf2ad0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x10007eaf2ae0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x10007eaf2af0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x10007eaf2b00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x10007eaf2b10: 00 00 00 00 f1 f1 f1 f1 00 00 00 00 00 00 00 00
=>0x10007eaf2b20: 00 00 00 f2 f2 f2 f2 f2 f8 f8[f8]f8 f2 f2 f2 f2
  0x10007eaf2b30: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8
  0x10007eaf2b40: f8 f8 f8 f3 f3 f3 f3 f3 f3 f3 f3 f3 00 00 00 00
  0x10007eaf2b50: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x10007eaf2b60: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x10007eaf2b70: 00 00 00 00 00 00 00 00 00 00 00 00 f1 f1 f1 f1
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==1050==ABORTING

Comment 1

[Timothy Nikkel (:tnikkel)]

Attachment: refcopysvg

Comment 2

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/mozilla-inbound/rev/41717d086ca1
Make SurfaceKey::SVGContext return a reference instead of a copy. r=decoder

Comment 3

[Andrew Osmond [:aosmond] (he/him)]

Note to future me, always make sure the things that should be refs, are actually refs. Thanks for taking care of this!

Comment 4

[Stefan Hindli [:stefan_hindli]]

https://hg.mozilla.org/mozilla-central/rev/41717d086ca1