Closed Bug 1460616 Opened 7 years ago Closed 7 years ago

AddressSanitizer: heap-use-after-free /builds/worker/workspace/build/src/gfx/2d/SwizzleSSE2.cpp:21:10 in LoadRemainder_SSE2

Categories

(Core :: Graphics: Canvas2D, defect)

Product:
Core
Component:
Graphics: Canvas2D
Version:
59 Branch
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
RESOLVED DUPLICATE of bug 1459162

People

(Reporter: jkratzer, Unassigned)

References

(Blocks 1 open bug)

Details

(Keywords: crash, testcase-wanted)

Attachments

(1 file)

trigger.html
1.45 KB, text/html
Details
Testcase found while fuzzing mozilla-central rev b52b2eb81d1e. I'm currently reducing the testcase and will update once complete. ================================================================= ==15553==ERROR: AddressSanitizer: heap-use-after-free on address 0x7fc5cdaa4080 at pc 0x7fc5da13b4dd bp 0x7fff797dbb10 sp 0x7fff797dbb08 READ of size 8 at 0x7fc5cdaa4080 thread T0 (file:// Content) #0 0x7fc5da13b4dc in LoadRemainder_SSE2 /builds/worker/workspace/build/src/gfx/2d/SwizzleSSE2.cpp:21:10 #1 0x7fc5da13b4dc in void mozilla::gfx::Unpremultiply_SSE2<true>(unsigned char const*, int, unsigned char*, int, mozilla::gfx::IntSizeTyped<mozilla::gfx::UnknownUnits>) /builds/worker/workspace/build/src/gfx/2d/SwizzleSSE2.cpp:237 #2 0x7fc5da281013 in mozilla::gfx::UnpremultiplyData(unsigned char const*, int, mozilla::gfx::SurfaceFormat, unsigned char*, int, mozilla::gfx::SurfaceFormat, mozilla::gfx::IntSizeTyped<mozilla::gfx::UnknownUnits> const&) /builds/worker/workspace/build/src/gfx/2d/Swizzle.cpp #3 0x7fc5dd80bc56 in mozilla::dom::CanvasRenderingContext2D::GetImageDataArray(JSContext*, int, int, unsigned int, unsigned int, JSObject**) /builds/worker/workspace/build/src/dom/canvas/CanvasRenderingContext2D.cpp:5614:7 #4 0x7fc5dd80afef in mozilla::dom::CanvasRenderingContext2D::GetImageData(JSContext*, double, double, double, double, mozilla::ErrorResult&) /builds/worker/workspace/build/src/dom/canvas/CanvasRenderingContext2D.cpp:5501:12 #5 0x7fc5dc525c10 in mozilla::dom::CanvasRenderingContext2DBinding::getImageData(JSContext*, JS::Handle<JSObject*>, mozilla::dom::CanvasRenderingContext2D*, JSJitMethodCallArgs const&) /builds/worker/workspace/build/src/obj-firefox/dom/bindings/CanvasRenderingContext2DBinding.cpp:3990:61 #6 0x7fc5dd6e6721 in bool mozilla::dom::binding_detail::GenericMethod<mozilla::dom::binding_detail::NormalThisPolicy, mozilla::dom::binding_detail::ThrowExceptions>(JSContext*, unsigned int, JS::Value*) /builds/worker/workspace/build/src/dom/bindings/BindingUtils.cpp:3260:13 #7 0x7fc5e3f91027 in CallJSNative /builds/worker/workspace/build/src/js/src/vm/JSContext-inl.h:280:15 #8 0x7fc5e3f91027 in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct) /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:467 #9 0x7fc5e3f7b820 in CallFromStack /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:522:12 #10 0x7fc5e3f7b820 in Interpret(JSContext*, js::RunState&) /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:3086 #11 0x7fc5e3f61fe3 in js::RunScript(JSContext*, js::RunState&) /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:417:12 #12 0x7fc5e3f90da5 in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct) /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:489:15 #13 0x7fc5e3f92022 in js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>) /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:535:10 #14 0x7fc5e4ac9f6a in JS::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::HandleValueArray const&, JS::MutableHandle<JS::Value>) /builds/worker/workspace/build/src/js/src/jsapi.cpp:2989:12 #15 0x7fc5dce72cf5 in mozilla::dom::EventListener::HandleEvent(JSContext*, JS::Handle<JS::Value>, mozilla::dom::Event&, mozilla::ErrorResult&) /builds/worker/workspace/build/src/obj-firefox/dom/bindings/EventListenerBinding.cpp:51:8 #16 0x7fc5dde18c2e in HandleEvent<mozilla::dom::EventTarget *> /builds/worker/workspace/build/src/obj-firefox/dist/include/mozilla/dom/EventListenerBinding.h:66:12 #17 0x7fc5dde18c2e in mozilla::EventListenerManager::HandleEventSubType(mozilla::EventListenerManager::Listener*, mozilla::dom::Event*, mozilla::dom::EventTarget*) /builds/worker/workspace/build/src/dom/events/EventListenerManager.cpp:1118 #18 0x7fc5dde1a38b in mozilla::EventListenerManager::HandleEventInternal(nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event**, mozilla::dom::EventTarget*, nsEventStatus*) /builds/worker/workspace/build/src/dom/events/EventListenerManager.cpp:1288:20 #19 0x7fc5dde043df in mozilla::EventTargetChainItem::HandleEventTargetChain(nsTArray<mozilla::EventTargetChainItem>&, mozilla::EventChainPostVisitor&, mozilla::EventDispatchingCallback*, mozilla::ELMCreationDetector&) /builds/worker/workspace/build/src/dom/events/EventDispatcher.cpp:482:12 #20 0x7fc5dde08533 in mozilla::EventDispatcher::Dispatch(nsISupports*, nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event*, nsEventStatus*, mozilla::EventDispatchingCallback*, nsTArray<mozilla::dom::EventTarget*>*) /builds/worker/workspace/build/src/dom/events/EventDispatcher.cpp:961:9 #21 0x7fc5dde0aa6b in mozilla::EventDispatcher::DispatchDOMEvent(nsISupports*, mozilla::WidgetEvent*, mozilla::dom::Event*, nsPresContext*, nsEventStatus*) /builds/worker/workspace/build/src/dom/events/EventDispatcher.cpp #22 0x7fc5db34ca28 in nsINode::DispatchEvent(mozilla::dom::Event&, mozilla::dom::CallerType, mozilla::ErrorResult&) /builds/worker/workspace/build/src/dom/base/nsINode.cpp:1079:5 #23 0x7fc5dde28e53 in mozilla::dom::EventTarget::DispatchEvent(mozilla::dom::Event&) /builds/worker/workspace/build/src/dom/events/EventTarget.cpp:204:13 #24 0x7fc5ddd9f0ec in mozilla::AsyncEventDispatcher::Run() /builds/worker/workspace/build/src/dom/events/AsyncEventDispatcher.cpp:68:12 #25 0x7fc5daea2e1f in nsContentUtils::RemoveScriptBlocker() /builds/worker/workspace/build/src/dom/base/nsContentUtils.cpp:5633:15 #26 0x7fc5db27ba17 in nsDocument::EndUpdate(unsigned int) /builds/worker/workspace/build/src/dom/base/nsDocument.cpp:5078:3 #27 0x7fc5de2001cc in nsHTMLDocument::EndUpdate(unsigned int) /builds/worker/workspace/build/src/dom/html/nsHTMLDocument.cpp:2119:15 #28 0x7fc5db084c84 in ~mozAutoDocUpdate /builds/worker/workspace/build/src/dom/base/mozAutoDocUpdate.h:40:18 #29 0x7fc5db084c84 in mozilla::dom::Element::SetAttr(int, nsAtom*, nsAtom*, nsTSubstring<char16_t> const&, nsIPrincipal*, bool) /builds/worker/workspace/build/src/dom/base/Element.cpp:2542 #30 0x7fc5dd1f76d0 in SetAttr /builds/worker/workspace/build/src/obj-firefox/dist/include/mozilla/dom/Element.h:838:12 #31 0x7fc5dd1f76d0 in SetAttr /builds/worker/workspace/build/src/obj-firefox/dist/include/mozilla/dom/Element.h:833 #32 0x7fc5dd1f76d0 in SetAttr /builds/worker/workspace/build/src/obj-firefox/dist/include/mozilla/dom/Element.h:1597 #33 0x7fc5dd1f76d0 in SetHTMLAttr /builds/worker/workspace/build/src/dom/html/nsGenericHTMLElement.h:776 #34 0x7fc5dd1f76d0 in SetUnsignedIntAttr /builds/worker/workspace/build/src/dom/html/nsGenericHTMLElement.h:852 #35 0x7fc5dd1f76d0 in SetWidth /builds/worker/workspace/build/src/obj-firefox/dist/include/mozilla/dom/HTMLCanvasElement.h:170 #36 0x7fc5dd1f76d0 in mozilla::dom::HTMLCanvasElementBinding::set_width(JSContext*, JS::Handle<JSObject*>, mozilla::dom::HTMLCanvasElement*, JSJitSetterCallArgs) /builds/worker/workspace/build/src/obj-firefox/dom/bindings/HTMLCanvasElementBinding.cpp:137 #37 0x7fc5dd6e3e23 in bool mozilla::dom::binding_detail::GenericSetter<mozilla::dom::binding_detail::NormalThisPolicy>(JSContext*, unsigned int, JS::Value*) /builds/worker/workspace/build/src/dom/bindings/BindingUtils.cpp:3204:8 #38 0x7fc5e3f91027 in CallJSNative /builds/worker/workspace/build/src/js/src/vm/JSContext-inl.h:280:15 #39 0x7fc5e3f91027 in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct) /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:467 #40 0x7fc5e3f93c56 in InternalCall /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:516:12 #41 0x7fc5e3f93c56 in Call /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:535 #42 0x7fc5e3f93c56 in js::CallSetter(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::Handle<JS::Value>) /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:664 #43 0x7fc5e4f458fc in SetExistingProperty(JSContext*, JS::Handle<js::NativeObject*>, JS::Handle<jsid>, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::Handle<js::NativeObject*>, JS::Handle<JS::PropertyResult>, JS::ObjectOpResult&) /builds/worker/workspace/build/src/js/src/vm/NativeObject.cpp:2783:10 #44 0x7fc5e4f3d69b in bool js::NativeSetProperty<(js::QualifiedBool)1>(JSContext*, JS::Handle<js::NativeObject*>, JS::Handle<jsid>, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::ObjectOpResult&) /builds/worker/workspace/build/src/js/src/vm/NativeObject.cpp:2811:20 #45 0x7fc5e3f73685 in SetProperty /builds/worker/workspace/build/src/js/src/vm/NativeObject.h:1648:12 #46 0x7fc5e3f73685 in SetPropertyOperation /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:264 #47 0x7fc5e3f73685 in Interpret(JSContext*, js::RunState&) /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:2881 #48 0x7fc5e3f61fe3 in js::RunScript(JSContext*, js::RunState&) /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:417:12 #49 0x7fc5e3f90da5 in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct) /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:489:15 #50 0x7fc5e3f92022 in js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>) /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:535:10 #51 0x7fc5e4ac9f6a in JS::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::HandleValueArray const&, JS::MutableHandle<JS::Value>) /builds/worker/workspace/build/src/js/src/jsapi.cpp:2989:12 #52 0x7fc5dce72cf5 in mozilla::dom::EventListener::HandleEvent(JSContext*, JS::Handle<JS::Value>, mozilla::dom::Event&, mozilla::ErrorResult&) /builds/worker/workspace/build/src/obj-firefox/dom/bindings/EventListenerBinding.cpp:51:8 #53 0x7fc5dde18c2e in HandleEvent<mozilla::dom::EventTarget *> /builds/worker/workspace/build/src/obj-firefox/dist/include/mozilla/dom/EventListenerBinding.h:66:12 #54 0x7fc5dde18c2e in mozilla::EventListenerManager::HandleEventSubType(mozilla::EventListenerManager::Listener*, mozilla::dom::Event*, mozilla::dom::EventTarget*) /builds/worker/workspace/build/src/dom/events/EventListenerManager.cpp:1118 #55 0x7fc5dde1a38b in mozilla::EventListenerManager::HandleEventInternal(nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event**, mozilla::dom::EventTarget*, nsEventStatus*) /builds/worker/workspace/build/src/dom/events/EventListenerManager.cpp:1288:20 #56 0x7fc5dde043df in mozilla::EventTargetChainItem::HandleEventTargetChain(nsTArray<mozilla::EventTargetChainItem>&, mozilla::EventChainPostVisitor&, mozilla::EventDispatchingCallback*, mozilla::ELMCreationDetector&) /builds/worker/workspace/build/src/dom/events/EventDispatcher.cpp:482:12 #57 0x7fc5dde08533 in mozilla::EventDispatcher::Dispatch(nsISupports*, nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event*, nsEventStatus*, mozilla::EventDispatchingCallback*, nsTArray<mozilla::dom::EventTarget*>*) /builds/worker/workspace/build/src/dom/events/EventDispatcher.cpp:961:9 #58 0x7fc5dde0aa6b in mozilla::EventDispatcher::DispatchDOMEvent(nsISupports*, mozilla::WidgetEvent*, mozilla::dom::Event*, nsPresContext*, nsEventStatus*) /builds/worker/workspace/build/src/dom/events/EventDispatcher.cpp #59 0x7fc5db34ca28 in nsINode::DispatchEvent(mozilla::dom::Event&, mozilla::dom::CallerType, mozilla::ErrorResult&) /builds/worker/workspace/build/src/dom/base/nsINode.cpp:1079:5 #60 0x7fc5dde28e53 in mozilla::dom::EventTarget::DispatchEvent(mozilla::dom::Event&) /builds/worker/workspace/build/src/dom/events/EventTarget.cpp:204:13 #61 0x7fc5ddd9f0ec in mozilla::AsyncEventDispatcher::Run() /builds/worker/workspace/build/src/dom/events/AsyncEventDispatcher.cpp:68:12 #62 0x7fc5daea2e1f in nsContentUtils::RemoveScriptBlocker() /builds/worker/workspace/build/src/dom/base/nsContentUtils.cpp:5633:15 #63 0x7fc5db27ba17 in nsDocument::EndUpdate(unsigned int) /builds/worker/workspace/build/src/dom/base/nsDocument.cpp:5078:3 #64 0x7fc5de2001cc in nsHTMLDocument::EndUpdate(unsigned int) /builds/worker/workspace/build/src/dom/html/nsHTMLDocument.cpp:2119:15 #65 0x7fc5db084c84 in ~mozAutoDocUpdate /builds/worker/workspace/build/src/dom/base/mozAutoDocUpdate.h:40:18 #66 0x7fc5db084c84 in mozilla::dom::Element::SetAttr(int, nsAtom*, nsAtom*, nsTSubstring<char16_t> const&, nsIPrincipal*, bool) /builds/worker/workspace/build/src/dom/base/Element.cpp:2542 #67 0x7fc5dd1f76d0 in SetAttr /builds/worker/workspace/build/src/obj-firefox/dist/include/mozilla/dom/Element.h:838:12 #68 0x7fc5dd1f76d0 in SetAttr /builds/worker/workspace/build/src/obj-firefox/dist/include/mozilla/dom/Element.h:833 #69 0x7fc5dd1f76d0 in SetAttr /builds/worker/workspace/build/src/obj-firefox/dist/include/mozilla/dom/Element.h:1597 #70 0x7fc5dd1f76d0 in SetHTMLAttr /builds/worker/workspace/build/src/dom/html/nsGenericHTMLElement.h:776 #71 0x7fc5dd1f76d0 in SetUnsignedIntAttr /builds/worker/workspace/build/src/dom/html/nsGenericHTMLElement.h:852 #72 0x7fc5dd1f76d0 in SetWidth /builds/worker/workspace/build/src/obj-firefox/dist/include/mozilla/dom/HTMLCanvasElement.h:170 #73 0x7fc5dd1f76d0 in mozilla::dom::HTMLCanvasElementBinding::set_width(JSContext*, JS::Handle<JSObject*>, mozilla::dom::HTMLCanvasElement*, JSJitSetterCallArgs) /builds/worker/workspace/build/src/obj-firefox/dom/bindings/HTMLCanvasElementBinding.cpp:137 #74 0x7fc5dd6e3e23 in bool mozilla::dom::binding_detail::GenericSetter<mozilla::dom::binding_detail::NormalThisPolicy>(JSContext*, unsigned int, JS::Value*) /builds/worker/workspace/build/src/dom/bindings/BindingUtils.cpp:3204:8 #75 0x7fc5e3f91027 in CallJSNative /builds/worker/workspace/build/src/js/src/vm/JSContext-inl.h:280:15 #76 0x7fc5e3f91027 in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct) /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:467 #77 0x7fc5e3f93c56 in InternalCall /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:516:12 #78 0x7fc5e3f93c56 in Call /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:535 #79 0x7fc5e3f93c56 in js::CallSetter(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::Handle<JS::Value>) /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:664 #80 0x7fc5e4f458fc in SetExistingProperty(JSContext*, JS::Handle<js::NativeObject*>, JS::Handle<jsid>, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::Handle<js::NativeObject*>, JS::Handle<JS::PropertyResult>, JS::ObjectOpResult&) /builds/worker/workspace/build/src/js/src/vm/NativeObject.cpp:2783:10 #81 0x7fc5e4f3d69b in bool js::NativeSetProperty<(js::QualifiedBool)1>(JSContext*, JS::Handle<js::NativeObject*>, JS::Handle<jsid>, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::ObjectOpResult&) /builds/worker/workspace/build/src/js/src/vm/NativeObject.cpp:2811:20 #82 0x7fc5e3f73685 in SetProperty /builds/worker/workspace/build/src/js/src/vm/NativeObject.h:1648:12 #83 0x7fc5e3f73685 in SetPropertyOperation /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:264 #84 0x7fc5e3f73685 in Interpret(JSContext*, js::RunState&) /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:2881 #85 0x7fc5e3f61fe3 in js::RunScript(JSContext*, js::RunState&) /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:417:12 #86 0x7fc5e3f90da5 in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct) /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:489:15 #87 0x7fc5e3f92022 in js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>) /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:535:10 #88 0x7fc5e4ac9f6a in JS::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::HandleValueArray const&, JS::MutableHandle<JS::Value>) /builds/worker/workspace/build/src/js/src/jsapi.cpp:2989:12 #89 0x7fc5dce72cf5 in mozilla::dom::EventListener::HandleEvent(JSContext*, JS::Handle<JS::Value>, mozilla::dom::Event&, mozilla::ErrorResult&) /builds/worker/workspace/build/src/obj-firefox/dom/bindings/EventListenerBinding.cpp:51:8 #90 0x7fc5dde18c2e in HandleEvent<mozilla::dom::EventTarget *> /builds/worker/workspace/build/src/obj-firefox/dist/include/mozilla/dom/EventListenerBinding.h:66:12 #91 0x7fc5dde18c2e in mozilla::EventListenerManager::HandleEventSubType(mozilla::EventListenerManager::Listener*, mozilla::dom::Event*, mozilla::dom::EventTarget*) /builds/worker/workspace/build/src/dom/events/EventListenerManager.cpp:1118 #92 0x7fc5dde1a38b in mozilla::EventListenerManager::HandleEventInternal(nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event**, mozilla::dom::EventTarget*, nsEventStatus*) /builds/worker/workspace/build/src/dom/events/EventListenerManager.cpp:1288:20 #93 0x7fc5dde04737 in mozilla::EventTargetChainItem::HandleEventTargetChain(nsTArray<mozilla::EventTargetChainItem>&, mozilla::EventChainPostVisitor&, mozilla::EventDispatchingCallback*, mozilla::ELMCreationDetector&) /builds/worker/workspace/build/src/dom/events/EventDispatcher.cpp:528:16 #94 0x7fc5dde08533 in mozilla::EventDispatcher::Dispatch(nsISupports*, nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event*, nsEventStatus*, mozilla::EventDispatchingCallback*, nsTArray<mozilla::dom::EventTarget*>*) /builds/worker/workspace/build/src/dom/events/EventDispatcher.cpp:961:9 #95 0x7fc5e00e8068 in nsDocumentViewer::LoadComplete(nsresult) /builds/worker/workspace/build/src/layout/base/nsDocumentViewer.cpp:1064:7 #96 0x7fc5e3241452 in nsDocShell::EndPageLoad(nsIWebProgress*, nsIChannel*, nsresult) /builds/worker/workspace/build/src/docshell/base/nsDocShell.cpp:7246:21 #97 0x7fc5e323d879 in nsDocShell::OnStateChange(nsIWebProgress*, nsIRequest*, unsigned int, nsresult) /builds/worker/workspace/build/src/docshell/base/nsDocShell.cpp:7039:7 #98 0x7fc5e324507f in non-virtual thunk to nsDocShell::OnStateChange(nsIWebProgress*, nsIRequest*, unsigned int, nsresult) /builds/worker/workspace/build/src/docshell/base/nsDocShell.cpp #99 0x7fc5d9ec0297 in nsDocLoader::DoFireOnStateChange(nsIWebProgress*, nsIRequest*, int&, nsresult) /builds/worker/workspace/build/src/uriloader/base/nsDocLoader.cpp:1315:3 #100 0x7fc5d9ebf31a in nsDocLoader::doStopDocumentLoad(nsIRequest*, nsresult) /builds/worker/workspace/build/src/uriloader/base/nsDocLoader.cpp:858:14 #101 0x7fc5d9ebbef5 in nsDocLoader::DocLoaderIsEmpty(bool) /builds/worker/workspace/build/src/uriloader/base/nsDocLoader.cpp:747:9 #102 0x7fc5d9ebdebc in nsDocLoader::OnStopRequest(nsIRequest*, nsISupports*, nsresult) /builds/worker/workspace/build/src/uriloader/base/nsDocLoader.cpp:632:5 #103 0x7fc5d9ebeedc in non-virtual thunk to nsDocLoader::OnStopRequest(nsIRequest*, nsISupports*, nsresult) /builds/worker/workspace/build/src/uriloader/base/nsDocLoader.cpp #104 0x7fc5d82752ea in mozilla::net::nsLoadGroup::RemoveRequest(nsIRequest*, nsISupports*, nsresult) /builds/worker/workspace/build/src/netwerk/base/nsLoadGroup.cpp:629:28 #105 0x7fc5db29ea9a in DoUnblockOnload /builds/worker/workspace/build/src/dom/base/nsDocument.cpp:8401:18 #106 0x7fc5db29ea9a in nsDocument::UnblockOnload(bool) /builds/worker/workspace/build/src/dom/base/nsDocument.cpp:8323 #107 0x7fc5db27f414 in nsIDocument::DispatchContentLoadedEvents() /builds/worker/workspace/build/src/dom/base/nsDocument.cpp:5303:3 #108 0x7fc5db391da4 in applyImpl<nsIDocument, void (nsIDocument::*)()> /builds/worker/workspace/build/src/obj-firefox/dist/include/nsThreadUtils.h:1165:12 #109 0x7fc5db391da4 in apply<nsIDocument, void (nsIDocument::*)()> /builds/worker/workspace/build/src/obj-firefox/dist/include/nsThreadUtils.h:1171 #110 0x7fc5db391da4 in mozilla::detail::RunnableMethodImpl<nsIDocument*, void (nsIDocument::*)(), true, (mozilla::RunnableKind)0>::Run() /builds/worker/workspace/build/src/obj-firefox/dist/include/nsThreadUtils.h:1216 #111 0x7fc5d806d2a1 in mozilla::SchedulerGroup::Runnable::Run() /builds/worker/workspace/build/src/xpcom/threads/SchedulerGroup.cpp:337:32 #112 0x7fc5d808bf63 in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:1090:14 #113 0x7fc5d80a7b30 in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/workspace/build/src/xpcom/threads/nsThreadUtils.cpp:519:10 #114 0x7fc5d8f8665a in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) /builds/worker/workspace/build/src/ipc/glue/MessagePump.cpp:97:21 #115 0x7fc5d8eda649 in RunInternal /builds/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:326:10 #116 0x7fc5d8eda649 in RunHandler /builds/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:319 #117 0x7fc5d8eda649 in MessageLoop::Run() /builds/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:299 #118 0x7fc5dfa4defa in nsBaseAppShell::Run() /builds/worker/workspace/build/src/widget/nsBaseAppShell.cpp:157:27 #119 0x7fc5e3ca832b in XRE_RunAppShell() /builds/worker/workspace/build/src/toolkit/xre/nsEmbedFunctions.cpp:893:22 #120 0x7fc5d8eda649 in RunInternal /builds/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:326:10 #121 0x7fc5d8eda649 in RunHandler /builds/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:319 #122 0x7fc5d8eda649 in MessageLoop::Run() /builds/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:299 #123 0x7fc5e3ca7cf0 in XRE_InitChildProcess(int, char**, XREChildData const*) /builds/worker/workspace/build/src/toolkit/xre/nsEmbedFunctions.cpp:719:34 #124 0x4f50dc in content_process_main /builds/worker/workspace/build/src/browser/app/../../ipc/contentproc/plugin-container.cpp:50:30 #125 0x4f50dc in main /builds/worker/workspace/build/src/browser/app/nsBrowserApp.cpp:282 #126 0x7fc5f7d1482f in __libc_start_main /build/glibc-Cl5G7W/glibc-2.23/csu/../csu/libc-start.c:291 #127 0x42476c in _start (/home/forb1dden/builds/mc-asan/firefox+0x42476c) 0x7fc5cdaa4080 is located 120960 bytes inside of 131072-byte region [0x7fc5cda86800,0x7fc5cdaa6800) freed by thread T0 (file:// Content) here: #0 0x4c58b2 in realloc /builds/worker/workspace/moz-toolchain/src/llvm/projects/compiler-rt/lib/asan/asan_malloc_linux.cc:107:3 #1 0x4f616d in moz_xrealloc /builds/worker/workspace/build/src/memory/mozalloc/mozalloc.cpp:93:20 #2 0x7fc5d7ee080c in Realloc /builds/worker/workspace/build/src/obj-firefox/dist/include/nsTArray.h:212:12 #3 0x7fc5d7ee080c in nsTArrayInfallibleAllocator::ResultTypeProxy nsTArray_base<nsTArrayInfallibleAllocator, nsTArray_CopyWithMemutils>::EnsureCapacity<nsTArrayInfallibleAllocator>(unsigned long, unsigned long) /builds/worker/workspace/build/src/obj-firefox/dist/include/nsTArray-inl.h:183 #4 0x7fc5e3b0149b in AppendElement<mozilla::Telemetry::KeyedHistogramAccumulation, nsTArrayInfallibleAllocator> /builds/worker/workspace/build/src/obj-firefox/dist/include/nsTArray.h:2286:47 #5 0x7fc5e3b0149b in mozilla::TelemetryIPCAccumulator::AccumulateChildKeyedHistogram(mozilla::Telemetry::HistogramID, nsTString<char> const&, unsigned int) /builds/worker/workspace/build/src/toolkit/components/telemetry/ipc/TelemetryIPCAccumulator.cpp:173 #6 0x7fc5e3ad48a8 in internal_RemoteAccumulate /builds/worker/workspace/build/src/toolkit/components/telemetry/TelemetryHistogram.cpp:932:3 #7 0x7fc5e3ad48a8 in internal_Accumulate /builds/worker/workspace/build/src/toolkit/components/telemetry/TelemetryHistogram.cpp:953 #8 0x7fc5e3ad48a8 in TelemetryHistogram::Accumulate(mozilla::Telemetry::HistogramID, nsTString<char> const&, unsigned int) /builds/worker/workspace/build/src/toolkit/components/telemetry/TelemetryHistogram.cpp:1892 #9 0x7fc5d808c4d2 in ~AutoTimer /builds/worker/workspace/build/src/obj-firefox/dist/include/mozilla/Telemetry.h:298:7 #10 0x7fc5d808c4d2 in reset /builds/worker/workspace/build/src/obj-firefox/dist/include/mozilla/Maybe.h:536 #11 0x7fc5d808c4d2 in ~Maybe /builds/worker/workspace/build/src/obj-firefox/dist/include/mozilla/Maybe.h:188 #12 0x7fc5d808c4d2 in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:1110 #13 0x7fc5d80a7b30 in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/workspace/build/src/xpcom/threads/nsThreadUtils.cpp:519:10 #14 0x7fc5df785ad9 in SpinEventLoopUntil<mozilla::ProcessFailureBehavior::ReportToCaller, (lambda at /builds/worker/workspace/build/src/dom/xhr/XMLHttpRequestMainThread.cpp:2911:31)> /builds/worker/workspace/build/src/obj-firefox/dist/include/nsThreadUtils.h:324:25 #15 0x7fc5df785ad9 in mozilla::dom::XMLHttpRequestMainThread::SendInternal(mozilla::dom::BodyExtractorBase const*) /builds/worker/workspace/build/src/dom/xhr/XMLHttpRequestMainThread.cpp:2911 #16 0x7fc5df783de4 in mozilla::dom::XMLHttpRequestMainThread::Send(JSContext*, mozilla::dom::Nullable<mozilla::dom::DocumentOrBlobOrArrayBufferViewOrArrayBufferOrFormDataOrURLSearchParamsOrUSVString> const&, mozilla::ErrorResult&) /builds/worker/workspace/build/src/dom/xhr/XMLHttpRequestMainThread.cpp:2696:11 #17 0x7fc5dcc0c064 in mozilla::dom::XMLHttpRequestBinding::send(JSContext*, JS::Handle<JSObject*>, mozilla::dom::XMLHttpRequest*, JSJitMethodCallArgs const&) /builds/worker/workspace/build/src/obj-firefox/dom/bindings/XMLHttpRequestBinding.cpp:1275:9 #18 0x7fc5dd6e6721 in bool mozilla::dom::binding_detail::GenericMethod<mozilla::dom::binding_detail::NormalThisPolicy, mozilla::dom::binding_detail::ThrowExceptions>(JSContext*, unsigned int, JS::Value*) /builds/worker/workspace/build/src/dom/bindings/BindingUtils.cpp:3260:13 #19 0x1470b86cd1ef (<unknown module>) #20 0x621002117d17 (<unknown module>) #21 0x1470b86564e1 (<unknown module>) #22 0x7fc5e4507ed6 in EnterJit /builds/worker/workspace/build/src/js/src/jit/Jit.cpp:99:9 #23 0x7fc5e4507ed6 in js::jit::MaybeEnterJit(JSContext*, js::RunState&) /builds/worker/workspace/build/src/js/src/jit/Jit.cpp:163 #24 0x7fc5e3f61cc4 in js::RunScript(JSContext*, js::RunState&) /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:402:34 #25 0x7fc5e3f90da5 in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct) /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:489:15 #26 0x7fc5e3f92022 in js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>) /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:535:10 #27 0x7fc5e4ac9f6a in JS::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::HandleValueArray const&, JS::MutableHandle<JS::Value>) /builds/worker/workspace/build/src/js/src/jsapi.cpp:2989:12 #28 0x7fc5dce72cf5 in mozilla::dom::EventListener::HandleEvent(JSContext*, JS::Handle<JS::Value>, mozilla::dom::Event&, mozilla::ErrorResult&) /builds/worker/workspace/build/src/obj-firefox/dom/bindings/EventListenerBinding.cpp:51:8 #29 0x7fc5dde18c2e in HandleEvent<mozilla::dom::EventTarget *> /builds/worker/workspace/build/src/obj-firefox/dist/include/mozilla/dom/EventListenerBinding.h:66:12 #30 0x7fc5dde18c2e in mozilla::EventListenerManager::HandleEventSubType(mozilla::EventListenerManager::Listener*, mozilla::dom::Event*, mozilla::dom::EventTarget*) /builds/worker/workspace/build/src/dom/events/EventListenerManager.cpp:1118 #31 0x7fc5dde1a38b in mozilla::EventListenerManager::HandleEventInternal(nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event**, mozilla::dom::EventTarget*, nsEventStatus*) /builds/worker/workspace/build/src/dom/events/EventListenerManager.cpp:1288:20 #32 0x7fc5dde043df in mozilla::EventTargetChainItem::HandleEventTargetChain(nsTArray<mozilla::EventTargetChainItem>&, mozilla::EventChainPostVisitor&, mozilla::EventDispatchingCallback*, mozilla::ELMCreationDetector&) /builds/worker/workspace/build/src/dom/events/EventDispatcher.cpp:482:12 #33 0x7fc5dde08533 in mozilla::EventDispatcher::Dispatch(nsISupports*, nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event*, nsEventStatus*, mozilla::EventDispatchingCallback*, nsTArray<mozilla::dom::EventTarget*>*) /builds/worker/workspace/build/src/dom/events/EventDispatcher.cpp:961:9 #34 0x7fc5dde0aa6b in mozilla::EventDispatcher::DispatchDOMEvent(nsISupports*, mozilla::WidgetEvent*, mozilla::dom::Event*, nsPresContext*, nsEventStatus*) /builds/worker/workspace/build/src/dom/events/EventDispatcher.cpp #35 0x7fc5db34ca28 in nsINode::DispatchEvent(mozilla::dom::Event&, mozilla::dom::CallerType, mozilla::ErrorResult&) /builds/worker/workspace/build/src/dom/base/nsINode.cpp:1079:5 #36 0x7fc5dde28e53 in mozilla::dom::EventTarget::DispatchEvent(mozilla::dom::Event&) /builds/worker/workspace/build/src/dom/events/EventTarget.cpp:204:13 #37 0x7fc5ddd9f0ec in mozilla::AsyncEventDispatcher::Run() /builds/worker/workspace/build/src/dom/events/AsyncEventDispatcher.cpp:68:12 #38 0x7fc5daea2e1f in nsContentUtils::RemoveScriptBlocker() /builds/worker/workspace/build/src/dom/base/nsContentUtils.cpp:5633:15 #39 0x7fc5db27ba17 in nsDocument::EndUpdate(unsigned int) /builds/worker/workspace/build/src/dom/base/nsDocument.cpp:5078:3 previously allocated by thread T0 (file:// Content) here: #0 0x4c58b2 in realloc /builds/worker/workspace/moz-toolchain/src/llvm/projects/compiler-rt/lib/asan/asan_malloc_linux.cc:107:3 #1 0x4f616d in moz_xrealloc /builds/worker/workspace/build/src/memory/mozalloc/mozalloc.cpp:93:20 #2 0x7fc5d7ee080c in Realloc /builds/worker/workspace/build/src/obj-firefox/dist/include/nsTArray.h:212:12 #3 0x7fc5d7ee080c in nsTArrayInfallibleAllocator::ResultTypeProxy nsTArray_base<nsTArrayInfallibleAllocator, nsTArray_CopyWithMemutils>::EnsureCapacity<nsTArrayInfallibleAllocator>(unsigned long, unsigned long) /builds/worker/workspace/build/src/obj-firefox/dist/include/nsTArray-inl.h:183 #4 0x7fc5e3b0149b in AppendElement<mozilla::Telemetry::KeyedHistogramAccumulation, nsTArrayInfallibleAllocator> /builds/worker/workspace/build/src/obj-firefox/dist/include/nsTArray.h:2286:47 #5 0x7fc5e3b0149b in mozilla::TelemetryIPCAccumulator::AccumulateChildKeyedHistogram(mozilla::Telemetry::HistogramID, nsTString<char> const&, unsigned int) /builds/worker/workspace/build/src/toolkit/components/telemetry/ipc/TelemetryIPCAccumulator.cpp:173 #6 0x7fc5e3ad48a8 in internal_RemoteAccumulate /builds/worker/workspace/build/src/toolkit/components/telemetry/TelemetryHistogram.cpp:932:3 #7 0x7fc5e3ad48a8 in internal_Accumulate /builds/worker/workspace/build/src/toolkit/components/telemetry/TelemetryHistogram.cpp:953 #8 0x7fc5e3ad48a8 in TelemetryHistogram::Accumulate(mozilla::Telemetry::HistogramID, nsTString<char> const&, unsigned int) /builds/worker/workspace/build/src/toolkit/components/telemetry/TelemetryHistogram.cpp:1892 #9 0x7fc5d808c4d2 in ~AutoTimer /builds/worker/workspace/build/src/obj-firefox/dist/include/mozilla/Telemetry.h:298:7 #10 0x7fc5d808c4d2 in reset /builds/worker/workspace/build/src/obj-firefox/dist/include/mozilla/Maybe.h:536 #11 0x7fc5d808c4d2 in ~Maybe /builds/worker/workspace/build/src/obj-firefox/dist/include/mozilla/Maybe.h:188 #12 0x7fc5d808c4d2 in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:1110 #13 0x7fc5d80a7b30 in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/workspace/build/src/xpcom/threads/nsThreadUtils.cpp:519:10 #14 0x7fc5df785ad9 in SpinEventLoopUntil<mozilla::ProcessFailureBehavior::ReportToCaller, (lambda at /builds/worker/workspace/build/src/dom/xhr/XMLHttpRequestMainThread.cpp:2911:31)> /builds/worker/workspace/build/src/obj-firefox/dist/include/nsThreadUtils.h:324:25 #15 0x7fc5df785ad9 in mozilla::dom::XMLHttpRequestMainThread::SendInternal(mozilla::dom::BodyExtractorBase const*) /builds/worker/workspace/build/src/dom/xhr/XMLHttpRequestMainThread.cpp:2911 #16 0x7fc5df783de4 in mozilla::dom::XMLHttpRequestMainThread::Send(JSContext*, mozilla::dom::Nullable<mozilla::dom::DocumentOrBlobOrArrayBufferViewOrArrayBufferOrFormDataOrURLSearchParamsOrUSVString> const&, mozilla::ErrorResult&) /builds/worker/workspace/build/src/dom/xhr/XMLHttpRequestMainThread.cpp:2696:11 #17 0x7fc5dcc0c064 in mozilla::dom::XMLHttpRequestBinding::send(JSContext*, JS::Handle<JSObject*>, mozilla::dom::XMLHttpRequest*, JSJitMethodCallArgs const&) /builds/worker/workspace/build/src/obj-firefox/dom/bindings/XMLHttpRequestBinding.cpp:1275:9 #18 0x7fc5dd6e6721 in bool mozilla::dom::binding_detail::GenericMethod<mozilla::dom::binding_detail::NormalThisPolicy, mozilla::dom::binding_detail::ThrowExceptions>(JSContext*, unsigned int, JS::Value*) /builds/worker/workspace/build/src/dom/bindings/BindingUtils.cpp:3260:13 #19 0x1470b86cd1ef (<unknown module>) #20 0x621002117ae7 (<unknown module>) #21 0x1470b86564e1 (<unknown module>) #22 0x7fc5e4507ed6 in EnterJit /builds/worker/workspace/build/src/js/src/jit/Jit.cpp:99:9 #23 0x7fc5e4507ed6 in js::jit::MaybeEnterJit(JSContext*, js::RunState&) /builds/worker/workspace/build/src/js/src/jit/Jit.cpp:163 #24 0x7fc5e3f61cc4 in js::RunScript(JSContext*, js::RunState&) /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:402:34 #25 0x7fc5e3f90da5 in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct) /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:489:15 #26 0x7fc5e3f92022 in js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>) /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:535:10 #27 0x7fc5e4ac9f6a in JS::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::HandleValueArray const&, JS::MutableHandle<JS::Value>) /builds/worker/workspace/build/src/js/src/jsapi.cpp:2989:12 #28 0x7fc5dce72cf5 in mozilla::dom::EventListener::HandleEvent(JSContext*, JS::Handle<JS::Value>, mozilla::dom::Event&, mozilla::ErrorResult&) /builds/worker/workspace/build/src/obj-firefox/dom/bindings/EventListenerBinding.cpp:51:8 #29 0x7fc5dde18c2e in HandleEvent<mozilla::dom::EventTarget *> /builds/worker/workspace/build/src/obj-firefox/dist/include/mozilla/dom/EventListenerBinding.h:66:12 #30 0x7fc5dde18c2e in mozilla::EventListenerManager::HandleEventSubType(mozilla::EventListenerManager::Listener*, mozilla::dom::Event*, mozilla::dom::EventTarget*) /builds/worker/workspace/build/src/dom/events/EventListenerManager.cpp:1118 #31 0x7fc5dde1a38b in mozilla::EventListenerManager::HandleEventInternal(nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event**, mozilla::dom::EventTarget*, nsEventStatus*) /builds/worker/workspace/build/src/dom/events/EventListenerManager.cpp:1288:20 #32 0x7fc5dde043df in mozilla::EventTargetChainItem::HandleEventTargetChain(nsTArray<mozilla::EventTargetChainItem>&, mozilla::EventChainPostVisitor&, mozilla::EventDispatchingCallback*, mozilla::ELMCreationDetector&) /builds/worker/workspace/build/src/dom/events/EventDispatcher.cpp:482:12 #33 0x7fc5dde08533 in mozilla::EventDispatcher::Dispatch(nsISupports*, nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event*, nsEventStatus*, mozilla::EventDispatchingCallback*, nsTArray<mozilla::dom::EventTarget*>*) /builds/worker/workspace/build/src/dom/events/EventDispatcher.cpp:961:9 #34 0x7fc5dde0aa6b in mozilla::EventDispatcher::DispatchDOMEvent(nsISupports*, mozilla::WidgetEvent*, mozilla::dom::Event*, nsPresContext*, nsEventStatus*) /builds/worker/workspace/build/src/dom/events/EventDispatcher.cpp #35 0x7fc5db34ca28 in nsINode::DispatchEvent(mozilla::dom::Event&, mozilla::dom::CallerType, mozilla::ErrorResult&) /builds/worker/workspace/build/src/dom/base/nsINode.cpp:1079:5 #36 0x7fc5dde28e53 in mozilla::dom::EventTarget::DispatchEvent(mozilla::dom::Event&) /builds/worker/workspace/build/src/dom/events/EventTarget.cpp:204:13 #37 0x7fc5ddd9f0ec in mozilla::AsyncEventDispatcher::Run() /builds/worker/workspace/build/src/dom/events/AsyncEventDispatcher.cpp:68:12 #38 0x7fc5daea2e1f in nsContentUtils::RemoveScriptBlocker() /builds/worker/workspace/build/src/dom/base/nsContentUtils.cpp:5633:15 #39 0x7fc5db27ba17 in nsDocument::EndUpdate(unsigned int) /builds/worker/workspace/build/src/dom/base/nsDocument.cpp:5078:3 SUMMARY: AddressSanitizer: heap-use-after-free /builds/worker/workspace/build/src/gfx/2d/SwizzleSSE2.cpp:21:10 in LoadRemainder_SSE2 Shadow bytes around the buggy address: 0x0ff939b4c7c0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x0ff939b4c7d0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x0ff939b4c7e0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x0ff939b4c7f0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x0ff939b4c800: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd =>0x0ff939b4c810:[fd]fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x0ff939b4c820: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x0ff939b4c830: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x0ff939b4c840: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x0ff939b4c850: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x0ff939b4c860: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb ==15553==ABORTING
Related to bug 1459162 perhaps?
Group: core-security → gfx-core-security
Flags: needinfo?(jkratzer)
Flags: needinfo?(jkratzer)
(In reply to Ryan VanderMeulen [:RyanVM] from comment #1) > Related to bug 1459162 perhaps? The stack looks similar. I assume we'll know more once the testcase has been reduced.
(In reply to Jason Kratzer [:jkratzer] from comment #2) > (In reply to Ryan VanderMeulen [:RyanVM] from comment #1) > > Related to bug 1459162 perhaps? > > The stack looks similar. I assume we'll know more once the testcase has > been reduced. Also, there's a patch (awaiting review) in bug 1459162; maybe you could apply it locally and see if it fixes the problem?
ni?jason for comment 3
Flags: needinfo?(jthomas)
I believe this ni is for :jkratzer, redirecting.
Flags: needinfo?(jthomas) → needinfo?(jkratzer)
Attached file trigger.html —
Still waiting on my build to complete. Will test against the patch once it's done.
Flags: needinfo?(jkratzer)
Finally had a chance to test this against the patch in bug 1459162 and it no longer triggers. Marking this as a duplicate.
Status: NEW → RESOLVED
Closed: 7 years ago
Resolution: --- → DUPLICATE
Group: gfx-core-security
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: