1507259 - AddressSanitizer: stack-overflow /builds/worker/workspace/moz-toolchain/src/llvm/projects/compiler-rt/lib/asan/asan_interceptors_memintrinsics.cc:27:3 in __asan_memset

Status: RESOLVED WORKSFORME

(Core :: Graphics, defect, P5)

Description

[Jason Kratzer [:jkratzer]]

Attachment: testcase.html

Testcase found while fuzzing mozilla-central rev 073045259e75.

SUMMARY: AddressSanitizer: stack-overflow /builds/worker/workspace/moz-toolchain/src/llvm/projects/compiler-rt/lib/asan/asan_interceptors_memintrinsics.cc:27:3 in __asan_memset
==32386==ABORTING
=================================================================
==7391==ERROR: AddressSanitizer: stack-overflow on address 0x7ffc1bc21ff8 (pc 0x560d3c87027e bp 0x7ffc1bc22850 sp 0x7ffc1bc22000 T0)
    #0 0x560d3c87027d in __asan_memset /builds/worker/workspace/moz-toolchain/src/llvm/projects/compiler-rt/lib/asan/asan_interceptors_memintrinsics.cc:27:3
    #1 0x7f146a13340a in list_remove<(anonymous namespace)::Edge, &(anonymous namespace)::Edge::fPrevEdgeAbove, &(anonymous namespace)::Edge::fNextEdgeAbove> /builds/worker/workspace/build/src/gfx/skia/skia/src/gpu/GrTessellator.cpp:133:14
    #2 0x7f146a13340a in remove_edge_above /builds/worker/workspace/build/src/gfx/skia/skia/src/gpu/GrTessellator.cpp:917
    #3 0x7f146a13340a in set_bottom /builds/worker/workspace/build/src/gfx/skia/skia/src/gpu/GrTessellator.cpp:1004
    #4 0x7f146a13340a in (anonymous namespace)::merge_edges_above((anonymous namespace)::Edge*, (anonymous namespace)::Edge*, (anonymous namespace)::EdgeList*, (anonymous namespace)::Vertex**, (anonymous namespace)::Comparator&) /builds/worker/workspace/build/src/gfx/skia/skia/src/gpu/GrTessellator.cpp:1029
    #5 0x7f146a132273 in (anonymous namespace)::merge_collinear_edges((anonymous namespace)::Edge*, (anonymous namespace)::EdgeList*, (anonymous namespace)::Vertex**, (anonymous namespace)::Comparator&) /builds/worker/workspace/build/src/gfx/skia/skia/src/gpu/GrTessellator.cpp
    #6 0x7f146a132273 in (anonymous namespace)::merge_collinear_edges((anonymous namespace)::Edge*, (anonymous namespace)::EdgeList*, (anonymous namespace)::Vertex**, (anonymous namespace)::Comparator&) /builds/worker/workspace/build/src/gfx/skia/skia/src/gpu/GrTessellator.cpp
    #7 0x7f146a132273 in (anonymous namespace)::merge_collinear_edges((anonymous namespace)::Edge*, (anonymous namespace)::EdgeList*, (anonymous namespace)::Vertex**, (anonymous namespace)::Comparator&) /builds/worker/workspace/build/src/gfx/skia/skia/src/gpu/GrTessellator.cpp
    #8 0x7f146a132273 in (anonymous namespace)::merge_collinear_edges((anonymous namespace)::Edge*, (anonymous namespace)::EdgeList*, (anonymous namespace)::Vertex**, (anonymous namespace)::Comparator&) /builds/worker/workspace/build/src/gfx/skia/skia/src/gpu/GrTessellator.cpp
...truncated...

Comment 1

[Andrew Osmond [:aosmond] (he/him)]

I was only able to reproduce with gfx.canvas.azure.accelerated set to true (+ forcing OpenGL acceleration). Reviewing bug 1468801, I don't think we should normally hit this code path since we deprecated support.

Comment 2

[Intermittent Failures Robot]

1 failures in 2917 pushes (0.0 failures/push) were associated with this bug in the last 7 days.

Repository breakdown:
* mozilla-central: 1

Platform breakdown:
* linux64: 1

For more details, see:
https://treeherder.mozilla.org/intermittent-failures.html#/bugdetails?bug=1507259&startday=2018-11-12&endday=2018-11-18&tree=all

Comment 3

[Timea Cernea [:tbabos][inactive]]

Hey Jason,
Please update the resolution or the affected flags for this issue when you have the time. Thank you!

Comment 4

[Jason Kratzer [:jkratzer]]

I can no longer reproduce this issue on mozilla-central rev fc74eb2c7b84. I think we can safely close this issue.