Closed Bug 1536847 Opened 6 years ago Closed 6 years ago

Intermittent SUMMARY: AddressSanitizer: heap-use-after-free z:\build\build\src\gfx\vr\gfxVRPuppet.cpp:752 in mozilla::gfx::VRSystemManagerPuppet::GetHMDs(class nsTArray<class RefPtr<class mozilla::gfx::VRDisplayHost> > &)

Categories

(Core :: WebVR, defect, P5)

Product:
Core
Component:
WebVR
Type:
defect

Tracking

()

Status:
RESOLVED DUPLICATE of bug 1537692

People

(Reporter: intermittent-bug-filer, Unassigned)

Details

(Keywords: intermittent-failure, regression)

#[markdown(off)]
Filed by: aiakab [at] mozilla.com

https://treeherder.mozilla.org/logviewer.html#?job_id=234959654&repo=mozilla-central

https://queue.taskcluster.net/v1/task/ZuJslCNQQVuPfNicIVaNEg/runs/0/artifacts/public/logs/live_backing.log

https://hg.mozilla.org/mozilla-central/raw-file/tip/layout/tools/reftest/reftest-analyzer.xhtml#logurl=https://queue.taskcluster.net/v1/task/ZuJslCNQQVuPfNicIVaNEg/runs/0/artifacts/public/logs/live_backing.log&only_show_unexpected=1

12:58:41 INFO - REFTEST TEST-PASS | file:///Z:/task_1553084136/build/tests/reftest/tests/dom/vr/test/reftest/change_size.html == file:///Z:/task_1553084136/build/tests/reftest/tests/dom/vr/test/reftest/wrapper.html?change_size.png | image comparison, max difference: 0, number of differing pixels: 0
12:58:41 INFO - REFTEST TEST-END | file:///Z:/task_1553084136/build/tests/reftest/tests/dom/vr/test/reftest/change_size.html == file:///Z:/task_1553084136/build/tests/reftest/tests/dom/vr/test/reftest/wrapper.html?change_size.png
12:58:41 INFO - REFTEST INFO | RESTORE PREFERENCE pref(dom.vr.controller.enumerate.interval,1000)
12:58:41 INFO - REFTEST INFO | RESTORE PREFERENCE pref(dom.vr.display.enumerate.interval,5000)
12:58:41 INFO - REFTEST INFO | RESTORE PREFERENCE pref(dom.vr.display.rafMaxDuration,50)
12:58:41 INFO - REFTEST INFO | RESTORE PREFERENCE pref(dom.vr.puppet.submitframe,0)
12:58:41 INFO - REFTEST INFO | RESTORE PREFERENCE pref(dom.vr.require-gesture,true)
12:58:41 INFO - REFTEST INFO | RESTORE PREFERENCE pref(dom.vr.test.enabled,false)
12:58:41 INFO - REFTEST INFO | RESTORE PREFERENCE pref(dom.vr.puppet.enabled,false)
12:58:41 INFO - REFTEST INFO | Slowest test took 1120ms (file:///Z:/task_1553084136/build/tests/reftest/tests/dom/vr/test/reftest/draw_rect.html)
12:58:41 INFO - REFTEST INFO | Total canvas count = 0
12:58:41 INFO - [Parent 5116, Gecko_IOThread] WARNING: pipe error: 109: file z:/build/build/src/ipc/chromium/src/chrome/common/ipc_channel_win.cc, line 341
12:58:41 INFO - [Child 4576, Chrome_ChildThread] WARNING: pipe error: 109: file z:/build/build/src/ipc/chromium/src/chrome/common/ipc_channel_win.cc, line 341
12:58:41 INFO - [Child 4576, Chrome_ChildThread] WARNING: pipe error: 109: file z:/build/build/src/ipc/chromium/src/chrome/common/ipc_channel_win.cc, line 341
12:58:41 INFO - JavaScript error: resource://reftest/reftest.jsm, line 1558: NS_ERROR_NOT_AVAILABLE: Component returned failure code: 0x80040111 (NS_ERROR_NOT_AVAILABLE) [nsIPropertyBag2.getPropertyAsAString]
12:58:41 INFO - [Parent 5116, Gecko_IOThread] WARNING: pipe error: 109: file z:/build/build/src/ipc/chromium/src/chrome/common/ipc_channel_win.cc, line 341
12:58:41 INFO - [GPU 1556, Chrome_ChildThread] WARNING: pipe error: 109: file z:/build/build/src/ipc/chromium[Child 4112, Chrome_ChildThread/src/chrome/cJomavaScript error: resom] WARNING: pipe error: 109: file z:/ource://reftest/reftest.nbuild/build/src/ipcjsm, line 1558: NS_ER/chromiR/OR_NOTium/src/chrome/common/ipc_channe_AVAILABLE: Compl_ponent returned failure cowcinde: 0x80040111 (N.c_c, line 341S_ERROR_NOT_AVAILABLE) [nsIProper
12:58:41 INFO - tyBag2.getPropertyAsAString]
12:58:41 INFO - [cChild 4112h, Chrome_ChildThread] WARNING: pipe error: 109: filaen z:/build/build/snrc/ipc/chromium/src/chrome/common/ipc_channel_ewin.cc, line 341
12:58:41 INFO - l_win.cc, line 341
12:58:41 INFO - ###!!! [Parent][MessageChannel] Error: (msgtype=0x9D0017,name=PVRManager::Msg_UpdateDisplayInfo) Channel closing: too late to send/recv, messages will be lost
12:58:41 INFO - [GPU 1556, Chrome_ChildThread] WARNING: pipe error: 109: file z:/build/build/src/ipc/chromium/src/chrome/common/ipc_channel_win.cc, line 341
12:58:41 INFO - [Parent 5116, Gecko_IOThread] WARNING: pipe error: 109: file z:/build/build/src/ipc/chromium/src/chrome/common/ipc_channel_win.cc, line 341
12:58:41 INFO - [GPU 1556, Chrome_ChildThread] WARNING: pipe error: 109: file z:/build/build/src/ipc/chromium/src/chrome/common/ipc_channel_win.cc, line 341
12:58:41 INFO - [GPU 1556, Chrome_ChildThread] WARNING: pipe error: 109: file z:/build/build/src/ipc/chromium/src/chrome/common/ipc_channel_win.cc, line 341
12:58:41 INFO - [Parent 5116, Gecko_IOThread] WARNING: pipe error: 109: file z:/build/build/src/ipc/chromium/src/chrome/common/ipc_channel_win.cc, line 341
12:58:41 INFO - [Parent 5116, Gecko_IOThread] WARNING: pipe error: 109: file z:/build/build/src/ipc/chromium/src/chrome/common/ipc_channel_win.cc, line 341
12:58:41 INFO - [GPU 1556, Chrome_ChildThread] WARNING: pipe error: 109: file z:/build/build/src/ipc/chromium/src/chrome/common/ipc_channel_win.cc, line 341
12:58:41 INFO - ###!!! [Parent][MessageChannel] Error: (msgtype=0x9D0017,name=PVRManager::Msg_UpdateDisplayInfo) Channel closing: too late to send/recv, messages will be lost
12:58:41 INFO - [GPU 1556, Chrome_ChildThread] WARNING: pipe error: 109: file z:/build/build/src/ipc/chromium/src/chrome/common/ipc_channel_win.cc, line 341
12:58:41 INFO - ###!!! [Parent][RunMessage] Error: Channel closing: too late to send/recv, messages will be lost
12:58:41 INFO - [GPU 1556, Chrome_ChildThread] WARNING: pipe error: 109: file z:/build/build/src/ipc/chromium/src/chrome/common/ipc_channel_win.cc, line 341
12:58:41 INFO - [GPU 1556, Chrome_ChildThread] WARNING: pipe error: 109: file z:/build/build/src/ipc/chromium/src/chrome/common/ipc_channel_win.cc, line 341
12:58:41 INFO - [Parent 5116, Gecko_IOThread] WARNING: pipe error: 109: file z:/build/build/src/ipc/chromium/src/chrome/common/ipc_channel_win.cc, line 341
12:58:41 INFO - [Parent 5116, Gecko_IOThread] WARNING: pipe error: 109: file z:/build/build/src/ipc/chromium/src/chrome/common/ipc_channel_win.cc, line 341
12:58:41 INFO - [Child 8196, Chrome_ChildThread] WARNING: pipe error: 109: file z:/build/build/src/ipc/chromium/src/chrome/common/ipc_channel_win.cc, line 341
12:58:41 INFO - [Child 8196, Chrome_ChildThread] WARNING: pipe error: 109: file z:/build/build/src/ipc/chromium/src/chrome/common/ipc_channel_win.cc, line 341
12:58:41 INFO - JavaScript error: resource://reftest/reftest.jsm, line 1558: NS_ERROR_NOT_AVAILABLE: Component returned failure code: 0x80040111 (NS_ERROR_NOT_AVAILABLE) [nsIPropertyBag2.getPropertyAsAString]
12:58:41 INFO - [Parent 5116, Gecko_IOThread] WARNING: pipe error: 109: file z:/build/build/src/ipc/chromium/src/chrome/common/ipc_channel_win.cc, line 341
12:58:41 INFO - [GPU 1556, Chrome_ChildThread] WARNING: pipe error: 109: file z:/build/build/src/ipc/chromium/src/chrome/common/ipc_channel_win.cc, line 341
12:58:41 INFO - [GPU 1556, Chrome_ChildThread] WARNING: pipe error: 109: file z:/build/build/src/ipc/chromium/src/chrome/common/ipc_channel_win.cc, line 341
12:58:41 INFO - ###!!! [Parent][RunMessage] Error: Channel closing: too late to send/recv, messages will be lost
12:58:41 INFO - [GPU 1556, Chrome_ChildThread] WARNING: pipe error: 109: file z:/build/build/src/ipc/chromium/src/chrome/common/ipc_channel_win.cc, line 341
12:58:41 INFO - [GPU 1556, Chrome_ChildThread] WARNING: pipe error: 109: file z:/build/build/src/ipc/chromium/src/chrome/common/ipc_channel_win.cc, line 341
12:58:41 INFO - [Parent 5116, Gecko_IOThread] WARNING: pipe error: 109: file z:/build/build/src/ipc/chromium/src/chrome/common/ipc_channel_win.cc, line 341
12:58:41 INFO - [Parent 5116, Gecko_IOThread] WARNING: pipe error: 109: file z:/build/build/src/ipc/chromium/src/chrome/common/ipc_channel_win.cc, line 341
12:58:42 INFO - 1553086722616 Marionette TRACE Received observer notification xpcom-will-shutdown
12:58:42 INFO - 1553086722617 Marionette INFO Stopped listening on port 2828
12:58:42 INFO - 1553086722617 Marionette DEBUG Remote service is inactive
12:58:42 INFO - [VR 10012, Chrome_ChildThread] WARNING: pipe error: 109: file z:/build/build/src/ipc/chromium/src/chrome/common/ipc_channel_win.cc, line 341
12:58:42 INFO - [GPU 1556, Chrome_ChildThread] WARNING: pipe error: 109: file z:/build/build/src/ipc/chromium/src/chrome/common/ipc_channel_win.cc, line 341
12:58:42 INFO - =================================================================
12:58:42 ERROR - ==1556==ERROR: AddressSanitizer: heap-use-after-free on address 0x12687ae00808 at pc 0x7ff9ed264e3c bp 0x001b757fe220 sp 0x001b757fe268
12:58:42 INFO - WRITE of size 8 at 0x12687ae00808 thread T2
12:58:42 INFO - ###!!! [Child][MessageChannel] Error: (msgtype=0x9B0002,name=PVRGPU::Msg_StopVRService) Closed channel: cannot send/recv
12:58:42 INFO - [GPU 1556, Chrome_ChildThread] WARNING: pipe error
12:58:42 INFO - ###!!! [Child][RunMessage] Error: Channel closing: too late to send/recv, messages will be lost
12:58:42 INFO - : 109: file z:/build/build/src/ipc/chromium/src/chrome/common/ipc_channel_win.cc, line 341
12:58:42 INFO - [GPU 1556, Chrome_ChildThread] WARNING: pipe error: 109: file z:/build/build/src/ipc/chromium/src/chrome/common/ipc_channel_win.cc, line 341
12:58:42 INFO - [Parent 5116, Gecko_IOThread] WARNING: pipe error: 109: file z:/build/build/src/ipc/chromium/src/chrome/common/ipc_channel_win.cc, line 341
12:58:42 INFO - [GPU 1556, Chrome_ChildThread] WARNING: pipe error: 109: file z:/build/build/src/ipc/chromium/src/chrome/common/ipc_channel_win.cc, line 341
12:58:43 INFO - #0 0x7ff9ed264e3b in mozilla::gfx::VRSystemManagerPuppet::GetHMDs(class nsTArray<class RefPtr<class mozilla::gfx::VRDisplayHost> > &) z:\build\build\src\gfx\vr\gfxVRPuppet.cpp:752
12:58:43 INFO - #1 0x7ff9ed278f15 in mozilla::gfx::VRSystemManager::NotifyVSync(void) z:\build\build\src\gfx\vr\gfxVR.cpp:41
12:58:43 INFO - #2 0x7ff9ed263187 in mozilla::gfx::VRSystemManagerPuppet::NotifyVSync(void) z:\build\build\src\gfx\vr\gfxVRPuppet.cpp:669
12:58:43 INFO - #3 0x7ff9ed271015 in mozilla::gfx::VRManager::NotifyVsync(class mozilla::TimeStamp const &) z:\build\build\src\gfx\vr\VRManager.cpp:208
12:58:43 INFO - #4 0x7ff9ed2630f8 in mozilla::gfx::VRSystemManagerPuppet::Run10msTasks(void) z:\build\build\src\gfx\vr\gfxVRPuppet.cpp:665
12:58:43 INFO - #5 0x7ff9ed272634 in mozilla::gfx::VRManager::Run10msTasks(void) z:\build\build\src\gfx\vr\VRManager.cpp:335
12:58:43 INFO - #6 0x7ff9ed2717d1 in mozilla::gfx::VRManager::RunTasks(void) z:\build\build\src\gfx\vr\VRManager.cpp:274
12:58:43 INFO - #7 0x7ff9e9d8fc24 in nsTimerImpl::Fire(int) z:\build\build\src\xpcom\threads\nsTimerImpl.cpp:559
12:58:43 INFO - #8 0x7ff9e9d8f1b5 in nsTimerEvent::Run(void) z:\build\build\src\xpcom\threads\TimerThread.cpp:260
12:58:43 INFO - #9 0x7ff9eadd9ee3 in ?DeferOrRunPendingTask@MessageLoop@@IEAA_N$$QEAUPendingTask@1@@Z z:\build\build\src\ipc\chromium\src\base\message_loop.cc:450
12:58:43 INFO - #10 0x7ff9eaddb8de in MessageLoop::DoWork(void) z:\build\build\src\ipc\chromium\src\base\message_loop.cc:523
12:58:43 INFO - #11 0x7ff9eadabeb1 in base::MessagePumpForUI::DoRunLoop(void) z:\build\build\src\ipc\chromium\src\base\message_pump_win.cc:203
12:58:43 INFO - #12 0x7ff9eadae4d9 in base::MessagePumpWin::Run(class base::MessagePump::Delegate *) z:\build\build\src\ipc\chromium\src\base\message_pump_win.h:79
12:58:43 INFO - #13 0x7ff9eadd8c5e in MessageLoop::RunHandler(void) z:\build\build\src\ipc\chromium\src\base\message_loop.cc:308
12:58:43 INFO - #14 0x7ff9eadeaae2 in base::Thread::ThreadMain(void) z:\build\build\src\ipc\chromium\src\base\thread.cc:192
12:58:43 INFO - #15 0x7ff9eadafcef in `anonymous namespace'::ThreadFunc z:\build\build\src\ipc\chromium\src\base\platform_thread_win.cc:19
12:58:43 INFO - #16 0x7ffa2e52e888 in __asan::AsanThread::ThreadStart(unsigned __int64,struct __sanitizer::atomic_uintptr_t *) Z:\task_1553018212\build\src\build\build-clang\build-clang\src\llvm\projects\compiler-rt\lib\asan\asan_thread.cc:264
12:58:43 INFO - #17 0x7ffa41d43033 (C:\Windows\System32\KERNEL32.DLL+0x180013033)
12:58:43 INFO - #18 0x7ffa3b61df21 in patched_BaseThreadInitThunk z:\build\build\src\mozglue\build\WindowsDllBlocklist.cpp:712
12:58:43 INFO - #19 0x7ffa41f91460 (C:\Windows\SYSTEM32\ntdll.dll+0x180071460)
12:58:43 INFO - 0x12687ae00808 is located 8 bytes inside of 73760-byte region [0x12687ae00800,0x12687ae12820)

Group: gfx-core-security
Status: NEW → RESOLVED
Closed: 6 years ago
Resolution: --- → DUPLICATE
Group: gfx-core-security
You need to log in before you can comment on or make changes to this bug.