Closed Bug 1556200 Opened 6 years ago Closed 6 years ago

Intermittent tier 2 ==8063==ERROR: AddressSanitizer: heap-use-after-free on address 0x61100003005f at pc 0x7f986dadd35d bp 0x7f9864d90dd0 sp 0x7f9864d90dc8

Categories

(Core :: Graphics: Canvas2D, defect, P5)

Product:
Core
Component:
Graphics: Canvas2D
Type:
defect

Tracking

()

Status:
RESOLVED DUPLICATE of bug 1492988

People

(Reporter: intermittent-bug-filer, Unassigned)

Details

(Keywords: intermittent-failure, regression)

Filed by: rmaries [at] mozilla.com
Parsed log: https://treeherder.mozilla.org/logviewer.html#?job_id=249575281&repo=mozilla-inbound
Full log: https://queue.taskcluster.net/v1/task/DAPxnv4rT3yC9OjccCzpcQ/runs/0/artifacts/public/logs/live_backing.log
Reftest URL: https://hg.mozilla.org/mozilla-central/raw-file/tip/layout/tools/reftest/reftest-analyzer.xhtml#logurl=https://queue.taskcluster.net/v1/task/DAPxnv4rT3yC9OjccCzpcQ/runs/0/artifacts/public/logs/live_backing.log&only_show_unexpected=1

[task 2019-06-01T22:43:02.710Z] 22:43:02 INFO - REFTEST TEST-START | file:///builds/worker/workspace/build/tests/reftest/tests/dom/canvas/test/reftest/visible-occluded.html == file:///builds/worker/workspace/build/tests/reftest/tests/dom/canvas/test/reftest/visible-occluded-ref.html
[task 2019-06-01T22:43:05.016Z] 22:43:05 INFO - ###!!! [Child][RunMessage] Error: Channel closing: too late to send/recv, messages will be lost
[task 2019-06-01T22:43:05.708Z] 22:43:05 INFO - =================================================================
[task 2019-06-01T22:43:05.711Z] 22:43:05 ERROR - ==8063==ERROR: AddressSanitizer: heap-use-after-free on address 0x61100003005f at pc 0x7f986dadd35d bp 0x7f9864d90dd0 sp 0x7f9864d90dc8
[task 2019-06-01T22:43:05.714Z] 22:43:05 INFO - READ of size 1 at 0x61100003005f thread T5 (WRWorker#0)
[task 2019-06-01T22:43:06.586Z] 22:43:06 INFO - #0 0x7f986dadd35c in nsThreadManager::ReleaseThread(void*) /builds/worker/workspace/build/src/xpcom/threads/nsThreadManager.cpp:91:15
[task 2019-06-01T22:43:06.587Z] 22:43:06 INFO - #1 0x7f988eb2182d in _PR_DestroyThreadPrivate /builds/worker/workspace/build/src/nsprpub/pr/src/threads/prtpd.c:237:25
[task 2019-06-01T22:43:06.588Z] 22:43:06 INFO - #2 0x7f988eb11a94 in _pt_thread_death_internal /builds/worker/workspace/build/src/nsprpub/pr/src/pthreads/ptthread.c:855:9
[task 2019-06-01T22:43:06.590Z] 22:43:06 INFO - #3 0x7f988eb11d16 in pt_thread_death /builds/worker/workspace/build/src/nsprpub/pr/src/pthreads/ptthread.c:828:5
[task 2019-06-01T22:43:06.594Z] 22:43:06 INFO - #4 0x7f988e764438 in __nptl_deallocate_tsd.part.4 (/lib/x86_64-linux-gnu/libpthread.so.0+0x6438)
[task 2019-06-01T22:43:06.595Z] 22:43:06 INFO - #5 0x7f988e76586f in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x786f)
[task 2019-06-01T22:43:06.644Z] 22:43:06 INFO - #6 0x7f988d7ee41c in clone /build/glibc-LK5gWL/glibc-2.23/misc/../sysdeps/unix/sysv/linux/x86_64/clone.S:109
[task 2019-06-01T22:43:06.644Z] 22:43:06 INFO - 0x61100003005f is located 159 bytes inside of 200-byte region [0x61100002ffc0,0x611000030088)
[task 2019-06-01T22:43:06.644Z] 22:43:06 INFO - freed by thread T0 (GPU Process) here:
[task 2019-06-01T22:43:06.649Z] 22:43:06 INFO - #0 0x56409a868182 in free /builds/worker/workspace/moz-toolchain/src/llvm/projects/compiler-rt/lib/asan/asan_malloc_linux.cc:124:3
[task 2019-06-01T22:43:06.649Z] 22:43:06 INFO - #1 0x7f986dad384d in nsThread::Release() /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:187:1
[task 2019-06-01T22:43:06.650Z] 22:43:06 INFO - #2 0x7f986dadf61c in Release /builds/worker/workspace/build/src/obj-firefox/dist/include/mozilla/RefPtr.h:46:40
[task 2019-06-01T22:43:06.653Z] 22:43:06 INFO - #3 0x7f986dadf61c in Release /builds/worker/workspace/build/src/obj-firefox/dist/include/mozilla/RefPtr.h:363
[task 2019-06-01T22:43:06.653Z] 22:43:06 INFO - #4 0x7f986dadf61c in ~RefPtr /builds/worker/workspace/build/src/obj-firefox/dist/include/mozilla/RefPtr.h:77
[task 2019-06-01T22:43:06.654Z] 22:43:06 INFO - #5 0x7f986dadf61c in Destruct /builds/worker/workspace/build/src/obj-firefox/dist/include/nsTArray.h:525
[task 2019-06-01T22:43:06.655Z] 22:43:06 INFO - #6 0x7f986dadf61c in DestructRange /builds/worker/workspace/build/src/obj-firefox/dist/include/nsTArray.h:2183
[task 2019-06-01T22:43:06.655Z] 22:43:06 INFO - #7 0x7f986dadf61c in ClearAndRetainStorage /builds/worker/workspace/build/src/obj-firefox/dist/include/nsTArray.h:1300
[task 2019-06-01T22:43:06.656Z] 22:43:06 INFO - #8 0x7f986dadf61c in ~nsTArray_Impl /builds/worker/workspace/build/src/obj-firefox/dist/include/nsTArray.h:881
[task 2019-06-01T22:43:06.657Z] 22:43:06 INFO - #9 0x7f986dadf61c in nsThreadManager::Shutdown() /builds/worker/workspace/build/src/xpcom/threads/nsThreadManager.cpp:318
[task 2019-06-01T22:43:06.673Z] 22:43:06 INFO - #10 0x7f986db31471 in mozilla::ShutdownXPCOM(nsIServiceManager*) /builds/worker/workspace/build/src/xpcom/build/XPCOMInit.cpp:649:28
[task 2019-06-01T22:43:06.674Z] 22:43:06 INFO - #11 0x7f9879c27c55 in XRE_InitChildProcess(int, char**, XREChildData const*) /builds/worker/workspace/build/src/toolkit/xre/nsEmbedFunctions.cpp:753:16
[task 2019-06-01T22:43:06.675Z] 22:43:06 INFO - #12 0x56409a89b3a7 in content_process_main /builds/worker/workspace/build/src/browser/app/../../ipc/contentproc/plugin-container.cpp:56:28
[task 2019-06-01T22:43:06.676Z] 22:43:06 INFO - #13 0x56409a89b3a7 in main /builds/worker/workspace/build/src/browser/app/nsBrowserApp.cpp:263
[task 2019-06-01T22:43:06.677Z] 22:43:06 INFO - #14 0x7f988d70782f in __libc_start_main /build/glibc-LK5gWL/glibc-2.23/csu/../csu/libc-start.c:291
[task 2019-06-01T22:43:06.678Z] 22:43:06 INFO - previously allocated by thread T5 (WRWorker#0) here:
[task 2019-06-01T22:43:06.679Z] 22:43:06 INFO - #0 0x56409a868503 in __interceptor_malloc /builds/worker/workspace/moz-toolchain/src/llvm/projects/compiler-rt/lib/asan/asan_malloc_linux.cc:146:3
[task 2019-06-01T22:43:06.680Z] 22:43:06 INFO - #1 0x56409a89cf9d in moz_xmalloc /builds/worker/workspace/build/src/memory/mozalloc/mozalloc.cpp:52:15
[task 2019-06-01T22:43:06.681Z] 22:43:06 INFO - #2 0x7f986dad88d7 in operator new /builds/worker/workspace/build/src/obj-firefox/dist/include/mozilla/mozalloc.h:144:10
[task 2019-06-01T22:43:06.682Z] 22:43:06 INFO - #3 0x7f986dad88d7 in nsThreadManager::GetCurrentThread() /builds/worker/workspace/build/src/xpcom/threads/nsThreadManager.cpp:376
[task 2019-06-01T22:43:06.707Z] 22:43:06 INFO - #4 0x7f9879361345 in profiler_register_thread(char const*, void*) /builds/worker/workspace/build/src/tools/profiler/core/platform.cpp:3666:9
[task 2019-06-01T22:43:06.749Z] 22:43:06 INFO - #5 0x7f987038be5f in gecko_profiler_register_thread /builds/worker/workspace/build/src/gfx/layers/wr/WebRenderBridgeParent.cpp:142:3
[task 2019-06-01T22:43:06.778Z] 22:43:06 INFO - #6 0x7f987bf49512 in webrender_bindings::bindings::wr_thread_pool_new::$u7b$$u7b$closure$u7d$$u7d$::h1f15a480874c4b38 /builds/worker/workspace/build/src/gfx/webrender_bindings/src/bindings.rs:1048:12
[task 2019-06-01T22:43:06.780Z] 22:43:06 INFO - Thread T5 (WRWorker#0) created by T0 (GPU Process) here:
[task 2019-06-01T22:43:06.797Z] 22:43:06 INFO - #0 0x56409a850add in pthread_create /builds/worker/workspace/moz-toolchain/src/llvm/projects/compiler-rt/lib/asan/asan_interceptors.cc:210:3
[task 2019-06-01T22:43:06.800Z] 22:43:06 INFO - #1 0x7f987c59cc65 in std::sys::unix::thread::Thread::new::hba7601f1ccb9f089 /rustc/3c235d5600393dfe6c36eeed34042efad8d4f26e/src/libstd/sys/unix/thread.rs:68:18
[task 2019-06-01T22:43:06.802Z] 22:43:06 INFO - SUMMARY: AddressSanitizer: heap-use-after-free /builds/worker/workspace/build/src/xpcom/threads/nsThreadManager.cpp:91:15 in nsThreadManager::ReleaseThread(void*)
[task 2019-06-01T22:43:06.804Z] 22:43:06 INFO - Shadow bytes around the buggy address:
[task 2019-06-01T22:43:06.805Z] 22:43:06 INFO - 0x0c227fffdfb0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
[task 2019-06-01T22:43:06.806Z] 22:43:06 INFO - 0x0c227fffdfc0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
[task 2019-06-01T22:43:06.807Z] 22:43:06 INFO - 0x0c227fffdfd0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
[task 2019-06-01T22:43:06.808Z] 22:43:06 INFO - 0x0c227fffdfe0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
[task 2019-06-01T22:43:06.809Z] 22:43:06 INFO - 0x0c227fffdff0: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd
[task 2019-06-01T22:43:06.809Z] 22:43:06 INFO - =>0x0c227fffe000: fd fd fd fd fd fd fd fd fd fd fd[fd]fd fd fd fd
[task 2019-06-01T22:43:06.810Z] 22:43:06 INFO - 0x0c227fffe010: fd fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
[task 2019-06-01T22:43:06.812Z] 22:43:06 INFO - 0x0c227fffe020: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[task 2019-06-01T22:43:06.813Z] 22:43:06 INFO - 0x0c227fffe030: 00 00 00 00 00 00 00 00 00 00 00 fa fa fa fa fa
[task 2019-06-01T22:43:06.814Z] 22:43:06 INFO - 0x0c227fffe040: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
[task 2019-06-01T22:43:06.815Z] 22:43:06 INFO - 0x0c227fffe050: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
[task 2019-06-01T22:43:06.816Z] 22:43:06 INFO - Shadow byte legend (one shadow byte represents 8 application bytes):
[task 2019-06-01T22:43:06.816Z] 22:43:06 INFO - Addressable: 00
[task 2019-06-01T22:43:06.818Z] 22:43:06 INFO - Partially addressable: 01 02 03 04 05 06 07
[task 2019-06-01T22:43:06.819Z] 22:43:06 INFO - Heap left redzone: fa
[task 2019-06-01T22:43:06.819Z] 22:43:06 INFO - Freed heap region: fd
[task 2019-06-01T22:43:06.819Z] 22:43:06 INFO - Stack left redzone: f1
[task 2019-06-01T22:43:06.821Z] 22:43:06 INFO - Stack mid redzone: f2
[task 2019-06-01T22:43:06.822Z] 22:43:06 INFO - Stack right redzone: f3
[task 2019-06-01T22:43:06.822Z] 22:43:06 INFO - Stack after return: f5
[task 2019-06-01T22:43:06.825Z] 22:43:06 INFO - Stack use after scope: f8
[task 2019-06-01T22:43:06.825Z] 22:43:06 INFO - Global redzone: f9
[task 2019-06-01T22:43:06.826Z] 22:43:06 INFO - Global init order: f6
[task 2019-06-01T22:43:06.827Z] 22:43:06 INFO - Poisoned by user: f7
[task 2019-06-01T22:43:06.828Z] 22:43:06 INFO - Container overflow: fc
[task 2019-06-01T22:43:06.829Z] 22:43:06 INFO - Array cookie: ac
[task 2019-06-01T22:43:06.830Z] 22:43:06 INFO - Intra object redzone: bb
[task 2019-06-01T22:43:06.832Z] 22:43:06 INFO - ASan internal: fe
[task 2019-06-01T22:43:06.833Z] 22:43:06 INFO - Left alloca redzone: ca
[task 2019-06-01T22:43:06.834Z] 22:43:06 INFO - Right alloca redzone: cb
[task 2019-06-01T22:43:06.836Z] 22:43:06 INFO - Shadow gap: cc
[task 2019-06-01T22:43:06.837Z] 22:43:06 INFO - ==8063==ABORTING
[task 2019-06-01T22:43:07.019Z] 22:43:07 INFO - REFTEST INFO | Process mode: e10s
[task 2019-06-01T22:43:07.019Z] 22:43:07 WARNING - leakcheck | refcount logging is off, so leaks can't be detected!
[task 2019-06-01T22:43:07.020Z] 22:43:07 INFO - REFTEST INFO | Running tests in file:///builds/worker/workspace/build/tests/reftest/tests/layout/reftests/css-disabled/button/reftest.list
[task 2019-06-01T22:43:07.040Z] 22:43:07 INFO - REFTEST INFO | INFO | runtests.py | ASan using symbolizer at /builds/worker/workspace/build/application/firefox/llvm-symbolizer
[task 2019-06-01T22:43:07.049Z] 22:43:07 INFO - REFTEST INFO | INFO | runtests.py | ASan running in default memory configuration
[task 2019-06-01T22:43:07.049Z] 22:43:07 INFO - REFTEST INFO | Running with e10s: True
[task 2019-06-01T22:43:07.050Z] 22:43:07 INFO - REFTEST INFO | Application command: /builds/worker/workspace/build/application/firefox/firefox -marionette -profile /tmp/tmpGqRy2N.mozrunner
[task 2019-06-01T22:43:08.665Z] 22:43:08 INFO - 1559428988661 addons.webextension.screenshots@mozilla.org WARN Loading extension 'screenshots@mozilla.org': Reading manifest: Invalid extension permission: mozillaAddons
[task 2019-06-01T22:43:08.666Z] 22:43:08 INFO - 1559428988662 addons.webextension.screenshots@mozilla.org WARN Loading extension 'screenshots@mozilla.org': Reading manifest: Invalid extension permission: telemetry
[task 2019-06-01T22:43:08.667Z] 22:43:08 INFO - 1559428988663 addons.webextension.screenshots@mozilla.org WARN Loading extension 'screenshots@mozilla.org': Reading manifest: Invalid extension permission: resource://pdf.js/
[task 2019-06-01T22:43:08.670Z] 22:43:08 INFO - 1559428988664 addons.webextension.screenshots@mozilla.org WARN Loading extension 'screenshots@mozilla.org': Reading manifest: Invalid extension permission: about:reader*
[task 2019-06-01T22:43:09.151Z] 22:43:09 INFO - 1559428989146 Marionette TRACE Received observer notification profile-after-change
[task 2019-06-01T22:43:09.430Z] 22:43:09 INFO - 1559428989418 Marionette TRACE Received observer notification command-line-startup
[task 2019-06-01T22:43:09.430Z] 22:43:09 INFO - 1559428989419 Marionette TRACE Received observer notification nsPref:changed
[task 2019-06-01T22:43:09.431Z] 22:43:09 INFO - 1559428989420 Marionette DEBUG Init aborted (running=false, enabled=true, finalUIStartup=false)
[task 2019-06-01T22:43:09.945Z] 22:43:09 INFO - 1559428989940 Marionette TRACE Received observer notification toplevel-window-ready
[task 2019-06-01T22:43:22.510Z] 22:43:22 INFO - 1559429002502 Marionette TRACE Received observer notification marionette-startup-requested
[task 2019-06-01T22:43:22.510Z] 22:43:22 INFO - 1559429002503 Marionette TRACE Waiting until startup recorder finished recording startup scripts...
[task 2019-06-01T22:43:22.680Z] 22:43:22 INFO - 1559429002673 Marionette TRACE All scripts recorded.
[task 2019-06-01T22:43:22.891Z] 22:43:22 INFO - 1559429002885 Marionette INFO Listening on port 2828
[task 2019-06-01T22:43:22.893Z] 22:43:22 INFO - 1559429002886 Marionette DEBUG Remote service is active
[task 2019-06-01T22:43:22.958Z] 22:43:22 INFO - 1559429002948 Marionette DEBUG Accepted connection 0 from 127.0.0.1:56338
[task 2019-06-01T22:43:22.975Z] 22:43:22 INFO - 1559429002965 Marionette DEBUG Closed connection 0
[task 2019-06-01T22:43:22.975Z] 22:43:22 INFO - 1559429002968 Marionette DEBUG Accepted connection 1 from 127.0.0.1:56340
[task 2019-06-01T22:43:22.991Z] 22:43:22 INFO - 1559429002987 Marionette DEBUG 1 -> [0,1,"WebDriver:NewSession",{"strictFileInteractability":true}]
[task 2019-06-01T22:43:23.189Z] 22:43:23 INFO - 1559429003178 Marionette TRACE [4294967297] Frame script loaded
[task 2019-06-01T22:43:23.190Z] 22:43:23 INFO - 1559429003183 Marionette TRACE [4294967297] Frame script registered
[task 2019-06-01T22:43:23.219Z] 22:43:23 INFO - 1559429003211 Marionette TRACE [4294967300] Frame script loaded
[task 2019-06-01T22:43:23.240Z] 22:43:23 INFO - 1559429003237 Marionette DEBUG 1 <- [1,1,null,{"sessionId":"624583fb-46f9-4183-9e46-16e898668093","capabilities":{"browserName":"firefox","browserVersion":"69.0a ... p/tmpGqRy2N.mozrunner","moz:shutdownTimeout":180000,"moz:useNonSpecCompliantPointerOrigin":false,"moz:webdriverClick":true}}]
[task 2019-06-01T22:43:23.261Z] 22:43:23 INFO - 1559429003253 Marionette TRACE [4294967300] Frame script registered
[task 2019-06-01T22:43:23.297Z] 22:43:23 INFO - 1559429003283 Marionette DEBUG 1 -> [0,2,"Addon:Install",{"path":"/builds/worker/workspace/build/tests/reftest/reftest","temporary":true}]
[task 2019-06-01T22:43:23.759Z] 22:43:23 INFO - 1559429003751 Marionette DEBUG 1 <- [1,2,null,{"value":"reftest@mozilla.org"}]
[task 2019-06-01T22:43:24.127Z] 22:43:24 INFO - 1559429004124 Marionette DEBUG 1 -> [0,3,"WebDriver:DeleteSession",{}]
[task 2019-06-01T22:43:24.147Z] 22:43:24 INFO - 1559429004138 Marionette DEBUG 1 <- [1,3,null,{"value":null}]
[task 2019-06-01T22:43:24.250Z] 22:43:24 INFO - 1559429004242 Marionette DEBUG Closed connection 1

Group: core-security
Status: NEW → RESOLVED
Closed: 6 years ago
Resolution: --- → DUPLICATE
Group: core-security
You need to log in before you can comment on or make changes to this bug.