Closed Bug 1558723 Opened 5 years ago Closed 5 years ago

AddressSanitizer: heap-use-after-free /builds/worker/workspace/build/src/obj-firefox/dist/include/mozilla/LinkedList.h:288:12 in isInList

Categories

(Core :: Graphics: ImageLib, defect)

Product:
Core
Component:
Graphics: ImageLib
Type:
defect
Priority:
Not set
Severity:
normal

Tracking

()

Status:
RESOLVED DUPLICATE of bug 1557208

People

(Reporter: nataliaCs, Unassigned)

Details

Push with failure: https://treeherder.mozilla.org/#/jobs?repo=autoland&revision=13c976344b699aab96156c7dedd8c41413c8ad69&selectedJob=251293718&searchStr=linux%2Cx64%2Cquantumrender%2Casan%2Copt%2Creftests%2Ctest-linux64-asan-qr%2Fopt-reftest-e10s-5%2Cr%28r5%29&group_state=expanded

Failure log: https://treeherder.mozilla.org/logviewer.html#/jobs?job_id=251293718&repo=autoland&lineNumber=8136

[task 2019-06-12T01:35:14.323Z] 01:35:14 INFO - =================================================================
[task 2019-06-12T01:35:14.325Z] 01:35:14 ERROR - ==8786==ERROR: AddressSanitizer: heap-use-after-free on address 0x61100002ffd8 at pc 0x7f752ccef0d8 bp 0x7f7524711d00 sp 0x7f7524711cf8
[task 2019-06-12T01:35:14.327Z] 01:35:14 INFO - READ of size 8 at 0x61100002ffd8 thread T5 (WRWorker#0)
[task 2019-06-12T01:35:15.174Z] 01:35:15 INFO - #0 0x7f752ccef0d7 in isInList /builds/worker/workspace/build/src/obj-firefox/dist/include/mozilla/LinkedList.h:288:12
[task 2019-06-12T01:35:15.175Z] 01:35:15 INFO - #1 0x7f752ccef0d7 in nsThread::MaybeRemoveFromThreadList() /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:405
[task 2019-06-12T01:35:15.179Z] 01:35:15 INFO - #2 0x7f752ccf11a9 in nsThread::~nsThread() /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:643:3
[task 2019-06-12T01:35:15.179Z] 01:35:15 INFO - #3 0x7f752ccf177d in nsThread::~nsThread() /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:639:23
[task 2019-06-12T01:35:15.180Z] 01:35:15 INFO - #4 0x7f752ccee0cd in nsThread::Release() /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:191:1
[task 2019-06-12T01:35:15.182Z] 01:35:15 INFO - #5 0x7f754e52882d in _PR_DestroyThreadPrivate /builds/worker/workspace/build/src/nsprpub/pr/src/threads/prtpd.c:237:25
[task 2019-06-12T01:35:15.182Z] 01:35:15 INFO - #6 0x7f754e518a94 in _pt_thread_death_internal /builds/worker/workspace/build/src/nsprpub/pr/src/pthreads/ptthread.c:855:9
[task 2019-06-12T01:35:15.183Z] 01:35:15 INFO - #7 0x7f754e518d16 in pt_thread_death /builds/worker/workspace/build/src/nsprpub/pr/src/pthreads/ptthread.c:828:5
[task 2019-06-12T01:35:15.183Z] 01:35:15 INFO - #8 0x7f754e16c438 in __nptl_deallocate_tsd.part.4 (/lib/x86_64-linux-gnu/libpthread.so.0+0x6438)
[task 2019-06-12T01:35:15.184Z] 01:35:15 INFO - #9 0x7f754e16d86f in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x786f)
[task 2019-06-12T01:35:15.241Z] 01:35:15 INFO - #10 0x7f754d1f641c in clone /build/glibc-LK5gWL/glibc-2.23/misc/../sysdeps/unix/sysv/linux/x86_64/clone.S:109
[task 2019-06-12T01:35:15.242Z] 01:35:15 INFO - 0x61100002ffd8 is located 24 bytes inside of 216-byte region [0x61100002ffc0,0x611000030098)
[task 2019-06-12T01:35:15.243Z] 01:35:15 INFO - freed by thread T0 (GPU Process) here:
[task 2019-06-12T01:35:15.248Z] 01:35:15 INFO - #0 0x56336f4533f2 in free /builds/worker/workspace/moz-toolchain/src/llvm/projects/compiler-rt/lib/asan/asan_malloc_linux.cc:124:3
[task 2019-06-12T01:35:15.248Z] 01:35:15 INFO - #1 0x7f752ccee0cd in nsThread::Release() /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:191:1
[task 2019-06-12T01:35:15.249Z] 01:35:15 INFO - #2 0x7f752ccfa57c in Release /builds/worker/workspace/build/src/obj-firefox/dist/include/mozilla/RefPtr.h:46:40
[task 2019-06-12T01:35:15.249Z] 01:35:15 INFO - #3 0x7f752ccfa57c in Release /builds/worker/workspace/build/src/obj-firefox/dist/include/mozilla/RefPtr.h:363
[task 2019-06-12T01:35:15.251Z] 01:35:15 INFO - #4 0x7f752ccfa57c in ~RefPtr /builds/worker/workspace/build/src/obj-firefox/dist/include/mozilla/RefPtr.h:77
[task 2019-06-12T01:35:15.252Z] 01:35:15 INFO - #5 0x7f752ccfa57c in Destruct /builds/worker/workspace/build/src/obj-firefox/dist/include/nsTArray.h:525
[task 2019-06-12T01:35:15.253Z] 01:35:15 INFO - #6 0x7f752ccfa57c in DestructRange /builds/worker/workspace/build/src/obj-firefox/dist/include/nsTArray.h:2183
[task 2019-06-12T01:35:15.254Z] 01:35:15 INFO - #7 0x7f752ccfa57c in ClearAndRetainStorage /builds/worker/workspace/build/src/obj-firefox/dist/include/nsTArray.h:1300
[task 2019-06-12T01:35:15.255Z] 01:35:15 INFO - #8 0x7f752ccfa57c in ~nsTArray_Impl /builds/worker/workspace/build/src/obj-firefox/dist/include/nsTArray.h:881
[task 2019-06-12T01:35:15.257Z] 01:35:15 INFO - #9 0x7f752ccfa57c in nsThreadManager::Shutdown() /builds/worker/workspace/build/src/xpcom/threads/nsThreadManager.cpp:318
[task 2019-06-12T01:35:15.257Z] 01:35:15 INFO - #10 0x7f752cd4c1bc in mozilla::ShutdownXPCOM(nsIServiceManager*) /builds/worker/workspace/build/src/xpcom/build/XPCOMInit.cpp:647:28
[task 2019-06-12T01:35:15.259Z] 01:35:15 INFO - #11 0x7f7538e4385a in XRE_InitChildProcess(int, char**, XREChildData const*) /builds/worker/workspace/build/src/toolkit/xre/nsEmbedFunctions.cpp:758:16
[task 2019-06-12T01:35:15.261Z] 01:35:15 INFO - #12 0x56336f4867b2 in content_process_main /builds/worker/workspace/build/src/browser/app/../../ipc/contentproc/plugin-container.cpp:56:28
[task 2019-06-12T01:35:15.261Z] 01:35:15 INFO - #13 0x56336f4867b2 in main /builds/worker/workspace/build/src/browser/app/nsBrowserApp.cpp:267
[task 2019-06-12T01:35:15.263Z] 01:35:15 INFO - #14 0x7f754d10f82f in __libc_start_main /build/glibc-LK5gWL/glibc-2.23/csu/../csu/libc-start.c:291
[task 2019-06-12T01:35:15.265Z] 01:35:15 INFO - previously allocated by thread T5 (WRWorker#0) here:
[task 2019-06-12T01:35:15.265Z] 01:35:15 INFO - #0 0x56336f453773 in __interceptor_malloc /builds/worker/workspace/moz-toolchain/src/llvm/projects/compiler-rt/lib/asan/asan_malloc_linux.cc:146:3
[task 2019-06-12T01:35:15.268Z] 01:35:15 INFO - #1 0x56336f48842d in moz_xmalloc /builds/worker/workspace/build/src/memory/mozalloc/mozalloc.cpp:52:15
[task 2019-06-12T01:35:15.269Z] 01:35:15 INFO - #2 0x7f752ccf3227 in operator new /builds/worker/workspace/build/src/obj-firefox/dist/include/mozilla/mozalloc.h:144:10
[task 2019-06-12T01:35:15.271Z] 01:35:15 INFO - #3 0x7f752ccf3227 in nsThreadManager::GetCurrentThread() /builds/worker/workspace/build/src/xpcom/threads/nsThreadManager.cpp:376
[task 2019-06-12T01:35:15.305Z] 01:35:15 INFO - #4 0x7f753857df05 in profiler_register_thread(char const*, void*) /builds/worker/workspace/build/src/tools/profiler/core/platform.cpp:3743:9
[task 2019-06-12T01:35:15.341Z] 01:35:15 INFO - #5 0x7f752f64a01f in gecko_profiler_register_thread /builds/worker/workspace/build/src/gfx/layers/wr/WebRenderBridgeParent.cpp:142:3
[task 2019-06-12T01:35:15.369Z] 01:35:15 INFO - #6 0x7f753b15a842 in webrender_bindings::bindings::wr_thread_pool_new::$u7b$$u7b$closure$u7d$$u7d$::h9e0a5abfefaf5976 /builds/worker/workspace/build/src/gfx/webrender_bindings/src/bindings.rs:1048:12
[task 2019-06-12T01:35:15.371Z] 01:35:15 INFO - Thread T5 (WRWorker#0) created by T0 (GPU Process) here:
[task 2019-06-12T01:35:15.388Z] 01:35:15 INFO - #0 0x56336f43bd4d in pthread_create /builds/worker/workspace/moz-toolchain/src/llvm/projects/compiler-rt/lib/asan/asan_interceptors.cc:210:3
[task 2019-06-12T01:35:15.389Z] 01:35:15 INFO - #1 0x7f753b7aa0d5 in std::sys::unix::thread::Thread::new::hba7601f1ccb9f089 /rustc/3c235d5600393dfe6c36eeed34042efad8d4f26e/src/libstd/sys/unix/thread.rs:68:18
[task 2019-06-12T01:35:15.393Z] 01:35:15 INFO - SUMMARY: AddressSanitizer: heap-use-after-free /builds/worker/workspace/build/src/obj-firefox/dist/include/mozilla/LinkedList.h:288:12 in isInList
[task 2019-06-12T01:35:15.395Z] 01:35:15 INFO - Shadow bytes around the buggy address:
[task 2019-06-12T01:35:15.396Z] 01:35:15 INFO - 0x0c227fffdfa0: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd
[task 2019-06-12T01:35:15.398Z] 01:35:15 INFO - 0x0c227fffdfb0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
[task 2019-06-12T01:35:15.400Z] 01:35:15 INFO - 0x0c227fffdfc0: fd fd fd fd fa fa fa fa fa fa fa fa fa fa fa fa
[task 2019-06-12T01:35:15.404Z] 01:35:15 INFO - 0x0c227fffdfd0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
[task 2019-06-12T01:35:15.409Z] 01:35:15 INFO - 0x0c227fffdfe0: fd fd fd fd fd fd fd fd fd fd fd fd fa fa fa fa
[task 2019-06-12T01:35:15.410Z] 01:35:15 INFO - =>0x0c227fffdff0: fa fa fa fa fa fa fa fa fd fd fd[fd]fd fd fd fd
[task 2019-06-12T01:35:15.412Z] 01:35:15 INFO - 0x0c227fffe000: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
[task 2019-06-12T01:35:15.413Z] 01:35:15 INFO - 0x0c227fffe010: fd fd fd fa fa fa fa fa fa fa fa fa fa fa fa fa
[task 2019-06-12T01:35:15.414Z] 01:35:15 INFO - 0x0c227fffe020: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[task 2019-06-12T01:35:15.416Z] 01:35:15 INFO - 0x0c227fffe030: 00 00 00 00 00 00 00 00 00 00 00 fa fa fa fa fa
[task 2019-06-12T01:35:15.416Z] 01:35:15 INFO - 0x0c227fffe040: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
[task 2019-06-12T01:35:15.419Z] 01:35:15 INFO - Shadow byte legend (one shadow byte represents 8 application bytes):
[task 2019-06-12T01:35:15.420Z] 01:35:15 INFO - Addressable: 00
[task 2019-06-12T01:35:15.425Z] 01:35:15 INFO - Partially addressable: 01 02 03 04 05 06 07
[task 2019-06-12T01:35:15.427Z] 01:35:15 INFO - Heap left redzone: fa
[task 2019-06-12T01:35:15.428Z] 01:35:15 INFO - Freed heap region: fd
[task 2019-06-12T01:35:15.430Z] 01:35:15 INFO - Stack left redzone: f1
[task 2019-06-12T01:35:15.430Z] 01:35:15 INFO - Stack mid redzone: f2
[task 2019-06-12T01:35:15.430Z] 01:35:15 INFO - Stack right redzone: f3
[task 2019-06-12T01:35:15.431Z] 01:35:15 INFO - Stack after return: f5
[task 2019-06-12T01:35:15.431Z] 01:35:15 INFO - Stack use after scope: f8
[task 2019-06-12T01:35:15.433Z] 01:35:15 INFO - Global redzone: f9
[task 2019-06-12T01:35:15.435Z] 01:35:15 INFO - Global init order: f6
[task 2019-06-12T01:35:15.436Z] 01:35:15 INFO - Poisoned by user: f7
[task 2019-06-12T01:35:15.441Z] 01:35:15 INFO - Container overflow: fc
[task 2019-06-12T01:35:15.446Z] 01:35:15 INFO - Array cookie: ac
[task 2019-06-12T01:35:15.447Z] 01:35:15 INFO - Intra object redzone: bb
[task 2019-06-12T01:35:15.449Z] 01:35:15 INFO - ASan internal: fe
[task 2019-06-12T01:35:15.450Z] 01:35:15 INFO - Left alloca redzone: ca
[task 2019-06-12T01:35:15.462Z] 01:35:15 INFO - Right alloca redzone: cb
[task 2019-06-12T01:35:15.462Z] 01:35:15 INFO - Shadow gap: cc
[task 2019-06-12T01:35:15.462Z] 01:35:15 INFO - ==8786==ABORTING
[task 2019-06-12T01:35:15.462Z] 01:35:15 INFO - [warn] evsig_handler: received signal 17, but have no base configured

Group: core-security → gfx-core-security
Status: NEW → RESOLVED
Closed: 5 years ago
Resolution: --- → DUPLICATE
Group: gfx-core-security
You need to log in before you can comment on or make changes to this bug.