1559307 - SUMMARY: AddressSanitizer: heap-use-after-free /builds/worker/workspace/build/src/xpcom/threads/nsThreadManager.cpp:91:15 in nsThreadManager::ReleaseThread(void*)

Status: RESOLVED DUPLICATE of bug 1557208

(Core :: Graphics: WebRender, defect, P3)

Description

[Natalia Csoregi [:nataliaCs]]

Push: https://treeherder.mozilla.org/#/jobs?repo=autoland&revision=a2930bb79701c54c30bc67ff27d35ee928ee4335&selectedJob=251810363&searchStr=linux%2Cx64%2Cquantumrender%2Casan%2Copt%2Creftests%2Ctest-linux64-asan-qr%2Fopt-reftest-e10s-7%2Cr%28r7%29&group_state=expanded

Failure log: [task 2019-06-14T01:36:07.789Z] 01:36:07 ERROR - ==4273==ERROR: AddressSanitizer: heap-use-after-free on address 0x61100003a05f at pc 0x7ff04e3bf98d bp 0x7ff045c24d90 sp 0x7ff045c24d88
[task 2019-06-14T01:36:07.790Z] 01:36:07 INFO - READ of size 1 at 0x61100003a05f thread T6 (WRWorker#1)
[task 2019-06-14T01:36:08.758Z] 01:36:08 INFO - #0 0x7ff04e3bf98c in nsThreadManager::ReleaseThread(void*) /builds/worker/workspace/build/src/xpcom/threads/nsThreadManager.cpp:91:15
[task 2019-06-14T01:36:08.758Z] 01:36:08 INFO - #1 0x7ff06fbf982d in _PR_DestroyThreadPrivate /builds/worker/workspace/build/src/nsprpub/pr/src/threads/prtpd.c:237:25
[task 2019-06-14T01:36:08.759Z] 01:36:08 INFO - #2 0x7ff06fbe9a94 in _pt_thread_death_internal /builds/worker/workspace/build/src/nsprpub/pr/src/pthreads/ptthread.c:855:9
[task 2019-06-14T01:36:08.760Z] 01:36:08 INFO - #3 0x7ff06fbe9d16 in pt_thread_death /builds/worker/workspace/build/src/nsprpub/pr/src/pthreads/ptthread.c:828:5
[task 2019-06-14T01:36:08.762Z] 01:36:08 INFO - #4 0x7ff06f83d438 in __nptl_deallocate_tsd.part.4 (/lib/x86_64-linux-gnu/libpthread.so.0+0x6438)
[task 2019-06-14T01:36:08.762Z] 01:36:08 INFO - #5 0x7ff06f83e86f in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x786f)
[task 2019-06-14T01:36:08.819Z] 01:36:08 INFO - #6 0x7ff06e8c741c in clone /build/glibc-LK5gWL/glibc-2.23/misc/../sysdeps/unix/sysv/linux/x86_64/clone.S:109
[task 2019-06-14T01:36:08.820Z] 01:36:08 INFO - 0x61100003a05f is located 159 bytes inside of 216-byte region [0x611000039fc0,0x61100003a098)
[task 2019-06-14T01:36:08.820Z] 01:36:08 INFO - freed by thread T0 (GPU Process) here:
[task 2019-06-14T01:36:08.821Z] 01:36:08 INFO - #0 0x55c91e5f83f2 in free /builds/worker/workspace/moz-toolchain/src/llvm/projects/compiler-rt/lib/asan/asan_malloc_linux.cc:124:3
[task 2019-06-14T01:36:08.825Z] 01:36:08 INFO - #1 0x7ff04e3b579d in nsThread::Release() /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:191:1
[task 2019-06-14T01:36:08.826Z] 01:36:08 INFO - #2 0x7ff04e3c1c4c in Release /builds/worker/workspace/build/src/obj-firefox/dist/include/mozilla/RefPtr.h:46:40
[task 2019-06-14T01:36:08.827Z] 01:36:08 INFO - #3 0x7ff04e3c1c4c in Release /builds/worker/workspace/build/src/obj-firefox/dist/include/mozilla/RefPtr.h:363
[task 2019-06-14T01:36:08.828Z] 01:36:08 INFO - #4 0x7ff04e3c1c4c in ~RefPtr /builds/worker/workspace/build/src/obj-firefox/dist/include/mozilla/RefPtr.h:77
[task 2019-06-14T01:36:08.829Z] 01:36:08 INFO - #5 0x7ff04e3c1c4c in Destruct /builds/worker/workspace/build/src/obj-firefox/dist/include/nsTArray.h:525
[task 2019-06-14T01:36:08.831Z] 01:36:08 INFO - #6 0x7ff04e3c1c4c in DestructRange /builds/worker/workspace/build/src/obj-firefox/dist/include/nsTArray.h:2183
[task 2019-06-14T01:36:08.831Z] 01:36:08 INFO - #7 0x7ff04e3c1c4c in ClearAndRetainStorage /builds/worker/workspace/build/src/obj-firefox/dist/include/nsTArray.h:1300
[task 2019-06-14T01:36:08.832Z] 01:36:08 INFO - #8 0x7ff04e3c1c4c in ~nsTArray_Impl /builds/worker/workspace/build/src/obj-firefox/dist/include/nsTArray.h:881
[task 2019-06-14T01:36:08.834Z] 01:36:08 INFO - #9 0x7ff04e3c1c4c in nsThreadManager::Shutdown() /builds/worker/workspace/build/src/xpcom/threads/nsThreadManager.cpp:318
[task 2019-06-14T01:36:08.843Z] 01:36:08 INFO - #10 0x7ff04e4135ec in mozilla::ShutdownXPCOM(nsIServiceManager*) /builds/worker/workspace/build/src/xpcom/build/XPCOMInit.cpp:647:28
[task 2019-06-14T01:36:08.843Z] 01:36:08 INFO - #11 0x7ff05a4c829a in XRE_InitChildProcess(int, char**, XREChildData const*) /builds/worker/workspace/build/src/toolkit/xre/nsEmbedFunctions.cpp:758:16
[task 2019-06-14T01:36:08.843Z] 01:36:08 INFO - #12 0x55c91e62b7b2 in content_process_main /builds/worker/workspace/build/src/browser/app/../../ipc/contentproc/plugin-container.cpp:56:28
[task 2019-06-14T01:36:08.843Z] 01:36:08 INFO - #13 0x55c91e62b7b2 in main /builds/worker/workspace/build/src/browser/app/nsBrowserApp.cpp:267
[task 2019-06-14T01:36:08.843Z] 01:36:08 INFO - #14 0x7ff06e7e082f in __libc_start_main /build/glibc-LK5gWL/glibc-2.23/csu/../csu/libc-start.c:291
[task 2019-06-14T01:36:08.844Z] 01:36:08 INFO - previously allocated by thread T6 (WRWorker#1) here:
[task 2019-06-14T01:36:08.844Z] 01:36:08 INFO - #0 0x55c91e5f8773 in __interceptor_malloc /builds/worker/workspace/moz-toolchain/src/llvm/projects/compiler-rt/lib/asan/asan_malloc_linux.cc:146:3
[task 2019-06-14T01:36:08.844Z] 01:36:08 INFO - #1 0x55c91e62d42d in moz_xmalloc /builds/worker/workspace/build/src/memory/mozalloc/mozalloc.cpp:52:15
[task 2019-06-14T01:36:08.844Z] 01:36:08 INFO - #2 0x7ff04e3ba8f7 in operator new /builds/worker/workspace/build/src/obj-firefox/dist/include/mozilla/mozalloc.h:144:10
[task 2019-06-14T01:36:08.844Z] 01:36:08 INFO - #3 0x7ff04e3ba8f7 in nsThreadManager::GetCurrentThread() /builds/worker/workspace/build/src/xpcom/threads/nsThreadManager.cpp:376
[task 2019-06-14T01:36:08.879Z] 01:36:08 INFO - #4 0x7ff059c0e175 in profiler_register_thread(char const*, void*) /builds/worker/workspace/build/src/tools/profiler/core/platform.cpp:3743:9
[task 2019-06-14T01:36:08.920Z] 01:36:08 INFO - #5 0x7ff050d109ef in gecko_profiler_register_thread /builds/worker/workspace/build/src/gfx/layers/wr/WebRenderBridgeParent.cpp:142:3
[task 2019-06-14T01:36:08.943Z] 01:36:08 INFO - #6 0x7ff05c7de222 in webrender_bindings::bindings::wr_thread_pool_new::$u7b$$u7b$closure$u7d$$u7d$::h9e0a5abfefaf5976 /builds/worker/workspace/build/src/gfx/webrender_bindings/src/bindings.rs:1048:12
[task 2019-06-14T01:36:08.945Z] 01:36:08 INFO - Thread T6 (WRWorker#1) created by T0 (GPU Process) here:
[task 2019-06-14T01:36:08.968Z] 01:36:08 INFO - #0 0x55c91e5e0d4d in pthread_create /builds/worker/workspace/moz-toolchain/src/llvm/projects/compiler-rt/lib/asan/asan_interceptors.cc:210:3
[task 2019-06-14T01:36:08.979Z] 01:36:08 INFO - #1 0x7ff05ce58815 in std::sys::unix::thread::Thread::new::hba7601f1ccb9f089 /rustc/3c235d5600393dfe6c36eeed34042efad8d4f26e/src/libstd/sys/unix/thread.rs:68:18
[task 2019-06-14T01:36:08.981Z] 01:36:08 INFO - SUMMARY: AddressSanitizer: heap-use-after-free /builds/worker/workspace/build/src/xpcom/threads/nsThreadManager.cpp:91:15 in nsThreadManager::ReleaseThread(void*)

Comment 1

[Andrew McCreight [:mccr8]]

This looks like another variant of bug 1479743.

Comment 2

[BugBot [:suhaib / :marco/ :calixte]]

The priority flag is not set for this bug.
:jbonisteel, could you have a look please?

For more information, please visit auto_nag documentation.

Comment 3

[Nicolas Silva [:nical]]

Fixed in Bug 1557208.