Closed Bug 1565862 Opened 5 years ago Closed 5 years ago

Intermittent AddressSanitizer: heap-use-after-free /builds/worker/workspace/build/src/obj-firefox/dist/include/mozilla/LinkedList.h:288:12 in isInList

Categories

(Core :: Graphics: WebRender, defect)

defect
Not set
normal

Tracking

()

RESOLVED DUPLICATE of bug 1557208

People

(Reporter: NarcisB, Unassigned)

References

Details

(Keywords: csectype-uaf, intermittent-failure)

Push link: https://treeherder.mozilla.org/#/jobs?repo=autoland&resultStatus=testfailed%2Cbusted%2Cexception%2Crunnable&revision=d1635bf62251366c88e221b9c3af3f795e23254f&selectedJob=256376172

Log link: https://treeherder.mozilla.org/logviewer.html#/jobs?job_id=256376172&repo=autoland&lineNumber=2985

Log snippet:

[task 2019-07-13T20:08:52.240Z] 20:08:52     INFO - REFTEST TEST-START | file:///builds/worker/workspace/build/tests/reftest/tests/layout/reftests/w3c-css/submitted/ruby/nested-ruby-pairing-001.html == file:///builds/worker/workspace/build/tests/reftest/tests/layout/reftests/w3c-css/submitted/ruby/nested-ruby-pairing-001-ref.html
[task 2019-07-13T20:08:52.240Z] 20:08:52     INFO - REFTEST TEST-LOAD | file:///builds/worker/workspace/build/tests/reftest/tests/layout/reftests/w3c-css/submitted/ruby/nested-ruby-pairing-001.html | 13 / 14 (92%)
[task 2019-07-13T20:08:52.479Z] 20:08:52     INFO - REFTEST TEST-LOAD | file:///builds/worker/workspace/build/tests/reftest/tests/layout/reftests/w3c-css/submitted/ruby/nested-ruby-pairing-001-ref.html | 13 / 14 (92%)
[task 2019-07-13T20:08:52.636Z] 20:08:52     INFO - REFTEST TEST-PASS | file:///builds/worker/workspace/build/tests/reftest/tests/layout/reftests/w3c-css/submitted/ruby/nested-ruby-pairing-001.html == file:///builds/worker/workspace/build/tests/reftest/tests/layout/reftests/w3c-css/submitted/ruby/nested-ruby-pairing-001-ref.html | image comparison, max difference: 0, number of differing pixels: 0
[task 2019-07-13T20:08:52.636Z] 20:08:52     INFO - REFTEST TEST-END | file:///builds/worker/workspace/build/tests/reftest/tests/layout/reftests/w3c-css/submitted/ruby/nested-ruby-pairing-001.html == file:///builds/worker/workspace/build/tests/reftest/tests/layout/reftests/w3c-css/submitted/ruby/nested-ruby-pairing-001-ref.html
[task 2019-07-13T20:08:52.657Z] 20:08:52     INFO - REFTEST INFO | Slowest test took 782ms (file:///builds/worker/workspace/build/tests/reftest/tests/layout/reftests/w3c-css/submitted/ruby/ruby-inlinize-blocks-002.html)
[task 2019-07-13T20:08:52.658Z] 20:08:52     INFO - REFTEST INFO | Total canvas count = 3
[task 2019-07-13T20:08:53.766Z] 20:08:53     INFO - 1563048533763	Marionette	TRACE	Received observer notification xpcom-will-shutdown
[task 2019-07-13T20:08:53.768Z] 20:08:53     INFO - 1563048533763	Marionette	INFO	Stopped listening on port 2828
[task 2019-07-13T20:08:53.768Z] 20:08:53     INFO - 1563048533764	Marionette	DEBUG	Remote service is inactive
[task 2019-07-13T20:08:53.784Z] 20:08:53     INFO - ###!!! [Child][RunMessage] Error: Channel closing: too late to send/recv, messages will be lost
[task 2019-07-13T20:08:54.477Z] 20:08:54     INFO - =================================================================
[task 2019-07-13T20:08:54.482Z] 20:08:54    ERROR - ==3500==ERROR: AddressSanitizer: heap-use-after-free on address 0x611000039fd8 at pc 0x7fbf24fbb9b8 bp 0x7fbf1c6bdd00 sp 0x7fbf1c6bdcf8
[task 2019-07-13T20:08:54.484Z] 20:08:54     INFO - READ of size 8 at 0x611000039fd8 thread T6 (WRWorker#1)
[task 2019-07-13T20:08:55.350Z] 20:08:55     INFO -     #0 0x7fbf24fbb9b7 in isInList /builds/worker/workspace/build/src/obj-firefox/dist/include/mozilla/LinkedList.h:288:12
[task 2019-07-13T20:08:55.350Z] 20:08:55     INFO -     #1 0x7fbf24fbb9b7 in nsThread::MaybeRemoveFromThreadList() /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:405
[task 2019-07-13T20:08:55.354Z] 20:08:55     INFO -     #2 0x7fbf24fbdb89 in nsThread::~nsThread() /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:643:3
[task 2019-07-13T20:08:55.354Z] 20:08:55     INFO -     #3 0x7fbf24fbe16d in nsThread::~nsThread() /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:639:23
[task 2019-07-13T20:08:55.354Z] 20:08:55     INFO -     #4 0x7fbf24fba9ad in nsThread::Release() /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:191:1
[task 2019-07-13T20:08:55.356Z] 20:08:55     INFO -     #5 0x7fbf46a6282d in _PR_DestroyThreadPrivate /builds/worker/workspace/build/src/nsprpub/pr/src/threads/prtpd.c:236:25
[task 2019-07-13T20:08:55.360Z] 20:08:55     INFO -     #6 0x7fbf46a52a94 in _pt_thread_death_internal /builds/worker/workspace/build/src/nsprpub/pr/src/pthreads/ptthread.c:840:9
[task 2019-07-13T20:08:55.361Z] 20:08:55     INFO -     #7 0x7fbf46a52d16 in _pt_thread_death /builds/worker/workspace/build/src/nsprpub/pr/src/pthreads/ptthread.c:813:5
[task 2019-07-13T20:08:55.362Z] 20:08:55     INFO -     #8 0x7fbf466a6438 in __nptl_deallocate_tsd.part.4 (/lib/x86_64-linux-gnu/libpthread.so.0+0x6438)
[task 2019-07-13T20:08:55.362Z] 20:08:55     INFO -     #9 0x7fbf466a786f in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x786f)
[task 2019-07-13T20:08:55.420Z] 20:08:55     INFO -     #10 0x7fbf4573041c in clone /build/glibc-LK5gWL/glibc-2.23/misc/../sysdeps/unix/sysv/linux/x86_64/clone.S:109
[task 2019-07-13T20:08:55.421Z] 20:08:55     INFO - 0x611000039fd8 is located 24 bytes inside of 232-byte region [0x611000039fc0,0x61100003a0a8)
[task 2019-07-13T20:08:55.422Z] 20:08:55     INFO - freed by thread T0 (GPU Process) here:
[task 2019-07-13T20:08:55.422Z] 20:08:55     INFO -     #0 0x55b15d0ee442 in free /builds/worker/workspace/moz-toolchain/src/llvm/projects/compiler-rt/lib/asan/asan_malloc_linux.cc:124:3
[task 2019-07-13T20:08:55.423Z] 20:08:55     INFO -     #1 0x7fbf24fba9ad in nsThread::Release() /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:191:1
[task 2019-07-13T20:08:55.424Z] 20:08:55     INFO -     #2 0x7fbf24fc711c in Release /builds/worker/workspace/build/src/obj-firefox/dist/include/mozilla/RefPtr.h:46:40
[task 2019-07-13T20:08:55.425Z] 20:08:55     INFO -     #3 0x7fbf24fc711c in Release /builds/worker/workspace/build/src/obj-firefox/dist/include/mozilla/RefPtr.h:363
[task 2019-07-13T20:08:55.425Z] 20:08:55     INFO -     #4 0x7fbf24fc711c in ~RefPtr /builds/worker/workspace/build/src/obj-firefox/dist/include/mozilla/RefPtr.h:77
[task 2019-07-13T20:08:55.426Z] 20:08:55     INFO -     #5 0x7fbf24fc711c in Destruct /builds/worker/workspace/build/src/obj-firefox/dist/include/nsTArray.h:525
[task 2019-07-13T20:08:55.426Z] 20:08:55     INFO -     #6 0x7fbf24fc711c in DestructRange /builds/worker/workspace/build/src/obj-firefox/dist/include/nsTArray.h:2183
[task 2019-07-13T20:08:55.427Z] 20:08:55     INFO -     #7 0x7fbf24fc711c in ClearAndRetainStorage /builds/worker/workspace/build/src/obj-firefox/dist/include/nsTArray.h:1300
[task 2019-07-13T20:08:55.428Z] 20:08:55     INFO -     #8 0x7fbf24fc711c in ~nsTArray_Impl /builds/worker/workspace/build/src/obj-firefox/dist/include/nsTArray.h:881
[task 2019-07-13T20:08:55.428Z] 20:08:55     INFO -     #9 0x7fbf24fc711c in nsThreadManager::Shutdown() /builds/worker/workspace/build/src/xpcom/threads/nsThreadManager.cpp:318
[task 2019-07-13T20:08:55.445Z] 20:08:55     INFO -     #10 0x7fbf250188bc in mozilla::ShutdownXPCOM(nsIServiceManager*) /builds/worker/workspace/build/src/xpcom/build/XPCOMInit.cpp:647:28
[task 2019-07-13T20:08:55.446Z] 20:08:55     INFO -     #11 0x7fbf312a4bfa in XRE_InitChildProcess(int, char**, XREChildData const*) /builds/worker/workspace/build/src/toolkit/xre/nsEmbedFunctions.cpp:758:16
[task 2019-07-13T20:08:55.446Z] 20:08:55     INFO -     #12 0x55b15d121802 in content_process_main /builds/worker/workspace/build/src/browser/app/../../ipc/contentproc/plugin-container.cpp:56:28
[task 2019-07-13T20:08:55.447Z] 20:08:55     INFO -     #13 0x55b15d121802 in main /builds/worker/workspace/build/src/browser/app/nsBrowserApp.cpp:267
[task 2019-07-13T20:08:55.448Z] 20:08:55     INFO -     #14 0x7fbf4564982f in __libc_start_main /build/glibc-LK5gWL/glibc-2.23/csu/../csu/libc-start.c:291
[task 2019-07-13T20:08:55.448Z] 20:08:55     INFO - previously allocated by thread T6 (WRWorker#1) here:
[task 2019-07-13T20:08:55.448Z] 20:08:55     INFO -     #0 0x55b15d0ee7c3 in __interceptor_malloc /builds/worker/workspace/moz-toolchain/src/llvm/projects/compiler-rt/lib/asan/asan_malloc_linux.cc:146:3
[task 2019-07-13T20:08:55.448Z] 20:08:55     INFO -     #1 0x55b15d12347d in moz_xmalloc /builds/worker/workspace/build/src/memory/mozalloc/mozalloc.cpp:52:15
[task 2019-07-13T20:08:55.449Z] 20:08:55     INFO -     #2 0x7fbf24fbfc37 in operator new /builds/worker/workspace/build/src/obj-firefox/dist/include/mozilla/cxxalloc.h:33:10
[task 2019-07-13T20:08:55.449Z] 20:08:55     INFO -     #3 0x7fbf24fbfc37 in nsThreadManager::GetCurrentThread() /builds/worker/workspace/build/src/xpcom/threads/nsThreadManager.cpp:376
[task 2019-07-13T20:08:55.481Z] 20:08:55     INFO -     #4 0x7fbf309c97e5 in profiler_register_thread(char const*, void*) /builds/worker/workspace/build/src/tools/profiler/core/platform.cpp:3777:9
[task 2019-07-13T20:08:55.522Z] 20:08:55     INFO -     #5 0x7fbf2796641f in gecko_profiler_register_thread /builds/worker/workspace/build/src/gfx/layers/wr/WebRenderBridgeParent.cpp:136:3
[task 2019-07-13T20:08:55.563Z] 20:08:55     INFO -     #6 0x7fbf33660b29 in webrender_bindings::bindings::wr_thread_pool_new::_$u7b$$u7b$closure$u7d$$u7d$::h5758bebc82cddfc8 /builds/worker/workspace/build/src/gfx/webrender_bindings/src/bindings.rs:1046:12
[task 2019-07-13T20:08:55.563Z] 20:08:55     INFO -     #7 0x7fbf33c99805 in _$LT$alloc..boxed..Box$LT$F$GT$$u20$as$u20$core..ops..function..Fn$LT$A$GT$$GT$::call::hd0627d94a3b6bca8 /rustc/a53f9df32fbb0b5f4382caaad8f1a46f36ea887c/src/liballoc/boxed.rs:718:8
[task 2019-07-13T20:08:55.564Z] 20:08:55     INFO -     #8 0x7fbf33c99805 in rayon_core::registry::main_loop::_$u7b$$u7b$closure$u7d$$u7d$::hb6be0ae738bbc5a5 /builds/worker/workspace/build/src/third_party/rust/rayon-core/src/registry.rs:688
[task 2019-07-13T20:08:55.568Z] 20:08:55     INFO -     #9 0x7fbf33c99805 in _$LT$std..panic..AssertUnwindSafe$LT$F$GT$$u20$as$u20$core..ops..function..FnOnce$LT$$LP$$RP$$GT$$GT$::call_once::h324bd73f9655b351 /rustc/a53f9df32fbb0b5f4382caaad8f1a46f36ea887c/src/libstd/panic.rs:315
[task 2019-07-13T20:08:55.569Z] 20:08:55     INFO -     #10 0x7fbf33c99805 in std::panicking::try::do_call::h5cc0e35814f78b01 /rustc/a53f9df32fbb0b5f4382caaad8f1a46f36ea887c/src/libstd/panicking.rs:293
[task 2019-07-13T20:08:55.569Z] 20:08:55     INFO -     #11 0x7fbf33c99805 in __rust_maybe_catch_panic /rustc/a53f9df32fbb0b5f4382caaad8f1a46f36ea887c/src/libpanic_abort/lib.rs:29
[task 2019-07-13T20:08:55.571Z] 20:08:55     INFO -     #12 0x7fbf33c99805 in std::panicking::try::ha68d62c204b03801 /rustc/a53f9df32fbb0b5f4382caaad8f1a46f36ea887c/src/libstd/panicking.rs:272
[task 2019-07-13T20:08:55.572Z] 20:08:55     INFO -     #13 0x7fbf33c99805 in std::panic::catch_unwind::hc406f6850b170648 /rustc/a53f9df32fbb0b5f4382caaad8f1a46f36ea887c/src/libstd/panic.rs:394
[task 2019-07-13T20:08:55.572Z] 20:08:55     INFO -     #14 0x7fbf33c99805 in rayon_core::unwind::halt_unwinding::h545c676f4ddaea35 /builds/worker/workspace/build/src/third_party/rust/rayon-core/src/unwind.rs:18
[task 2019-07-13T20:08:55.573Z] 20:08:55     INFO -     #15 0x7fbf33c99805 in rayon_core::registry::main_loop::h61304810bc0506e7 /builds/worker/workspace/build/src/third_party/rust/rayon-core/src/registry.rs:665
[task 2019-07-13T20:08:55.574Z] 20:08:55     INFO -     #16 0x7fbf33c99805 in rayon_core::registry::Registry::new::_$u7b$$u7b$closure$u7d$$u7d$::ha59db086df7ea637 /builds/worker/workspace/build/src/third_party/rust/rayon-core/src/registry.rs:134
[task 2019-07-13T20:08:55.574Z] 20:08:55     INFO -     #17 0x7fbf33c99805 in std::sys_common::backtrace::__rust_begin_short_backtrace::h1cac9f2d6dfc0236 /rustc/a53f9df32fbb0b5f4382caaad8f1a46f36ea887c/src/libstd/sys_common/backtrace.rs:136
[task 2019-07-13T20:08:55.576Z] 20:08:55     INFO -     #18 0x7fbf33c99511 in std::thread::Builder::spawn_unchecked::_$u7b$$u7b$closure$u7d$$u7d$::_$u7b$$u7b$closure$u7d$$u7d$::h843feb4df54a7596 /rustc/a53f9df32fbb0b5f4382caaad8f1a46f36ea887c/src/libstd/thread/mod.rs:470:16
[task 2019-07-13T20:08:55.576Z] 20:08:55     INFO -     #19 0x7fbf33c99511 in _$LT$std..panic..AssertUnwindSafe$LT$F$GT$$u20$as$u20$core..ops..function..FnOnce$LT$$LP$$RP$$GT$$GT$::call_once::h5cfc1b4431d71375 /rustc/a53f9df32fbb0b5f4382caaad8f1a46f36ea887c/src/libstd/panic.rs:315
[task 2019-07-13T20:08:55.577Z] 20:08:55     INFO -     #20 0x7fbf33c99511 in std::panicking::try::do_call::h24f597158bcd8cdd /rustc/a53f9df32fbb0b5f4382caaad8f1a46f36ea887c/src/libstd/panicking.rs:293
[task 2019-07-13T20:08:55.578Z] 20:08:55     INFO -     #21 0x7fbf33c99511 in __rust_maybe_catch_panic /rustc/a53f9df32fbb0b5f4382caaad8f1a46f36ea887c/src/libpanic_abort/lib.rs:29
[task 2019-07-13T20:08:55.578Z] 20:08:55     INFO -     #22 0x7fbf33c99511 in std::panicking::try::h86ce001650599361 /rustc/a53f9df32fbb0b5f4382caaad8f1a46f36ea887c/src/libstd/panicking.rs:272
[task 2019-07-13T20:08:55.579Z] 20:08:55     INFO -     #23 0x7fbf33c99511 in std::panic::catch_unwind::hde758c2ad709305b /rustc/a53f9df32fbb0b5f4382caaad8f1a46f36ea887c/src/libstd/panic.rs:394
[task 2019-07-13T20:08:55.580Z] 20:08:55     INFO -     #24 0x7fbf33c99511 in std::thread::Builder::spawn_unchecked::_$u7b$$u7b$closure$u7d$$u7d$::h4b567ffe8e72de7f /rustc/a53f9df32fbb0b5f4382caaad8f1a46f36ea887c/src/libstd/thread/mod.rs:469
[task 2019-07-13T20:08:55.580Z] 20:08:55     INFO -     #25 0x7fbf33c99511 in core::ops::function::FnOnce::call_once$u7b$$u7b$vtable.shim$u7d$$u7d$::h497e1e5020f13569 /rustc/a53f9df32fbb0b5f4382caaad8f1a46f36ea887c/src/libcore/ops/function.rs:231
[task 2019-07-13T20:08:55.581Z] 20:08:55     INFO -     #26 0x7fbf33cdf77d in _$LT$alloc..boxed..Box$LT$F$GT$$u20$as$u20$core..ops..function..FnOnce$LT$A$GT$$GT$::call_once::h805c3cc89d534c05 /rustc/a53f9df32fbb0b5f4382caaad8f1a46f36ea887c/src/liballoc/boxed.rs:704:8
[task 2019-07-13T20:08:55.581Z] 20:08:55     INFO -     #27 0x7fbf33ce18e7 in _$LT$alloc..boxed..Box$LT$F$GT$$u20$as$u20$core..ops..function..FnOnce$LT$A$GT$$GT$::call_once::h9ebda9db5f03daf3 /rustc/a53f9df32fbb0b5f4382caaad8f1a46f36ea887c/src/liballoc/boxed.rs:704:8
[task 2019-07-13T20:08:55.583Z] 20:08:55     INFO -     #28 0x7fbf33ce18e7 in std::sys_common::thread::start_thread::ha32838ccbb8a8179 /rustc/a53f9df32fbb0b5f4382caaad8f1a46f36ea887c/src/libstd/sys_common/thread.rs:13
[task 2019-07-13T20:08:55.583Z] 20:08:55     INFO -     #29 0x7fbf33ce18e7 in std::sys::unix::thread::Thread::new::thread_start::h6f10b78f26c98dc6 /rustc/a53f9df32fbb0b5f4382caaad8f1a46f36ea887c/src/libstd/sys/unix/thread.rs:79
[task 2019-07-13T20:08:55.584Z] 20:08:55     INFO - Thread T6 (WRWorker#1) created by T0 (GPU Process) here:
[task 2019-07-13T20:08:55.611Z] 20:08:55     INFO -     #0 0x55b15d0d6d9d in pthread_create /builds/worker/workspace/moz-toolchain/src/llvm/projects/compiler-rt/lib/asan/asan_interceptors.cc:210:3
[task 2019-07-13T20:08:55.611Z] 20:08:55     INFO -     #1 0x7fbf33ce15e5 in std::sys::unix::thread::Thread::new::h6be137d16fd9b117 /rustc/a53f9df32fbb0b5f4382caaad8f1a46f36ea887c/src/libstd/sys/unix/thread.rs:67:18
[task 2019-07-13T20:08:55.611Z] 20:08:55     INFO - SUMMARY: AddressSanitizer: heap-use-after-free /builds/worker/workspace/build/src/obj-firefox/dist/include/mozilla/LinkedList.h:288:12 in isInList
[task 2019-07-13T20:08:55.612Z] 20:08:55     INFO - Shadow bytes around the buggy address:
[task 2019-07-13T20:08:55.612Z] 20:08:55     INFO -   0x0c227ffff3a0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
[task 2019-07-13T20:08:55.613Z] 20:08:55     INFO -   0x0c227ffff3b0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
[task 2019-07-13T20:08:55.614Z] 20:08:55     INFO -   0x0c227ffff3c0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
[task 2019-07-13T20:08:55.614Z] 20:08:55     INFO -   0x0c227ffff3d0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
[task 2019-07-13T20:08:55.615Z] 20:08:55     INFO -   0x0c227ffff3e0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
[task 2019-07-13T20:08:55.615Z] 20:08:55     INFO - =>0x0c227ffff3f0: fa fa fa fa fa fa fa fa fd fd fd[fd]fd fd fd fd
[task 2019-07-13T20:08:55.616Z] 20:08:55     INFO -   0x0c227ffff400: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
[task 2019-07-13T20:08:55.617Z] 20:08:55     INFO -   0x0c227ffff410: fd fd fd fd fd fa fa fa fa fa fa fa fa fa fa fa
[task 2019-07-13T20:08:55.617Z] 20:08:55     INFO -   0x0c227ffff420: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
[task 2019-07-13T20:08:55.618Z] 20:08:55     INFO -   0x0c227ffff430: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
[task 2019-07-13T20:08:55.619Z] 20:08:55     INFO -   0x0c227ffff440: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
[task 2019-07-13T20:08:55.619Z] 20:08:55     INFO - Shadow byte legend (one shadow byte represents 8 application bytes):
[task 2019-07-13T20:08:55.620Z] 20:08:55     INFO -   Addressable:           00
[task 2019-07-13T20:08:55.620Z] 20:08:55     INFO -   Partially addressable: 01 02 03 04 05 06 07
[task 2019-07-13T20:08:55.621Z] 20:08:55     INFO -   Heap left redzone:       fa
[task 2019-07-13T20:08:55.622Z] 20:08:55     INFO -   Freed heap region:       fd
[task 2019-07-13T20:08:55.622Z] 20:08:55     INFO -   Stack left redzone:      f1
[task 2019-07-13T20:08:55.623Z] 20:08:55     INFO -   Stack mid redzone:       f2
[task 2019-07-13T20:08:55.623Z] 20:08:55     INFO -   Stack right redzone:     f3
[task 2019-07-13T20:08:55.623Z] 20:08:55     INFO -   Stack after return:      f5
[task 2019-07-13T20:08:55.623Z] 20:08:55     INFO -   Stack use after scope:   f8
[task 2019-07-13T20:08:55.624Z] 20:08:55     INFO -   Global redzone:          f9
[task 2019-07-13T20:08:55.624Z] 20:08:55     INFO -   Global init order:       f6
[task 2019-07-13T20:08:55.624Z] 20:08:55     INFO -   Poisoned by user:        f7
[task 2019-07-13T20:08:55.624Z] 20:08:55     INFO -   Container overflow:      fc
[task 2019-07-13T20:08:55.627Z] 20:08:55     INFO -   Array cookie:            ac
[task 2019-07-13T20:08:55.627Z] 20:08:55     INFO -   Intra object redzone:    bb
[task 2019-07-13T20:08:55.628Z] 20:08:55     INFO -   ASan internal:           fe
[task 2019-07-13T20:08:55.628Z] 20:08:55     INFO -   Left alloca redzone:     ca
[task 2019-07-13T20:08:55.629Z] 20:08:55     INFO -   Right alloca redzone:    cb
[task 2019-07-13T20:08:55.630Z] 20:08:55     INFO -   Shadow gap:              cc
[task 2019-07-13T20:08:55.631Z] 20:08:55     INFO - ==3500==ABORTING

Revival of bug 1557208?

Flags: needinfo?(nical.bugzilla)
Keywords: csectype-uaf
See Also: → 1557208
Component: JavaScript Engine → Graphics: WebRender

Indeed. I'll continue invetsigating on the other bug.

Status: NEW → RESOLVED
Closed: 5 years ago
Flags: needinfo?(nical.bugzilla)
Resolution: --- → DUPLICATE
Group: core-security
You need to log in before you can comment on or make changes to this bug.