1568234 - LSan: Direct leak of 784 bytes [@ cssparser::parser::Parser::parse_comma_separated]

Status: NEW

(Core :: DOM: Core & HTML, defect, P3)

Description

[Tyson Smith [:tsmith]]

Attachment: testcase.html

Direct leak of 784 byte(s) in 25 object(s) allocated from:
    #0 __interceptor_realloc /builds/worker/workspace/moz-toolchain/src/llvm/projects/compiler-rt/lib/asan/asan_malloc_linux.cc:165:3
    #1 std::sys::unix::alloc::_$LT$impl$u20$core..alloc..GlobalAlloc$u20$for$u20$std..alloc..System$GT$::realloc::h8df3ca51ecd89c35 /rustc/a53f9df32fbb0b5f4382caaad8f1a46f36ea887c/src/libstd/sys/unix/alloc.rs:43:12
    #2 __rdl_realloc /rustc/a53f9df32fbb0b5f4382caaad8f1a46f36ea887c/src/libstd/alloc.rs:255
    #3 alloc::alloc::realloc::h4bc5231c2b89109d /rustc/a53f9df32fbb0b5f4382caaad8f1a46f36ea887c/src/liballoc/alloc.rs:125
    #4 _$LT$alloc..alloc..Global$u20$as$u20$core..alloc..Alloc$GT$::realloc::hc52e0fe907a4f7ff /rustc/a53f9df32fbb0b5f4382caaad8f1a46f36ea887c/src/liballoc/alloc.rs:184
    #5 alloc::raw_vec::RawVec$LT$T$C$A$GT$::reserve_internal::h0f60d175b1d96be6 /rustc/a53f9df32fbb0b5f4382caaad8f1a46f36ea887c/src/liballoc/raw_vec.rs:666
    #6 alloc::raw_vec::RawVec$LT$T$C$A$GT$::reserve::h462d547446b8d0da /rustc/a53f9df32fbb0b5f4382caaad8f1a46f36ea887c/src/liballoc/raw_vec.rs:491
    #7 alloc::vec::Vec$LT$T$GT$::reserve::h80908fd58db99fb4 /rustc/a53f9df32fbb0b5f4382caaad8f1a46f36ea887c/src/liballoc/vec.rs:457
    #8 alloc::vec::Vec$LT$T$GT$::push::h1831bb6d57a6f575 /rustc/a53f9df32fbb0b5f4382caaad8f1a46f36ea887c/src/liballoc/vec.rs:1033
    #9 cssparser::parser::Parser::parse_comma_separated::h123ca9da6d07dde9 src/third_party/rust/cssparser/src/parser.rs:664
    #10 selectors::parser::parse_compound_selector_list::h5fff3e15153e4b80 src/servo/components/selectors/parser.rs:366
    #11 style::gecko::selector_parser::_$LT$impl$u20$selectors..parser..Parser$u20$for$u20$style..selector_parser..SelectorParser$GT$::parse_non_ts_functional_pseudo_class::h4032fb7efce96897 src/servo/components/style/gecko/selector_parser.rs:396
    #12 selectors::parser::parse_functional_pseudo_class::h271a74eaea99b1b2 src/servo/components/selectors/parser.rs:2091:4
    #13 selectors::parser::parse_one_simple_selector::_$u7b$$u7b$closure$u7d$$u7d$::h2cd9602cee317f5a src/servo/components/selectors/parser.rs:2228:24
    #14 cssparser::parser::Parser::parse_entirely::hbade9ccddc7f31ef src/third_party/rust/cssparser/src/parser.rs:634
    #15 cssparser::parser::parse_nested_block::hfeb631773c0028b3 src/third_party/rust/cssparser/src/parser.rs:1048
    #16 cssparser::parser::Parser::parse_nested_block::h3171e60ec05e3e6d src/third_party/rust/cssparser/src/parser.rs:689
    #17 selectors::parser::parse_one_simple_selector::hf0e18ae21c362c82 src/servo/components/selectors/parser.rs:2227
    #18 selectors::parser::parse_compound_selector::h5959fb63c55dd863 src/servo/components/selectors/parser.rs:2021:33
    #19 selectors::parser::parse_selector::hdab9a42487b8346a src/servo/components/selectors/parser.rs:1486
    #20 selectors::parser::SelectorList$LT$Impl$GT$::parse::_$u7b$$u7b$closure$u7d$$u7d$::h5add13127df4660d src/servo/components/selectors/parser.rs:315:66
    #21 cssparser::parser::Parser::parse_entirely::h99dfa992a56d6aac src/third_party/rust/cssparser/src/parser.rs:634
    #22 cssparser::parser::parse_until_before::hc2d3b2fcb1835f65 src/third_party/rust/cssparser/src/parser.rs:975
    #23 cssparser::parser::Parser::parse_until_before::hc08548621fa4cee4 src/third_party/rust/cssparser/src/parser.rs:709
    #24 selectors::parser::SelectorList$LT$Impl$GT$::parse::hef6b1101bc1aff45 src/servo/components/selectors/parser.rs:314
    #25 _$LT$style..stylesheets..rule_parser..NestedRuleParser$u20$as$u20$cssparser..rules_and_declarations..QualifiedRuleParser$GT$::parse_prelude::h5f7c7a911c36232f src/servo/components/style/stylesheets/rule_parser.rs:587:8
    #26 _$LT$style..stylesheets..rule_parser..TopLevelRuleParser$u20$as$u20$cssparser..rules_and_declarations..QualifiedRuleParser$GT$::parse_prelude::ha81f857b5a875c4f src/servo/components/style/stylesheets/rule_parser.rs:312
    #27 cssparser::rules_and_declarations::parse_qualified_rule::_$u7b$$u7b$closure$u7d$$u7d$::hedb1684a268a69d2 src/third_party/rust/cssparser/src/rules_and_declarations.rs:538
    #28 cssparser::parser::Parser::parse_entirely::hac4daaa128929e27 src/third_party/rust/cssparser/src/parser.rs:634
    #29 cssparser::parser::parse_until_before::h8508aec81e8b7511 src/third_party/rust/cssparser/src/parser.rs:975
    #30 cssparser::rules_and_declarations::parse_qualified_rule::h122ac9b536d572ca src/third_party/rust/cssparser/src/rules_and_declarations.rs:537
    #31 _$LT$cssparser..rules_and_declarations..RuleListParser$LT$P$GT$$u20$as$u20$core..iter..traits..iterator..Iterator$GT$::next::h3a22d692d353bd85 src/third_party/rust/cssparser/src/rules_and_declarations.rs:415:29
    #32 style::stylesheets::stylesheet::Stylesheet::parse_rules::h30786c53c660c954 src/servo/components/style/stylesheets/stylesheet.rs:418
    #33 style::stylesheets::stylesheet::StylesheetContents::from_str::hd9f0aeea75b2558a src/servo/components/style/stylesheets/stylesheet.rs:86
    #34 Servo_StyleSheet_FromUTF8Bytes src/servo/ports/geckolib/glue.rs:1391:13
    #35 mozilla::StyleSheet::ParseSheetSync(mozilla::css::Loader*, nsTSubstring<char> const&, mozilla::css::SheetLoadData*, unsigned int, mozilla::css::LoaderReusableStyleSheets*) src/layout/style/StyleSheet.cpp:1004:7
    #36 mozilla::css::Loader::ParseSheet(nsTSubstring<char> const&, mozilla::css::SheetLoadData*, mozilla::css::Loader::AllowAsyncParse) src/layout/style/Loader.cpp:1549:12
    #37 mozilla::css::StreamLoader::OnStopRequest(nsIRequest*, nsresult) src/layout/style/StreamLoader.cpp:109:28
    #38 nsSyncLoadService::PushSyncStreamToListener(already_AddRefed<nsIInputStream>, nsIStreamListener*, nsIChannel*) src/dom/base/nsSyncLoadService.cpp:362:14
    #39 mozilla::css::Loader::LoadSheet(mozilla::css::SheetLoadData*, mozilla::css::StyleSheetState, bool) src/layout/style/Loader.cpp:1303:12
    #40 mozilla::css::Loader::InternalLoadNonDocumentSheet(nsIURI*, bool, mozilla::css::SheetParsingMode, bool, nsIPrincipal*, mozilla::Encoding const*, RefPtr<mozilla::StyleSheet>*, nsIReferrerInfo*, nsICSSLoaderObserver*, mozilla::CORSMode, nsTSubstring<char16_t> const&) src/layout/style/Loader.cpp:2200:8
    #41 mozilla::css::Loader::LoadSheetSync(nsIURI*, mozilla::css::SheetParsingMode, bool, RefPtr<mozilla::StyleSheet>*) src/layout/style/Loader.cpp:2112:10
    #42 nsLayoutStylesheetCache::LoadSheet(nsIURI*, RefPtr<mozilla::StyleSheet>*, mozilla::css::SheetParsingMode, mozilla::css::FailureAction) src/layout/style/nsLayoutStylesheetCache.cpp:519:29
    #43 LoadSheetURL src/layout/style/nsLayoutStylesheetCache.cpp:460:3
    #44 nsLayoutStylesheetCache::HTMLSheet() src/obj-firefox/dist/include/mozilla/UserAgentStyleSheetList.h:27
    #45 mozilla::dom::Document::FillStyleSetUserAndUASheets() src/dom/base/Document.cpp:2644:62
    #46 FillStyleSet src/dom/base/Document.cpp:2684:3
    #47 mozilla::dom::Document::CreatePresShell(nsPresContext*, nsViewManager*) src/dom/base/Document.cpp:5921

Comment 1

[Emilio Cobos Álvarez (:emilio)]

User-agent stylesheets are static, so they should go away as soon as nsLayoutStyleSheetCache::ShutDown() is called, and other documents don't reference them.

Maybe in this case we're keeping the stylesheets in the document for too long and are leaking the document somehow?

Comment 2

[Tyson Smith [:tsmith]]

Attachment: leak_tab_pid72319.log

BloatView log

Comment 3

[Andrew McCreight [:mccr8]]

This is leaking a window.

Comment 4

[BugBot [:suhaib / :marco/ :calixte]]

The priority flag is not set for this bug.
:hiro, could you have a look please?

For more information, please visit auto_nag documentation.

Comment 5

[Hiroyuki Ikezoe (:hiro)]

Moving to DOM:Core & HTML as per comment 3.