1603036 - LeakSanitizer: [@ XDRBufferObject::create] or [@ CodeModule]

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

The following testcase crashes on mozilla-central revision 7635669b8d72 (build with --enable-address-sanitizer, run with --fuzzing-safe --no-threads --no-baseline --no-ion --blinterp-eager and ASAN_OPTIONS=detect_leaks=1 in the environment variable):

// jsfunfuzz-generated
(function() {
    (function() {
        // Adapted from randomly chosen test: js/src/jit-test/tests/xdr/module.js
        codeModule(parseModule(""));
    })();
})();

Backtrace:

Direct leak of 256 byte(s) in 1 object(s) allocated from:
    #0 0x563234c8a9f3 in __interceptor_malloc (/home/ubuntu/shell-cache/js-64-asan-linux-x86_64-7635669b8d72/js-64-asan-linux-x86_64-7635669b8d72+0x187a9f3)
    #1 0x563234d50a05 in unsigned char* mozilla::MallocAllocPolicy::maybe_pod_malloc<unsigned char>(unsigned long) /home/ubuntu/shell-cache/js-64-asan-linux-x86_64-7635669b8d72/objdir-js/dist/include/mozilla/AllocPolicy.h:83:28
    #2 0x563234d50a05 in unsigned char* mozilla::MallocAllocPolicy::pod_malloc<unsigned char>(unsigned long) /home/ubuntu/shell-cache/js-64-asan-linux-x86_64-7635669b8d72/objdir-js/dist/include/mozilla/AllocPolicy.h:101
    #3 0x563234d50a05 in mozilla::Vector<unsigned char, 0ul, mozilla::MallocAllocPolicy>::convertToHeapStorage(unsigned long) /home/ubuntu/shell-cache/js-64-asan-linux-x86_64-7635669b8d72/objdir-js/dist/include/mozilla/Vector.h:937
    #4 0x563234d50a05 in mozilla::Vector<unsigned char, 0ul, mozilla::MallocAllocPolicy>::growStorageBy(unsigned long) /home/ubuntu/shell-cache/js-64-asan-linux-x86_64-7635669b8d72/objdir-js/dist/include/mozilla/Vector.h:1025
    #5 0x563234d52db4 in bool mozilla::Vector<unsigned char, 0ul, mozilla::MallocAllocPolicy>::append<unsigned char>(unsigned char const*, unsigned char const*) /home/ubuntu/shell-cache/js-64-asan-linux-x86_64-7635669b8d72/objdir-js/dist/include/mozilla/Vector.h:1330:9
    #6 0x563234d52db4 in bool mozilla::Vector<unsigned char, 0ul, mozilla::MallocAllocPolicy>::append<unsigned char>(unsigned char const*, unsigned long) /home/ubuntu/shell-cache/js-64-asan-linux-x86_64-7635669b8d72/objdir-js/dist/include/mozilla/Vector.h:1386
    #7 0x563234d52db4 in bool mozilla::Vector<unsigned char, 0ul, mozilla::MallocAllocPolicy>::appendAll<unsigned char, 0ul, mozilla::MallocAllocPolicy>(mozilla::Vector<unsigned char, 0ul, mozilla::MallocAllocPolicy> const&) /home/ubuntu/shell-cache/js-64-asan-linux-x86_64-7635669b8d72/objdir-js/dist/include/mozilla/Vector.h:1379
    #8 0x563234d52db4 in XDRBufferObject::create(JSContext*, mozilla::Vector<unsigned char, 0ul, mozilla::MallocAllocPolicy>*) js/src/shell/js.cpp:4765
    #9 0x563234d09f85 in CodeModule(JSContext*, unsigned int, JS::Value*) js/src/shell/js.cpp:4804:29
    #10 0x563234ef5245 in CallJSNative(JSContext*, bool (*)(JSContext*, unsigned int, JS::Value*), js::CallReason, JS::CallArgs const&) js/src/vm/Interpreter.cpp:457:13
    #11 0x563234ef5245 in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) js/src/vm/Interpreter.cpp:549
    #12 0x5632365d9078 in js::jit::DoCallFallback(JSContext*, js::jit::BaselineFrame*, js::jit::ICCall_Fallback*, unsigned int, JS::Value*, JS::MutableHandle<JS::Value>) js/src/jit/BaselineIC.cpp:2941:10
/snip

For detailed crash information, see attachment.

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: Detailed Crash Information

Comment 2

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

autobisectjs shows this is probably related to the following changeset:

The first bad revision is:
changeset: https://hg.mozilla.org/mozilla-central/rev/b622095c76ab
user: caroline
date: Tue Dec 10 01:46:29 2019 +0000
summary: Bug 1588861 - Part 4: Add test harness for xdr modules. r=iain

Caroline, is bug 1588861 a likely regressor?

Comment 3

[Iain Ireland [:iain]]

Attachment: Bug 1603036: Call delete_ instead of free_ in XDRBufferObject finalizer r=tcampbell

Comment 4

[Iain Ireland [:iain]]

This took me an embarrassingly long time to replicate. Gary, can you add something about setting |ASAN_OPTIONS=detect_leaks=1| to the steps to replicate for LSAN bugs?

The patch is straightforward; we forgot to call the TranscodeBuffer's destructor in the XDRBufferObject finalizer before freeing it.

Comment 5

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/d6bd8269795a
Call delete_ instead of free_ in XDRBufferObject finalizer r=tcampbell

Comment 6

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

(In reply to Iain Ireland [:iain] from comment #4)

Gary, can you add something about setting |ASAN_OPTIONS=detect_leaks=1| to the steps to replicate for LSAN bugs?

Got it, I'll try to remember next time!

Comment 7

[Dorel Luca [:dluca]]

https://hg.mozilla.org/mozilla-central/rev/d6bd8269795a