Closed Bug 1629207 Opened 5 years ago Closed 5 years ago

Intermittent GECKO(5528) | SUMMARY: AddressSanitizer: heap-use-after-free /builds/worker/fetches/clang/bin/../lib/gcc/x86_64-unknown-linux-gnu/7.4.0/../../../../include/c++/7.4.0/bits/atomic_base.h:514:16 in fetch_add

Categories

(Core :: Layout, defect, P5)

Product:
Core
Component:
Layout
Type:
defect

Tracking

()

Status:
RESOLVED DUPLICATE of bug 1628120

People

(Reporter: intermittent-bug-filer, Unassigned)

Details

(Keywords: intermittent-failure)

Filed by: nerli [at] mozilla.com
Parsed log: https://treeherder.mozilla.org/logviewer.html#?job_id=297198186&repo=autoland
Full log: https://firefox-ci-tc.services.mozilla.com/api/queue/v1/task/Dt4ok_NOQlONQG6h6WNKkQ/runs/0/artifacts/public/logs/live_backing.log

[task 2020-04-11T00:04:32.618Z] 00:04:32 INFO - TEST-START | toolkit/content/tests/browser/browser_quickfind_editable.js
[task 2020-04-11T00:04:33.118Z] 00:04:33 INFO - GECKO(5528) | =================================================================
[task 2020-04-11T00:04:33.119Z] 00:04:33 ERROR - GECKO(5528) | ==5714==ERROR: AddressSanitizer: heap-use-after-free on address 0x60e000126660 at pc 0x7fad5a24f88a bp 0x7fad21fa03e0 sp 0x7fad21fa03d8
[task 2020-04-11T00:04:33.119Z] 00:04:33 INFO - GECKO(5528) | WRITE of size 8 at 0x60e000126660 thread T97 (MediaDe~hine #1)
[task 2020-04-11T00:04:33.886Z] 00:04:33 INFO - GECKO(5528) | #0 0x7fad5a24f889 in fetch_add /builds/worker/fetches/clang/bin/../lib/gcc/x86_64-unknown-linux-gnu/7.4.0/../../../../include/c++/7.4.0/bits/atomic_base.h:514:16
[task 2020-04-11T00:04:33.886Z] 00:04:33 INFO - GECKO(5528) | #1 0x7fad5a24f889 in operator++ /builds/worker/workspace/obj-build/dist/include/nsISupportsImpl.h:331:19
[task 2020-04-11T00:04:33.886Z] 00:04:33 INFO - GECKO(5528) | #2 0x7fad5a24f889 in AddRef /builds/worker/workspace/obj-build/dist/include/mozilla/dom/DocGroup.h:41:3
[task 2020-04-11T00:04:33.887Z] 00:04:33 INFO - GECKO(5528) | #3 0x7fad5a24f889 in AddRef /builds/worker/workspace/obj-build/dist/include/mozilla/RefPtr.h:49:39
[task 2020-04-11T00:04:33.887Z] 00:04:33 INFO - GECKO(5528) | #4 0x7fad5a24f889 in AddRef /builds/worker/workspace/obj-build/dist/include/mozilla/RefPtr.h:380:35
[task 2020-04-11T00:04:33.887Z] 00:04:33 INFO - GECKO(5528) | #5 0x7fad5a24f889 in RefPtr /builds/worker/workspace/obj-build/dist/include/mozilla/RefPtr.h:109:7
[task 2020-04-11T00:04:33.887Z] 00:04:33 INFO - GECKO(5528) | #6 0x7fad5a24f889 in mozilla::SchedulerGroup::Runnable::Runnable(already_AddRefed<nsIRunnable>&&, mozilla::dom::DocGroup*) /builds/worker/checkouts/gecko/xpcom/threads/SchedulerGroup.cpp:120:7
[task 2020-04-11T00:04:33.887Z] 00:04:33 INFO - GECKO(5528) | #7 0x7fad5a24f191 in mozilla::SchedulerGroup::LabeledDispatch(mozilla::TaskCategory, already_AddRefed<nsIRunnable>&&, mozilla::dom::DocGroup*) /builds/worker/checkouts/gecko/xpcom/threads/SchedulerGroup.cpp:82:13
[task 2020-04-11T00:04:33.974Z] 00:04:33 INFO - GECKO(5528) | #8 0x7fad5d336945 in (anonymous namespace)::LabellingEventTarget::Dispatch(already_AddRefed<nsIRunnable>, unsigned int) /builds/worker/checkouts/gecko/dom/base/DocGroup.cpp:73:10
[task 2020-04-11T00:04:33.978Z] 00:04:33 INFO - GECKO(5528) | #9 0x7fad5a25768a in mozilla::EventTargetWrapper::Dispatch(already_AddRefed<nsIRunnable>, mozilla::AbstractThread::DispatchReason) /builds/worker/checkouts/gecko/xpcom/threads/AbstractThread.cpp:57:21
[task 2020-04-11T00:04:33.979Z] 00:04:33 INFO - GECKO(5528) | #10 0x7fad5a25a613 in mozilla::AutoTaskDispatcher::DispatchTaskGroup(mozilla::UniquePtr<mozilla::AutoTaskDispatcher::PerThreadTaskGroup, mozilla::DefaultDelete<mozilla::AutoTaskDispatcher::PerThreadTaskGroup> >) /builds/worker/workspace/obj-build/dist/include/mozilla/TaskDispatcher.h:245:20
[task 2020-04-11T00:04:33.980Z] 00:04:33 INFO - GECKO(5528) | #11 0x7fad5a259294 in mozilla::AutoTaskDispatcher::~AutoTaskDispatcher() /builds/worker/workspace/obj-build/dist/include/mozilla/TaskDispatcher.h:87:7
[task 2020-04-11T00:04:33.981Z] 00:04:33 INFO - GECKO(5528) | #12 0x7fad5a255142 in mozilla::TaskQueue::Runner::Run() /builds/worker/checkouts/gecko/xpcom/threads/TaskQueue.cpp:208:3
[task 2020-04-11T00:04:34.038Z] 00:04:34 INFO - GECKO(5528) | #13 0x7fad5a2970b0 in nsThreadPool::Run() /builds/worker/checkouts/gecko/xpcom/threads/nsThreadPool.cpp:300:14
[task 2020-04-11T00:04:34.040Z] 00:04:34 INFO - GECKO(5528) | #14 0x7fad5a297d8c in non-virtual thunk to nsThreadPool::Run() /builds/worker/checkouts/gecko/xpcom/threads/nsThreadPool.cpp
[task 2020-04-11T00:04:34.041Z] 00:04:34 INFO - GECKO(5528) | #15 0x7fad5a288628 in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/checkouts/gecko/xpcom/threads/nsThread.cpp:1200:14
[task 2020-04-11T00:04:34.041Z] 00:04:34 INFO - GECKO(5528) | #16 0x7fad5a29304c in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.cpp:481:10
[task 2020-04-11T00:04:34.057Z] 00:04:34 INFO - GECKO(5528) | #17 0x7fad5b303ff9 in mozilla::ipc::MessagePumpForNonMainThreads::Run(base::MessagePump::Delegate*) /builds/worker/checkouts/gecko/ipc/glue/MessagePump.cpp:302:20
[task 2020-04-11T00:04:34.073Z] 00:04:34 INFO - GECKO(5528) | #18 0x7fad5b22ce67 in RunInternal /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:315:10
[task 2020-04-11T00:04:34.073Z] 00:04:34 INFO - GECKO(5528) | #19 0x7fad5b22ce67 in RunHandler /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:308:3
[task 2020-04-11T00:04:34.074Z] 00:04:34 INFO - GECKO(5528) | #20 0x7fad5b22ce67 in MessageLoop::Run() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:290:3
[task 2020-04-11T00:04:34.075Z] 00:04:34 INFO - GECKO(5528) | #21 0x7fad5a28200a in nsThread::ThreadFunc(void*) /builds/worker/checkouts/gecko/xpcom/threads/nsThread.cpp:444:10
[task 2020-04-11T00:04:34.083Z] 00:04:34 INFO - GECKO(5528) | #22 0x7fad76dd8d2e in _pt_root /builds/worker/checkouts/gecko/nsprpub/pr/src/pthreads/ptthread.c:201:5
[task 2020-04-11T00:04:34.083Z] 00:04:34 INFO - GECKO(5528) | #23 0x7fad7abcd6da in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x76da)
[task 2020-04-11T00:04:34.282Z] 00:04:34 INFO - GECKO(5528) | #24 0x7fad79bab88e in clone /build/glibc-OTsEL5/glibc-2.27/misc/../sysdeps/unix/sysv/linux/x86_64/clone.S:95
[task 2020-04-11T00:04:34.282Z] 00:04:34 INFO - GECKO(5528) | 0x60e000126660 is located 0 bytes inside of 152-byte region [0x60e000126660,0x60e0001266f8)
[task 2020-04-11T00:04:34.282Z] 00:04:34 INFO - GECKO(5528) | freed by thread T0 (Web Content) here:
[task 2020-04-11T00:04:34.285Z] 00:04:34 INFO - GECKO(5528) | #0 0x55c77dc700dd in free /builds/worker/fetches/llvm-project/llvm/projects/compiler-rt/lib/asan/asan_malloc_linux.cc:123:3
[task 2020-04-11T00:04:34.288Z] 00:04:34 INFO - GECKO(5528) | #1 0x7fad5d24391b in operator delete /builds/worker/workspace/obj-build/dist/include/mozilla/cxxalloc.h:51:10
[task 2020-04-11T00:04:34.289Z] 00:04:34 INFO - GECKO(5528) | #2 0x7fad5d24391b in Release /builds/worker/workspace/obj-build/dist/include/mozilla/dom/DocGroup.h:41:3
[task 2020-04-11T00:04:34.290Z] 00:04:34 INFO - GECKO(5528) | #3 0x7fad5d24391b in Release /builds/worker/workspace/obj-build/dist/include/mozilla/RefPtr.h:50:40
[task 2020-04-11T00:04:34.293Z] 00:04:34 INFO - GECKO(5528) | #4 0x7fad5d24391b in Release /builds/worker/workspace/obj-build/dist/include/mozilla/RefPtr.h:381:36
[task 2020-04-11T00:04:34.293Z] 00:04:34 INFO - GECKO(5528) | #5 0x7fad5d24391b in ~RefPtr /builds/worker/workspace/obj-build/dist/include/mozilla/RefPtr.h:81:7
[task 2020-04-11T00:04:34.294Z] 00:04:34 INFO - GECKO(5528) | #6 0x7fad5d24391b in mozilla::dom::Document::~Document() /builds/worker/checkouts/gecko/dom/base/Document.cpp:2029:1
[task 2020-04-11T00:04:34.319Z] 00:04:34 INFO - GECKO(5528) | #7 0x7fad5f9a944d in ~nsHTMLDocument /builds/worker/checkouts/gecko/dom/html/nsHTMLDocument.cpp:136:33
[task 2020-04-11T00:04:34.320Z] 00:04:34 INFO - GECKO(5528) | #8 0x7fad5f9a944d in nsHTMLDocument::~nsHTMLDocument() /builds/worker/checkouts/gecko/dom/html/nsHTMLDocument.cpp:136:33
[task 2020-04-11T00:04:34.367Z] 00:04:34 INFO - GECKO(5528) | #9 0x7fad5a0e50c8 in SnowWhiteKiller::Visit(nsPurpleBuffer&, nsPurpleBufferEntry*) /builds/worker/checkouts/gecko/xpcom/base/nsCycleCollector.cpp:2455:9
[task 2020-04-11T00:04:34.367Z] 00:04:34 INFO - GECKO(5528) | #10 0x7fad5a0c3d86 in void nsPurpleBuffer::VisitEntries<SnowWhiteKiller>(SnowWhiteKiller&) /builds/worker/checkouts/gecko/xpcom/base/nsCycleCollector.cpp:942:23
[task 2020-04-11T00:04:34.367Z] 00:04:34 INFO - GECKO(5528) | #11 0x7fad5a0c4645 in nsCycleCollector::FreeSnowWhiteWithBudget(js::SliceBudget&) /builds/worker/checkouts/gecko/xpcom/base/nsCycleCollector.cpp:2620:14
[task 2020-04-11T00:04:34.425Z] 00:04:34 INFO - GECKO(5528) | #12 0x7fad5bc08fbc in AsyncFreeSnowWhite::Run() /builds/worker/checkouts/gecko/js/xpconnect/src/XPCJSRuntime.cpp:148:9
[task 2020-04-11T00:04:34.425Z] 00:04:34 INFO - GECKO(5528) | #13 0x7fad5a2a7a58 in IdleRunnableWrapper::Run() /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.cpp:326:22
[task 2020-04-11T00:04:34.425Z] 00:04:34 INFO - GECKO(5528) | #14 0x7fad5a288628 in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/checkouts/gecko/xpcom/threads/nsThread.cpp:1200:14
[task 2020-04-11T00:04:34.425Z] 00:04:34 INFO - GECKO(5528) | #15 0x7fad5a29304c in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.cpp:481:10
[task 2020-04-11T00:04:34.426Z] 00:04:34 INFO - GECKO(5528) | #16 0x7fad5b3030da in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) /builds/worker/checkouts/gecko/ipc/glue/MessagePump.cpp:87:21
[task 2020-04-11T00:04:34.426Z] 00:04:34 INFO - GECKO(5528) | #17 0x7fad5b22ce67 in RunInternal /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:315:10
[task 2020-04-11T00:04:34.429Z] 00:04:34 INFO - GECKO(5528) | #18 0x7fad5b22ce67 in RunHandler /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:308:3
[task 2020-04-11T00:04:34.430Z] 00:04:34 INFO - GECKO(5528) | #19 0x7fad5b22ce67 in MessageLoop::Run() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:290:3
[task 2020-04-11T00:04:34.434Z] 00:04:34 INFO - GECKO(5528) | #20 0x7fad612f2868 in nsBaseAppShell::Run() /builds/worker/checkouts/gecko/widget/nsBaseAppShell.cpp:137:27
[task 2020-04-11T00:04:34.438Z] 00:04:34 INFO - GECKO(5528) | #21 0x7fad64a7b766 in XRE_RunAppShell() /builds/worker/checkouts/gecko/toolkit/xre/nsEmbedFunctions.cpp:909:20
[task 2020-04-11T00:04:34.438Z] 00:04:34 INFO - GECKO(5528) | #22 0x7fad5b22ce67 in RunInternal /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:315:10
[task 2020-04-11T00:04:34.440Z] 00:04:34 INFO - GECKO(5528) | #23 0x7fad5b22ce67 in RunHandler /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:308:3
[task 2020-04-11T00:04:34.440Z] 00:04:34 INFO - GECKO(5528) | #24 0x7fad5b22ce67 in MessageLoop::Run() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:290:3
[task 2020-04-11T00:04:34.442Z] 00:04:34 INFO - GECKO(5528) | #25 0x7fad64a7ae21 in XRE_InitChildProcess(int, char**, XREChildData const*) /builds/worker/checkouts/gecko/toolkit/xre/nsEmbedFunctions.cpp:740:34

Flags: needinfo?(afarre)
Status: NEW → RESOLVED
Closed: 5 years ago
Flags: needinfo?(afarre)
Resolution: --- → DUPLICATE
Group: core-security
Group: core-security → dom-core-security
Group: dom-core-security
You need to log in before you can comment on or make changes to this bug.