511191 - Crash on exit when enabling reflow logging

Status: NEW

(Core :: Layout, defect, P5)

Description

[Mats Palmgren (inactive)]

Attachment: stack

Crash on exit when enabling reflow logging.

STEPS TO REPRODUCE
0. prepare the environment, in bash:
     echo '* 1' > /tmp/reflow_rules.txt
     export GECKO_DISPLAY_REFLOW_RULES_FILE=/tmp/reflow_rules.txt
1. start Firefox
2. File->Quit

ACTUAL RESULTS
*** glibc detected *** firefox-bin: double free or corruption (!prev): 0x0000000001d37410 ***

See attached stack for details.

Comment 1

[Mats Palmgren (inactive)]

Attachment: valgrind output

Comment 2

[Wayne Mery (:wsmwk)]

Does this still reproduce?

Comment 3

[Mats Palmgren (inactive)]

Attachment: ASAN stacks

I can still reproduce this, now with an ASAN build.

Comment 4

[Andrei Purice]

Hey Mats,
Can you still reproduce this?

Comment 5

[Mats Palmgren (inactive)]

Yes, I get this in an ASAN debug build:

==13114==ERROR: AddressSanitizer: attempting double-free on 0x60300085af80 in thread T0:
    #0 0x5654d455c18d in __interceptor_free /builds/worker/fetches/llvm-project/llvm/projects/compiler-rt/lib/asan/asan_malloc_linux.cpp:123:3
    #1 0x7efc1d325190 in operator delete(void*) dist/include/mozilla/cxxalloc.h:51:10
    #2 0x7efc1d325190 in DR_State::~DR_State() layout/generic/nsIFrame.cpp:11738:5
    #3 0x7efc1d329729 in nsIFrame::DisplayReflowShutdown() layout/generic/nsIFrame.cpp:12351:3
    #4 0x7efc1dc47c06 in nsLayoutStatics::Shutdown() layout/build/nsLayoutStatics.cpp:327:3
    #5 0x7efc1dc47af3 in nsLayoutStatics::Release() layout/build/nsLayoutStatics.h:44:31
    #6 0x7efc1dc47af3 in Shutdown() layout/build/nsLayoutModule.cpp:119:3
    #7 0x7efc1dc47af3 in nsLayoutModuleDtor() layout/build/nsLayoutModule.cpp:253:3
...