Closed Bug 626068 Opened 15 years ago Closed 14 years ago

Mismatched free() / delete / delete [] @ mozilla::layers::LayerProgram::~LayerProgram() (LayerManagerOGLProgram.h:395) during startup

Categories

(Core :: Graphics, defect)

Product:
Core
Component:
Graphics
Platform:
x86
macOS
Type:
defect
Priority:
Not set
Severity:
normal

Tracking

()

Status:
RESOLVED FIXED

People

(Reporter: bc, Unassigned)

Details

(Keywords: valgrind, Whiteboard: [sg:nse][Apple bug])

Testing cross fuzz on Mac with valgrind I saw this 4 times during startup before the cross fuzz page loaded. I haven't tried to reproduce yet. This was with a build from 2011-01-14 ==66122== Mismatched free() / delete / delete [] ==66122== at 0x17712: operator delete(void*) (vg_replace_malloc.c:387) ==66122== by 0xCBC63D0: BindingTable::~BindingTable() (in /System/Library/Frameworks/OpenGL.framework/Versions/A/Libraries/libGLProgrammability.dylib) ==66122== by 0xCBCB28E: TGenericLinker::~TGenericLinker() (in /System/Library/Frameworks/OpenGL.framework/Versions/A/Libraries/libGLProgrammability.dylib) ==66122== by 0xCB84B0B: ShDestruct (in /System/Library/Frameworks/OpenGL.framework/Versions/A/Libraries/libGLProgrammability.dylib) ==66122== by 0x259E0286: gleFreeProgramObject (in /System/Library/Frameworks/OpenGL.framework/Versions/A/Resources/GLEngine.bundle/GLEngine) ==66122== by 0x258E6B6E: gleDeleteHashNameAndObject (in /System/Library/Frameworks/OpenGL.framework/Versions/A/Resources/GLEngine.bundle/GLEngine) ==66122== by 0x2594317D: glDeleteObjectARB_Exec (in /System/Library/Frameworks/OpenGL.framework/Versions/A/Resources/GLEngine.bundle/GLEngine) ==66122== by 0xC98187D: glDeleteProgram (in /System/Library/Frameworks/OpenGL.framework/Versions/A/Libraries/libGL.dylib) ==66122== by 0x52CB8DA: mozilla::gl::GLContext::fDeleteProgram(unsigned int) (GLContext.h:1958) ==66122== by 0x64BD6EB: mozilla::layers::LayerManagerOGLProgram::~LayerManagerOGLProgram() (LayerManagerOGLProgram.h:136) ==66122== by 0x64BD8FD: mozilla::layers::LayerProgram::~LayerProgram() (LayerManagerOGLProgram.h:395) ==66122== by 0x64BDAA1: mozilla::layers::ColorTextureLayerProgram::~ColorTextureLayerProgram() (LayerManagerOGLProgram.h:507) ==66122== Address 0x227dc980 is 0 bytes inside a block of size 512 alloc'd ==66122== at 0x16EC5: operator new[](unsigned long) (vg_replace_malloc.c:305) ==66122== by 0xCBC6680: BindingTable::BindingTable(unsigned int) (in /System/Library/Frameworks/OpenGL.framework/Versions/A/Libraries/libGLProgrammability.dylib) ==66122== by 0xCBCB47E: TGenericLinker::TGenericLinker(int) (in /System/Library/Frameworks/OpenGL.framework/Versions/A/Libraries/libGLProgrammability.dylib) ==66122== by 0xCBCB593: ConstructLinker(int) (in /System/Library/Frameworks/OpenGL.framework/Versions/A/Libraries/libGLProgrammability.dylib) ==66122== by 0x259DFCC4: gleCreateProgramObject (in /System/Library/Frameworks/OpenGL.framework/Versions/A/Resources/GLEngine.bundle/GLEngine) ==66122== by 0x25942FE4: glCreateProgramObjectARB_Exec (in /System/Library/Frameworks/OpenGL.framework/Versions/A/Resources/GLEngine.bundle/GLEngine) ==66122== by 0xC9817E6: glCreateProgram (in /System/Library/Frameworks/OpenGL.framework/Versions/A/Libraries/libGL.dylib) ==66122== by 0x52F13D0: mozilla::gl::GLContext::fCreateProgram() (GLContext.h:1914) ==66122== by 0x64BCA66: mozilla::layers::LayerManagerOGLProgram::CreateProgram(char const*, char const*) (LayerManagerOGLProgram.h:277) ==66122== by 0x64BCF9D: mozilla::layers::LayerProgram::Initialize(char const*, char const*) (LayerManagerOGLProgram.h:418) ==66122== by 0x64BD0B0: mozilla::layers::ColorTextureLayerProgram::Initialize(char const*, char const*) (LayerManagerOGLProgram.h:526) ==66122== by 0x64B7DE5: mozilla::layers::LayerManagerOGL::Initialize(mozilla::gl::GLContext*) (LayerManagerOGL.cpp:233) Adding configure options from /work/mozilla/builds/hg.mozilla.org/sisyphus/mozconfig/2.0.0/mozconfig-firefox-darwin-intel32-debug: --with-macos-sdk=/Developer/SDKs/MacOSX10.5.sdk --enable-application=browser --enable-debug --disable-optimize --enable-debug-symbols=-gdwarf-2 --enable-libxul --disable-install-strip --enable-tests --enable-logrefcnt --with-valgrind=yes --enable-valgrind=yes --enable-accessibility --disable-installer --enable-official-branding
fyi, this was reproducible on a fresh start loading a blank home page. The command used was: valgrind --dsymutil=yes --tool=memcheck --smc-check=all --trace-children=yes --track-origins=yes ... Found extension GL_ARB_texture_non_power_of_two Found extension GL_ARB_pixel_buffer_object Found extension GL_EXT_framebuffer_object Found extension GL_ARB_texture_rectangle Found extension GL_EXT_bgra OpenGL vendor ('NVIDIA Corporation') recognized as: NVIDIA
Looks like a bug inside mac system libraries (and a potential memory leak too, if the thing its calling delete instead of delete[] on has destructors).
Who wants to file a Radar ticket? Or maybe clegnitto knows the best person to email directly about the issue.
Allocator mismatches are usually not security holes.
Whiteboard: [sg:nse][Apple bug]
Filed Apple bug 11002645 about this.
I don't think this needs to remain security-sensitive.
Group: core-security
Apple believes this bug was fixed in Mac OS X 10.7.3.
Status: NEW → RESOLVED
Closed: 14 years ago
Resolution: --- → FIXED
What about 10.6 -- unaffected, affected, fixed?
No word from Apple on 10.6, the note I got only said they believed it was fixed in 10.7.
If we still support 10.6, and we don't know if it's fixed, I wouldn't think we should mark this Fixed.
We're unlikely to work around this, except by adding 10.6-specific Valgrind suppressions. It's Apple's bug and it's fixed on their current release. So FIXED seems appropriate to me.
Definitely not reproducible on 10.7.3. I can check a 10.6 machine during some idle time tomorrow.
You need to log in before you can comment on or make changes to this bug.