795855 - Mismatched delete vs malloc in SkBitmap::freePixels

Status: RESOLVED WONTFIX

(Core :: Graphics, defect)

Description

[Julian Seward [:jseward]]

x86-64 linux, running on 16 bit deep VNC server.

STR: go to www.wetter.de.  Wait for the colour-coded map of Germany to
be displayed.  The error below is reported exactly at that point.

Thread 26:
Mismatched free() / delete / delete []
   at 0x402A3C4: operator delete(void*) (/home/sewardj/Vg38BRANCH/branch38/coregrind/m_replacemalloc/vg_replace_malloc.c:480)
   by 0x73FFC5E: SkBitmap::freePixels() (gfx/skia/include/core/SkRefCnt.h:66)
   by 0x72D5419: mozilla::gfx::Scale(unsigned char*, int, int, int, unsigned char*, int, int, int, mozilla::gfx::SurfaceFormat) (gfx/2d/Scale.cpp:47)
   by 0x62639FA: mozilla::image::RasterImage::ScaleWorker::Run() (image/src/RasterImage.cpp:75)
   by 0x6F961DA: nsThread::ProcessNextEvent(bool, bool*) (xpcom/threads/nsThread.cpp:612)
   by 0x6F5F1C9: NS_ProcessNextEvent_P(nsIThread*, bool) (ff-opt/xpcom/build/nsThreadUtils.cpp:220)
   by 0x6F96CEC: nsThread::ThreadFunc(void*) (xpcom/threads/nsThread.cpp:256)
   by 0x41A9F82: _pt_root (nsprpub/pr/src/pthreads/ptthread.c:156)
   by 0x4A289C9: start_thread (/build/buildd/eglibc-2.11.1/nptl/pthread_create.c:300)
   by 0x51ACCDC: clone (/build/buildd/eglibc-2.11.1/misc/../sysdeps/unix/sysv/linux/x86_64/clone.S:112)

 Address 0x294fb110 is 0 bytes inside a block of size 96 alloc'd
   at 0x402ADDC: malloc (/home/sewardj/Vg38BRANCH/branch38/coregrind/m_replacemalloc/vg_replace_malloc.c:270)
   by 0x403EFEB: moz_xmalloc (memory/mozalloc/mozalloc.cpp:57)
   by 0x73FFE3B: SkBitmap::setPixels(void*, SkColorTable*) (ff-opt/gfx/skia/../../dist/include/mozilla/mozalloc.h:200)
   by 0x72DDAD7: skia::ImageOperations::ResizeBasic(SkBitmap const&, skia::ImageOperations::ResizeMethod, int, int, SkIRect const&, void*) (gfx/2d/image_operations.cpp:506)
   by 0x72DE0E4: skia::ImageOperations::Resize(SkBitmap const&, skia::ImageOperations::ResizeMethod, int, int, SkIRect const&, void*) (gfx/2d/image_operations.cpp:354)
   by 0x72DE137: skia::ImageOperations::Resize(SkBitmap const&, skia::ImageOperations::ResizeMethod, int, int, void*) (gfx/2d/image_operations.cpp:533)
   by 0x72D53F0: mozilla::gfx::Scale(unsigned char*, int, int, int, unsigned char*, int, int, int, mozilla::gfx::SurfaceFormat) (gfx/2d/Scale.cpp:45)
   by 0x62639FA: mozilla::image::RasterImage::ScaleWorker::Run() (image/src/RasterImage.cpp:75)
   by 0x6F961DA: nsThread::ProcessNextEvent(bool, bool*) (xpcom/threads/nsThread.cpp:612)
   by 0x6F5F1C9: NS_ProcessNextEvent_P(nsIThread*, bool) (ff-opt/xpcom/build/nsThreadUtils.cpp:220)
   by 0x6F96CEC: nsThread::ThreadFunc(void*) (xpcom/threads/nsThread.cpp:256)
   by 0x41A9F82: _pt_root (nsprpub/pr/src/pthreads/ptthread.c:156)

Comment 1

[Joe Drew (not getting mail)]

George, can you take this since it'll need to be upstreamed anyhows?

Comment 2

[George Wright (:gw280) (needinfo me!)]

Will do.

Comment 3

[Milan Sreckovic [:milan] (needinfo for best results)]

Is this taken care of in the upstreaming we're discussing now?

Comment 4

[George Wright (:gw280) (needinfo me!)]

So I don't think this is still an issue, but just to be sure I'm modifying our moz.build generator script for Skia to always use SkMemory_mozalloc, which should fix all of these mismatches going forward. The relevant source files have already been upstreamed, so that isn't an issue.

Comment 5

[Milan Sreckovic [:milan] (needinfo for best results)]

So... resolved?

Comment 6

[George Wright (:gw280) (needinfo me!)]

I believe so, but we'll need to verify it.

Comment 7

[Milan Sreckovic [:milan] (needinfo for best results)]

Julian, does it still happen for you?

Comment 8

[Julian Seward [:jseward]]

Yes I can reproduce it, but I think this is unlikely to be a real
problem.  I think we should close this.