814851 - Mismatched free() / delete / delete [] in SkMallocPixelRef::~SkMallocPixelRef()

Status: NEW

(Core :: Graphics, defect)

Description

[ISHIKAWA, Chiaki]

Found from valgrind run of "make mozmill" of TB 

under 32 bit Debian GNU/Linux.



TEST-START | /TB-NEW/TB-3HG/new-src/mail/test/mozmill/content-tabs/test-plugin-blocked.js | test_blocklisted_plugin_notification
Step Pass: {"function": "controller.click()"}
==23172== Thread 22:
==23172== Mismatched free() / delete / delete []
==23172==    at 0x4025D7A: operator delete(void*) (vg_replace_malloc.c:480)
==23172==    by 0x646B721: SkMallocPixelRef::~SkMallocPixelRef() (SkMallocPixelRef.cpp:32)
==23172==    by 0x141BDD7F: ???
==23172==  Address 0x141bdd80 is 0 bytes inside a block of size 52 alloc'd
==23172==    at 0x40271C4: malloc (vg_replace_malloc.c:270)
==23172==    by 0x4982E10: moz_xmalloc (mozalloc.cpp:54)
==23172==    by 0x6434196: SkBitmap::setPixels(void*, SkColorTable*) (mozalloc.h:200)
==23172==    by 0x642BD54: skia::ImageOperations::ResizeBasic(SkBitmap const&, skia::ImageOperations::ResizeMethod, int, int, SkIRect const&, void*) (image_operations.cpp:506)
==23172==
{
   <insert_a_suppression_name_here>
   Memcheck:Free
   fun:_ZdlPv
   fun:_ZN16SkMallocPixelRefD0Ev
   obj:*
}
==23172== Mismatched free() / delete / delete []
==23172==    at 0x4025D7A: operator delete(void*) (vg_replace_malloc.c:480)
==23172==    by 0x646B721: SkMallocPixelRef::~SkMallocPixelRef() (SkMallocPixelRef.cpp:32)
==23172==  Address 0x13f4e670 is 0 bytes inside a block of size 52 alloc'd
==23172==    at 0x40271C4: malloc (vg_replace_malloc.c:270)
==23172==    by 0x4982E10: moz_xmalloc (mozalloc.cpp:54)
==23172==    by 0x6434196: SkBitmap::setPixels(void*, SkColorTable*) (mozalloc.h:200)
==23172==    by 0x6422C6D: mozilla::gfx::Scale(unsigned char*, int, int, int, unsigned char*, int, int, int, mozilla::gfx::SurfaceFormat) (Scale.cpp:32)
==23172==    by 0x426723D: clone (clone.S:130)
==23172==
{
   <insert_a_suppression_name_here>
   Memcheck:Free
   fun:_ZdlPv
   fun:_ZN16SkMallocPixelRefD0Ev
}
Test Failure: Timeout waiting for alert

For details of running "make mozmill" test of TB under valgrind, please
see Bug 803816 - Valgrind warnings about uninitialised memory use (Thunderbird)

The full log in which the bug was found is in
https://bugzilla.mozilla.org/attachment.cgi?id=684438

TIA

Comment 1

[:aceman]

Looks like that code is in skia?

Comment 2

[ISHIKAWA, Chiaki]

(In reply to :aceman from comment #1)
> Looks like that code is in skia?

I did not know what skia was, and checked.

Yes, it seems that the file in question is 
the following file in comm-central :
mozilla/gfx/skia/src/core/SkMallocPixelRef.cpp

Comment 3

[:aceman]

Yes, I've already moved the bug to a better component.