1020584 - Intermittent font-features-turkish-override-4.html | Exited with code 1 during test run after "AddressSanitizer: heap-use-after-free ??:0 ??"

Status: RESOLVED WORKSFORME

(Core :: Networking: Cache, defect)

Description

[Ryan VanderMeulen [:RyanVM]]

Yay, another one with useless stacks.

https://tbpl.mozilla.org/php/getParsedLog.php?id=41045306&tree=Mozilla-Inbound

Ubuntu ASAN VM 12.04 x64 mozilla-inbound opt test reftest on 2014-06-04 10:25:50 PDT for push 8ee52188963c
slave: tst-linux64-spot-222

10:55:30     INFO -  REFTEST TEST-START | file:///builds/slave/test/build/tests/reftest/tests/layout/reftests/font-features/font-features-turkish-override-4.html
10:55:30     INFO -  REFTEST TEST-LOAD | http://localhost:52027/1401902950318/307/font-features/font-features-turkish-override-4.html | 5402 / 10983 (49%)
10:55:31     INFO -  REFTEST TEST-LOAD | http://localhost:52027/1401902950318/307/font-features/font-features-ref.html | 5402 / 10983 (49%)
10:55:31     INFO -  =================================================================
10:55:31     INFO -  ==1774==ERROR: AddressSanitizer: heap-use-after-free on address 0x60c0000634d0 at pc 0x7fe135896c50 bp 0x7fe120cf8ae0 sp 0x7fe120cf8ad8
10:55:31     INFO -  READ of size 8 at 0x60c0000634d0 thread T12 (Cache2 I/O)
10:55:31     INFO -      #0 0x7fe135896c4f (/builds/slave/test/build/application/firefox/libxul.so+0x1645c4f)
10:55:31     INFO -      #1 0x7fe1358c4d44 (/builds/slave/test/build/application/firefox/libxul.so+0x1673d44)
10:55:31     INFO -      #2 0x7fe135430f5c (/builds/slave/test/build/application/firefox/libxul.so+0x11dff5c)
10:55:31     INFO -      #3 0x7fe135919019 (/builds/slave/test/build/application/firefox/libxul.so+0x16c8019)
10:55:31     INFO -      #4 0x7fe13591870f (/builds/slave/test/build/application/firefox/libxul.so+0x16c770f)
10:55:31     INFO -      #5 0x7fe1359177e3 (/builds/slave/test/build/application/firefox/libxul.so+0x16c67e3)
10:55:31     INFO -      #6 0x7fe141ab1385 (/builds/slave/test/build/application/firefox/libnspr4.so+0x68385)
10:55:31     INFO -      #7 0x7fe144fcbe99 (/lib/x86_64-linux-gnu/libpthread.so.0+0x7e99)
10:55:31     INFO -      #8 0x7fe1440dcdbc (/lib/x86_64-linux-gnu/libc.so.6+0xf3dbc)
10:55:31     INFO -  0x60c0000634d0 is located 16 bytes inside of 120-byte region [0x60c0000634c0,0x60c000063538)
10:55:31     INFO -  freed by thread T0 here:
10:55:31     INFO -      #0 0x471b41 (/builds/slave/test/build/application/firefox/firefox+0x471b41)
10:55:31     INFO -      #1 0x7fe135896c40 (/builds/slave/test/build/application/firefox/libxul.so+0x1645c40)
10:55:31     INFO -      #2 0x7fe13589a650 (/builds/slave/test/build/application/firefox/libxul.so+0x1649650)
10:55:31     INFO -      #3 0x7fe135572215 (/builds/slave/test/build/application/firefox/libxul.so+0x1321215)
10:55:31     INFO -      #4 0x7fe13543217a (/builds/slave/test/build/application/firefox/libxul.so+0x11e117a)
10:55:31     INFO -  previously allocated by thread T12 (Cache2 I/O) here:
10:55:31     INFO -      #0 0x471d41 (/builds/slave/test/build/application/firefox/firefox+0x471d41)
10:55:31     INFO -      #1 0x7fe140184bed (/builds/slave/test/build/application/firefox/libmozalloc.so+0x1bed)
10:55:31     INFO -      #2 0x7fe135891493 (/builds/slave/test/build/application/firefox/libxul.so+0x1640493)
10:55:31     INFO -      #3 0x7fe1358cf303 (/builds/slave/test/build/application/firefox/libxul.so+0x167e303)
10:55:31     INFO -      #4 0x7fe1358ceb09 (/builds/slave/test/build/application/firefox/libxul.so+0x167db09)
10:55:31     INFO -  Thread T12 (Cache2 I/O) created by T0 here:
10:55:31     INFO -      #0 0x45e5b5 (/builds/slave/test/build/application/firefox/firefox+0x45e5b5)
10:55:31     INFO -      #1 0x7fe141aadd0d (/builds/slave/test/build/application/firefox/libnspr4.so+0x64d0d)
10:55:31     INFO -      #2 0x7fe141aad88a (/builds/slave/test/build/application/firefox/libnspr4.so+0x6488a)
10:55:31     INFO -      #3 0x7fe135917786 (/builds/slave/test/build/application/firefox/libxul.so+0x16c6786)
10:55:31     INFO -      #4 0x7fe1358a9fdf (/builds/slave/test/build/application/firefox/libxul.so+0x1658fdf)
10:55:31     INFO -      #5 0x7fe1358a9e97 (/builds/slave/test/build/application/firefox/libxul.so+0x1658e97)
10:55:31     INFO -      #6 0x7fe13591a6d1 (/builds/slave/test/build/application/firefox/libxul.so+0x16c96d1)
10:55:31     INFO -      #7 0x7fe1354d3069 (/builds/slave/test/build/application/firefox/libxul.so+0x1282069)
10:55:31     INFO -      #8 0x7fe13ae7c725 (/builds/slave/test/build/application/firefox/libxul.so+0x6c2b725)
10:55:31     INFO -      #9 0x7fe13ae5d71f (/builds/slave/test/build/application/firefox/libxul.so+0x6c0c71f)
10:55:31     INFO -      #10 0x7fe13ae5f123 (/builds/slave/test/build/application/firefox/libxul.so+0x6c0e123)
10:55:31     INFO -      #11 0x7fe13ae5ff6d (/builds/slave/test/build/application/firefox/libxul.so+0x6c0ef6d)
10:55:31     INFO -      #12 0x48a2c7 (/builds/slave/test/build/application/firefox/firefox+0x48a2c7)
10:55:31     INFO -      #13 0x7fe14400a76c (/lib/x86_64-linux-gnu/libc.so.6+0x2176c)
10:55:31     INFO -  SUMMARY: AddressSanitizer: heap-use-after-free ??:0 ??
10:55:31     INFO -  Shadow bytes around the buggy address:
10:55:31     INFO -    0x0c1880004640: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
10:55:31     INFO -    0x0c1880004650: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
10:55:31     INFO -    0x0c1880004660: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00
10:55:31     INFO -    0x0c1880004670: 00 00 00 00 00 00 00 00 fa fa fa fa fa fa fa fa
10:55:31     INFO -    0x0c1880004680: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
10:55:31     INFO -  =>0x0c1880004690: fa fa fa fa fa fa fa fa fd fd[fd]fd fd fd fd fd
10:55:31     INFO -    0x0c18800046a0: fd fd fd fd fd fd fd fa fa fa fa fa fa fa fa fa
10:55:31     INFO -    0x0c18800046b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
10:55:31     INFO -    0x0c18800046c0: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00
10:55:31     INFO -    0x0c18800046d0: 00 00 00 00 00 00 00 00 fa fa fa fa fa fa fa fa
10:55:31     INFO -    0x0c18800046e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
10:55:31     INFO -  Shadow byte legend (one shadow byte represents 8 application bytes):
10:55:31     INFO -    Addressable:           00
10:55:31     INFO -    Partially addressable: 01 02 03 04 05 06 07
10:55:31     INFO -    Heap left redzone:       fa
10:55:31     INFO -    Heap right redzone:      fb
10:55:31     INFO -    Freed heap region:       fd
10:55:31     INFO -    Stack left redzone:      f1
10:55:31     INFO -    Stack mid redzone:       f2
10:55:31     INFO -    Stack right redzone:     f3
10:55:31     INFO -    Stack partial redzone:   f4
10:55:31     INFO -    Stack after return:      f5
10:55:31     INFO -    Stack use after scope:   f8
10:55:31     INFO -    Global redzone:          f9
10:55:31     INFO -    Global init order:       f6
10:55:31     INFO -    Poisoned by user:        f7
10:55:31     INFO -    Contiguous container OOB:fc
10:55:31     INFO -    ASan internal:           fe
10:55:31     INFO -  ==1774==ABORTING
10:55:31     INFO -  [1844] ###!!! ABORT: Aborting on channel error.: file /builds/slave/m-in-l64-asan-0000000000000000/build/ipc/glue/MessageChannel.cpp, line 1532
10:55:31     INFO -  [1844] ###!!! ABORT: Aborting on channel error.: file /builds/slave/m-in-l64-asan-0000000000000000/build/ipc/glue/MessageChannel.cpp, line 1532
10:55:31     INFO -  ASAN:SIGSEGV
10:55:31     INFO -  =================================================================
10:55:31     INFO -  ==1844==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x7f02a62860ae sp 0x7f0299406ce0 bp 0x7f0299406cf0 T1)
10:55:32     INFO -      #0 0x7f02a62860ad (/builds/slave/test/build/application/firefox/libmozalloc.so+0x20ad)
10:55:32     INFO -      #1 0x7f02a76a6b85 (/builds/slave/test/build/application/firefox/libxul.so+0x121fb85)
10:55:32     INFO -      #2 0x7f02a76a684a (/builds/slave/test/build/application/firefox/libxul.so+0x121f84a)
10:55:32     INFO -      #3 0x7f02a7fb074e (/builds/slave/test/build/application/firefox/libxul.so+0x1b2974e)
10:55:32     INFO -      #4 0x7f02a7fb46c8 (/builds/slave/test/build/application/firefox/libxul.so+0x1b2d6c8)
10:55:32     INFO -      #5 0x7f02a7f44777 (/builds/slave/test/build/application/firefox/libxul.so+0x1abd777)
10:55:32     INFO -      #6 0x7f02a7f1fd3d (/builds/slave/test/build/application/firefox/libxul.so+0x1a98d3d)
10:55:32     INFO -      #7 0x7f02a7f3260c (/builds/slave/test/build/application/firefox/libxul.so+0x1aab60c)
10:55:32     INFO -      #8 0x7f02a7f5ecd0 (/builds/slave/test/build/application/firefox/libxul.so+0x1ad7cd0)
10:55:32     INFO -      #9 0x7f02a7f771d9 (/builds/slave/test/build/application/firefox/libxul.so+0x1af01d9)
10:55:32     INFO -      #10 0x7f02a7f3372c (/builds/slave/test/build/application/firefox/libxul.so+0x1aac72c)
10:55:32     INFO -      #11 0x7f02b23c0e99 (/lib/x86_64-linux-gnu/libpthread.so.0+0x7e99)
10:55:32     INFO -      #12 0x7f02a4cfddbc (/lib/x86_64-linux-gnu/libc.so.6+0xf3dbc)
10:55:32     INFO -  AddressSanitizer can not provide additional info.
10:55:32     INFO -  SUMMARY: AddressSanitizer: SEGV ??:0 ??
10:55:32     INFO -  Thread T1 (Chrome_ChildThr) created by T0 here:
10:55:32     INFO -      #0 0x45d345 (/builds/slave/test/build/application/firefox/plugin-container+0x45d345)
10:55:32     INFO -      #1 0x7f02a7f3368e (/builds/slave/test/build/application/firefox/libxul.so+0x1aac68e)
10:55:32     INFO -      #2 0x7f02a7f76e0e (/builds/slave/test/build/application/firefox/libxul.so+0x1aefe0e)
10:55:32     INFO -      #3 0x7f02a7fb615b (/builds/slave/test/build/application/firefox/libxul.so+0x1b2f15b)
10:55:32     INFO -      #4 0x7f02ad09a4e0 (/builds/slave/test/build/application/firefox/libxul.so+0x6c134e0)
10:55:32     INFO -      #5 0x488631 (/builds/slave/test/build/application/firefox/plugin-container+0x488631)
10:55:32     INFO -      #6 0x7f02a4c2b76c (/lib/x86_64-linux-gnu/libc.so.6+0x2176c)
10:55:32     INFO -  ==1844==ABORTING
10:55:32     INFO -  TEST-INFO | Main app process: killed by SIGHUP
10:55:32  WARNING -  TEST-UNEXPECTED-FAIL | file:///builds/slave/test/build/tests/reftest/tests/layout/reftests/font-features/font-features-turkish-override-4.html | Exited with code 1 during test run
10:55:32     INFO -  INFO | automation.py | Application ran for: 0:26:29.210363
10:55:32     INFO -  INFO | zombiecheck | Reading PID log: /tmp/tmpmiqH_npidlog
10:55:32     INFO -  ==> process 1774 launched child process 1844
10:55:32     INFO -  INFO | zombiecheck | Checking for orphan process with PID: 1844
10:55:32     INFO -  WARNING | leakcheck | refcount logging is off, so leaks can't be detected!
10:55:32     INFO -  REFTEST INFO | runreftest.py | Running tests: end.
10:55:32    ERROR - Return code: 1

Comment 1

[Christian Holler (:decoder)]

Attachment: Manually symbolized trace

Here's the manually symbolized trace, hope that helps until we fix the symbolizer bug.

Comment 2

[Ryan VanderMeulen [:RyanVM]]

Stack looks similar to bug 1019934, so that's good anyway.