New issue
Advanced search Search tips

Issue 592880 link

Starred by 2 users

Issue metadata

Status: Assigned
Owner:
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: ----
Pri: 2
Type: Bug

Blocked on:
issue 593269



Sign in to add a comment

HTMLTextFormControlElementTest.WordAndSentenceBoundary failing under Mac ASAN.

Project Member Reported by benwells@chromium.org, Mar 8 2016

Issue description

See https://build.chromium.org/p/chromium.memory/builders/Mac%20ASan%2064%20Tests%20%281%29/builds/12913 for example.

Sample output:
==1293==ERROR: AddressSanitizer: heap-use-after-free on address 0x62a000001c50 at pc 0x000109370ff4 bp 0x7fff5ac38cd0 sp 0x7fff5ac38cc8
READ of size 8 at 0x62a000001c50 thread T0
    #0 0x109370ff3 in v8::HandleScope::Initialize(v8::Isolate*) (in webkit_unit_tests) + 787
    #1 0x10cbb896b in blink::ScriptPromisePropertyBase::clearWrappers() (in webkit_unit_tests) + 235
    #2 0x10cbb86f2 in blink::ScriptPromisePropertyBase::~ScriptPromisePropertyBase() (in webkit_unit_tests) + 66
    #3 0x107b543e0 in blink::NormalPage::sweep() (in webkit_unit_tests) + 464
    #4 0x107b4fe21 in blink::BaseArena::completeSweep() (in webkit_unit_tests) + 385
    #5 0x107b5aece in blink::ThreadState::completeSweep() (in webkit_unit_tests) + 814
    #6 0x107b4abab in blink::Heap::collectGarbage(blink::BlinkGC::StackState, blink::BlinkGC::GCType, blink::BlinkGC::GCReason) (in webkit_unit_tests) + 2971
    #7 0x107b4cae0 in blink::Heap::collectAllGarbage() (in webkit_unit_tests) + 32
    #8 0x107b6afc3 in blink::ThreadState::enterSafePoint(blink::BlinkGC::StackState, void*) (in webkit_unit_tests) + 131
    #9 0x107b6c71e in blink::SafePointAwareMutexLocker::SafePointAwareMutexLocker(WTF::MutexBase&, blink::BlinkGC::StackState) (in webkit_unit_tests) + 270
    #10 0x107b5a93c in blink::ThreadState::detachMainThread() (in webkit_unit_tests) + 252
    #11 0x10a809ea2 in blink::shutdownWithoutV8() (in webkit_unit_tests) + 514
    #12 0x10769cfda in content::TestBlinkWebUnitTestSupport::~TestBlinkWebUnitTestSupport() (in webkit_unit_tests) + 362
    #13 0x10769d23d in content::TestBlinkWebUnitTestSupport::~TestBlinkWebUnitTestSupport() (in webkit_unit_tests) + 13
    #14 0x1076960a1 in content::TearDownBlinkTestEnvironment() (in webkit_unit_tests) + 401
    #15 0x104fc8c20 in (anonymous namespace)::runHelper(base::TestSuite*) (in webkit_unit_tests) + 512
    #16 0x1075ac51d in base::(anonymous namespace)::LaunchUnitTestsInternal(base::Callback\u003Cint ()> const&, int, int, bool, base::Callback\u003Cvoid ()> const&) (in webkit_unit_tests) + 685
    #17 0x1075ac1b0 in base::LaunchUnitTests(int, char**, base::Callback\u003Cint ()> const&) (in webkit_unit_tests) + 480
    #18 0x104fc8967 in main (in webkit_unit_tests) + 423
    #19 0x104fc87b3 in start (in webkit_unit_tests) + 51
    #20 0x7  (\u003Cunknown module>)

0x62a000001c50 is located 6736 bytes inside of 22608-byte region [0x62a000000200,0x62a000005a50)
freed by thread T0 here:
    #0 0x10fa8924b in 0x0005524b (in libclang_rt.asan_osx_dynamic.dylib) + 155
    #1 0x109e7b5bf in v8::internal::Isolate::TearDown() (in webkit_unit_tests) + 479
    #2 0x10d3eff52 in gin::IsolateHolder::~IsolateHolder() (in webkit_unit_tests) + 290
    #3 0x10cc4c88b in blink::V8PerIsolateData::~V8PerIsolateData() (in webkit_unit_tests) + 811
    #4 0x10cc4d469 in blink::V8PerIsolateData::destroy(v8::Isolate*) (in webkit_unit_tests) + 617
    #5 0x10a809c57 in blink::shutdown() (in webkit_unit_tests) + 343
    #6 0x10769cfda in content::TestBlinkWebUnitTestSupport::~TestBlinkWebUnitTestSupport() (in webkit_unit_tests) + 362
    #7 0x10769d23d in content::TestBlinkWebUnitTestSupport::~TestBlinkWebUnitTestSupport() (in webkit_unit_tests) + 13
    #8 0x1076960a1 in content::TearDownBlinkTestEnvironment() (in webkit_unit_tests) + 401
    #9 0x104fc8c20 in (anonymous namespace)::runHelper(base::TestSuite*) (in webkit_unit_tests) + 512
    #10 0x1075ac51d in base::(anonymous namespace)::LaunchUnitTestsInternal(base::Callback\u003Cint ()> const&, int, int, bool, base::Callback\u003Cvoid ()> const&) (in webkit_unit_tests) + 685
    #11 0x1075ac1b0 in base::LaunchUnitTests(int, char**, base::Callback\u003Cint ()> const&) (in webkit_unit_tests) + 480
    #12 0x104fc8967 in main (in webkit_unit_tests) + 423
    #13 0x104fc87b3 in start (in webkit_unit_tests) + 51
    #14 0x7  (\u003Cunknown module>)

previously allocated by thread T0 here:
    #0 0x10fa88c8b in 0x00054c8b (in libclang_rt.asan_osx_dynamic.dylib) + 155
    #1 0x1093c5007 in v8::Isolate::New(v8::Isolate::CreateParams const&) (in webkit_unit_tests) + 39
    #2 0x10d3efc09 in gin::IsolateHolder::IsolateHolder(gin::IsolateHolder::AccessMode) (in webkit_unit_tests) + 537
    #3 0x10cc4be7f in blink::V8PerIsolateData::V8PerIsolateData() (in webkit_unit_tests) + 47
    #4 0x10cc4cc6a in blink::V8PerIsolateData::initialize() (in webkit_unit_tests) + 42
    #5 0x10cc2d27e in blink::V8Initializer::initializeMainThreadIfNeeded() (in webkit_unit_tests) + 286
    #6 0x10a80918f in blink::initialize(blink::Platform*) (in webkit_unit_tests) + 175
    #7 0x10769ca35 in content::TestBlinkWebUnitTestSupport::TestBlinkWebUnitTestSupport() (in webkit_unit_tests) + 1653
    #8 0x1076959ff in content::SetUpBlinkTestEnvironment() (in webkit_unit_tests) + 5199
    #9 0x104fc8aec in (anonymous namespace)::runHelper(base::TestSuite*) (in webkit_unit_tests) + 204
    #10 0x1075ac51d in base::(anonymous namespace)::LaunchUnitTestsInternal(base::Callback\u003Cint ()> const&, int, int, bool, base::Callback\u003Cvoid ()> const&) (in webkit_unit_tests) + 685
    #11 0x1075ac1b0 in base::LaunchUnitTests(int, char**, base::Callback\u003Cint ()> const&) (in webkit_unit_tests) + 480
    #12 0x104fc8967 in main (in webkit_unit_tests) + 423
    #13 0x104fc87b3 in start (in webkit_unit_tests) + 51
    #14 0x7  (\u003Cunknown module>)

 
Cc: e...@chromium.org
Adding people who seem to know about blink GC
Should note, its failing flakily. Can't see anything obvious that would have started it off....
Blockedon: 593269
Components: Blink>Forms

Comment 7 by tkent@chromium.org, Jul 7 2016

Components: -Blink>Forms Blink>MemoryAllocator>GarbageCollection

Comment 8 by tasak@google.com, Aug 25 2016

Owner: keishi@chromium.org
Status: Assigned (was: Untriaged)

Sign in to add a comment