Attachment 117300 Details for Bug 91431 – AddressSanitizer report

AddressSanitizer report

out.log (text/plain), 7.80 KB, created by Massimo on 2015-07-22 17:40:36 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Massimo

Created: 2015-07-22 17:40:36 UTC

Size: 7.80 KB

patch

obsolete

>=================================================================
>==11446==ERROR: AddressSanitizer: heap-use-after-free on address 0x61500000fa98 at pc 0x7f0961e27c8e bp 0x7fff896d94d0 sp 0x7fff896d94c0
>READ of size 4 at 0x61500000fa98 thread T0
>    #0 0x7f0961e27c8d in _cairo_atomic_int_get /home/massimo/devel/obj/cairo/src/cairo-atomic-private.h:75
>    #1 0x7f0961e27c8d in _cairo_surface_reference /home/massimo/devel/obj/cairo/src/cairo-surface-inline.h:55
>    #2 0x7f0961e27c8d in _cairo_surface_snapshot_get_target /home/massimo/devel/obj/cairo/src/cairo-surface-snapshot-inline.h:55
>    #3 0x7f0961e27c8d in _cairo_surface_snapshot_get_extents /home/massimo/devel/obj/cairo/src/cairo-surface-snapshot.c:137
>    #4 0x7f0961e1a331 in _cairo_surface_get_extents /home/massimo/devel/obj/cairo/src/cairo-surface.c:2466
>    #5 0x7f0961dc8d02 in _surface_is_clear /home/massimo/devel/obj/cairo/src/cairo-pattern.c:3217
>    #6 0x7f0961dc8d02 in _cairo_pattern_is_clear /home/massimo/devel/obj/cairo/src/cairo-pattern.c:3327
>    #7 0x7f0961e14c26 in nothing_to_do /home/massimo/devel/obj/cairo/src/cairo-surface.c:2072
>    #8 0x7f0961e198d0 in _cairo_surface_fill /home/massimo/devel/obj/cairo/src/cairo-surface.c:2334
>    #9 0x7f0961e2d0fd in _cairo_surface_wrapper_fill /home/massimo/devel/obj/cairo/src/cairo-surface-wrapper.c:390
>    #10 0x7f0961dedc90 in _cairo_recording_surface_replay_internal /home/massimo/devel/obj/cairo/src/cairo-recording-surface.c:1838
>    #11 0x7f0961df0b9a in _cairo_recording_surface_replay /home/massimo/devel/obj/cairo/src/cairo-recording-surface.c:2001
>    #12 0x7f0961f0c578 in _emit_recording_surface_pattern /home/massimo/devel/obj/cairo/src/cairo-script-surface.c:1174
>    #13 0x7f0961f0dfaa in _emit_surface_pattern /home/massimo/devel/obj/cairo/src/cairo-script-surface.c:1576
>    #14 0x7f0961f0dfaa in _emit_pattern /home/massimo/devel/obj/cairo/src/cairo-script-surface.c:1650
>    #15 0x7f0961f0f1a4 in _emit_source /home/massimo/devel/obj/cairo/src/cairo-script-surface.c:1752
>    #16 0x7f0961f0f35d in _cairo_script_surface_paint /home/massimo/devel/obj/cairo/src/cairo-script-surface.c:2442
>    #17 0x7f0961e18c53 in _cairo_surface_paint /home/massimo/devel/obj/cairo/src/cairo-surface.c:2117
>    #18 0x7f0961e2bcb4 in _cairo_surface_wrapper_paint /home/massimo/devel/obj/cairo/src/cairo-surface-wrapper.c:165
>    #19 0x7f0961ded7b0 in _cairo_recording_surface_replay_internal /home/massimo/devel/obj/cairo/src/cairo-recording-surface.c:1742
>    #20 0x7f0961df0b9a in _cairo_recording_surface_replay /home/massimo/devel/obj/cairo/src/cairo-recording-surface.c:2001
>    #21 0x7f0961f0c578 in _emit_recording_surface_pattern /home/massimo/devel/obj/cairo/src/cairo-script-surface.c:1174
>    #22 0x7f0961f0dfaa in _emit_surface_pattern /home/massimo/devel/obj/cairo/src/cairo-script-surface.c:1576
>    #23 0x7f0961f0dfaa in _emit_pattern /home/massimo/devel/obj/cairo/src/cairo-script-surface.c:1650
>    #24 0x7f0961f0f1a4 in _emit_source /home/massimo/devel/obj/cairo/src/cairo-script-surface.c:1752
>    #25 0x7f0961f0f35d in _cairo_script_surface_paint /home/massimo/devel/obj/cairo/src/cairo-script-surface.c:2442
>    #26 0x7f0961e18c53 in _cairo_surface_paint /home/massimo/devel/obj/cairo/src/cairo-surface.c:2117
>    #27 0x7f0961d58270 in _cairo_gstate_paint /home/massimo/devel/obj/cairo/src/cairo-gstate.c:1067
>    #28 0x7f0961d2c300 in INT_cairo_paint /home/massimo/devel/obj/cairo/src/cairo.c:2003
>    #29 0x4a1458 in _cairo_boilerplate_get_image_surface /home/massimo/devel/obj/cairo/boilerplate/cairo-boilerplate.c:342
>    #30 0x429532 in cairo_test_for_target /home/massimo/devel/obj/cairo/test/cairo-test.c:1136
>    #31 0x42af85 in _cairo_test_context_run_for_target /home/massimo/devel/obj/cairo/test/cairo-test.c:1532
>    #32 0x41d624 in _cairo_test_runner_draw /home/massimo/devel/obj/cairo/test/cairo-test-runner.c:255
>    #33 0x41d624 in main /home/massimo/devel/obj/cairo/test/cairo-test-runner.c:937
>    #34 0x3f9f8206ff in __libc_start_main (/lib64/libc.so.6+0x3f9f8206ff)
>    #35 0x425be8 in _start (/home/massimo/devel/obj/cairo/test/.libs/lt-cairo-test-suite+0x425be8)
>
>0x61500000fa98 is located 24 bytes inside of 464-byte region [0x61500000fa80,0x61500000fc50)
>freed by thread T8 here:
>    #0 0x7f096228c70a in __interceptor_free (/lib64/libasan.so.2+0x9870a)
>    #1 0x7f0961dbf827 in _cairo_pattern_fini /home/massimo/devel/obj/cairo/src/cairo-pattern.c:443
>    #2 0x7f0961dc1452 in INT_cairo_pattern_destroy /home/massimo/devel/obj/cairo/src/cairo-pattern.c:1131
>    #3 0x48d4ea in draw_thread /home/massimo/devel/obj/cairo/test/pthread-same-source.c:74
>    #4 0x3fa0007554 in start_thread (/lib64/libpthread.so.0+0x3fa0007554)
>
>previously allocated by thread T0 here:
>    #0 0x7f096228ca0a in malloc (/lib64/libasan.so.2+0x98a0a)
>    #1 0x7f0961def8ed in INT_cairo_recording_surface_create /home/massimo/devel/obj/cairo/src/cairo-recording-surface.c:389
>    #2 0x7f0961defeac in _cairo_recording_surface_create_similar /home/massimo/devel/obj/cairo/src/cairo-recording-surface.c:441
>    #3 0x7f0961e1b242 in cairo_surface_create_similar /home/massimo/devel/obj/cairo/src/cairo-surface.c:516
>    #4 0x48d734 in create_source /home/massimo/devel/obj/cairo/test/pthread-same-source.c:95
>    #5 0x48d734 in draw /home/massimo/devel/obj/cairo/test/pthread-same-source.c:126
>    #6 0x42920a in cairo_test_for_target /home/massimo/devel/obj/cairo/test/cairo-test.c:929
>    #7 0x42af85 in _cairo_test_context_run_for_target /home/massimo/devel/obj/cairo/test/cairo-test.c:1532
>    #8 0x41d624 in _cairo_test_runner_draw /home/massimo/devel/obj/cairo/test/cairo-test-runner.c:255
>    #9 0x41d624 in main /home/massimo/devel/obj/cairo/test/cairo-test-runner.c:937
>    #10 0x3f9f8206ff in __libc_start_main (/lib64/libc.so.6+0x3f9f8206ff)
>
>Thread T8 created by T0 here:
>    #0 0x7f096222a703 in pthread_create (/lib64/libasan.so.2+0x36703)
>    #1 0x48d94d in draw /home/massimo/devel/obj/cairo/test/pthread-same-source.c:144
>    #2 0x42920a in cairo_test_for_target /home/massimo/devel/obj/cairo/test/cairo-test.c:929
>    #3 0x42af85 in _cairo_test_context_run_for_target /home/massimo/devel/obj/cairo/test/cairo-test.c:1532
>    #4 0x41d624 in _cairo_test_runner_draw /home/massimo/devel/obj/cairo/test/cairo-test-runner.c:255
>    #5 0x41d624 in main /home/massimo/devel/obj/cairo/test/cairo-test-runner.c:937
>    #6 0x3f9f8206ff in __libc_start_main (/lib64/libc.so.6+0x3f9f8206ff)
>
>SUMMARY: AddressSanitizer: heap-use-after-free /home/massimo/devel/obj/cairo/src/cairo-atomic-private.h:75 _cairo_atomic_int_get
>Shadow bytes around the buggy address:
>  0x0c2a7fff9f00: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
>  0x0c2a7fff9f10: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
>  0x0c2a7fff9f20: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
>  0x0c2a7fff9f30: fd fd fd fd fd fd fd fd fd fd fa fa fa fa fa fa
>  0x0c2a7fff9f40: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
>=>0x0c2a7fff9f50: fd fd fd[fd]fd fd fd fd fd fd fd fd fd fd fd fd
>  0x0c2a7fff9f60: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
>  0x0c2a7fff9f70: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
>  0x0c2a7fff9f80: fd fd fd fd fd fd fd fd fd fd fa fa fa fa fa fa
>  0x0c2a7fff9f90: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
>  0x0c2a7fff9fa0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>Shadow byte legend (one shadow byte represents 8 application bytes):
>  Addressable:           00
>  Partially addressable: 01 02 03 04 05 06 07 
>  Heap left redzone:       fa
>  Heap right redzone:      fb
>  Freed heap region:       fd
>  Stack left redzone:      f1
>  Stack mid redzone:       f2
>  Stack right redzone:     f3
>  Stack partial redzone:   f4
>  Stack after return:      f5
>  Stack use after scope:   f8
>  Global redzone:          f9
>  Global init order:       f6
>  Poisoned by user:        f7
>  Container overflow:      fc
>  Array cookie:            ac
>  Intra object redzone:    bb
>  ASan internal:           fe
>==11446==ABORTING

Actions: View

Attachments on bug 91431: 117300

Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.