Bug 161109

Summary: REGRESSION(204854): ASan is unhappy
Product: WebKit Reporter: Filip Pizlo <fpizlo>
Component: JavaScriptCoreAssignee: Filip Pizlo <fpizlo>
Status: RESOLVED FIXED    
Severity: Normal CC: ap, ddkilzer, ryanhaddad
Priority: P2    
Version: WebKit Nightly Build   
Hardware: All   
OS: All   
Bug Depends on:    
Bug Blocks: 161117    
Attachments:
Description Flags
the patch ggaren: review+

Description Filip Pizlo 2016-08-23 15:02:15 PDT
See here: https://build-safari.apple.com/results/Trunk%20El%20Capitan%20ASan%20Release%20WK2%20Tests/r204854_86469%20(1539)/results.html

For example:

==28827==ERROR: AddressSanitizer: heap-use-after-free on address 0x615000160260 at pc 0x000110f1fa4b bp 0x7fff52724740 sp 0x7fff52724738
READ of size 8 at 0x615000160260 thread T0
    #0 0x110f1fa4a in JSC::WeakSet::vm() const (/Volumes/Data/slave/elcapitan-asan-release-wk2-tests/build/buildToTest/JavaScriptCore.framework/Versions/A/JavaScriptCore+0x3fa4a)
    #1 0x11220f4a7 in JSC::constructRegExp(JSC::ExecState*, JSC::JSGlobalObject*, JSC::ArgList const&, JSC::JSObject*, JSC::JSValue) (/Volumes/Data/slave/elcapitan-asan-release-wk2-tests/build/buildToTest/JavaScriptCore.framework/Versions/A/JavaScriptCore+0x132f4a7)
    #2 0x112215dfc in JSC::callRegExpConstructor(JSC::ExecState*) (/Volumes/Data/slave/elcapitan-asan-release-wk2-tests/build/buildToTest/JavaScriptCore.framework/Versions/A/JavaScriptCore+0x1335dfc)
    #3 0x111f9ea08 in JSC::LLInt::handleHostCall(JSC::ExecState*, JSC::Instruction*, JSC::JSValue, JSC::CodeSpecializationKind) (/Volumes/Data/slave/elcapitan-asan-release-wk2-tests/build/buildToTest/JavaScriptCore.framework/Versions/A/JavaScriptCore+0x10bea08)
    #4 0x111fa32aa in JSC::LLInt::setUpCall(JSC::ExecState*, JSC::Instruction*, JSC::CodeSpecializationKind, JSC::JSValue, JSC::LLIntCallLinkInfo*) (/Volumes/Data/slave/elcapitan-asan-release-wk2-tests/build/buildToTest/JavaScriptCore.framework/Versions/A/JavaScriptCore+0x10c32aa)
    #5 0x111fabf1f in llint_entry (/Volumes/Data/slave/elcapitan-asan-release-wk2-tests/build/buildToTest/JavaScriptCore.framework/Versions/A/JavaScriptCore+0x10cbf1f)
    #6 0x111fabebb in llint_entry (/Volumes/Data/slave/elcapitan-asan-release-wk2-tests/build/buildToTest/JavaScriptCore.framework/Versions/A/JavaScriptCore+0x10cbebb)
    #7 0x111fabf2d in llint_entry (/Volumes/Data/slave/elcapitan-asan-release-wk2-tests/build/buildToTest/JavaScriptCore.framework/Versions/A/JavaScriptCore+0x10cbf2d)
    #8 0x111fabf2d in llint_entry (/Volumes/Data/slave/elcapitan-asan-release-wk2-tests/build/buildToTest/JavaScriptCore.framework/Versions/A/JavaScriptCore+0x10cbf2d)
    #9 0x111fabf2d in llint_entry (/Volumes/Data/slave/elcapitan-asan-release-wk2-tests/build/buildToTest/JavaScriptCore.framework/Versions/A/JavaScriptCore+0x10cbf2d)
    #10 0x111fac327 in llint_entry (/Volumes/Data/slave/elcapitan-asan-release-wk2-tests/build/buildToTest/JavaScriptCore.framework/Versions/A/JavaScriptCore+0x10cc327)
    #11 0x111fac327 in llint_entry (/Volumes/Data/slave/elcapitan-asan-release-wk2-tests/build/buildToTest/JavaScriptCore.framework/Versions/A/JavaScriptCore+0x10cc327)
    #12 0x111fabf2d in llint_entry (/Volumes/Data/slave/elcapitan-asan-release-wk2-tests/build/buildToTest/JavaScriptCore.framework/Versions/A/JavaScriptCore+0x10cbf2d)
    #13 0x111fabf2d in llint_entry (/Volumes/Data/slave/elcapitan-asan-release-wk2-tests/build/buildToTest/JavaScriptCore.framework/Versions/A/JavaScriptCore+0x10cbf2d)
    #14 0x111fabf2d in llint_entry (/Volumes/Data/slave/elcapitan-asan-release-wk2-tests/build/buildToTest/JavaScriptCore.framework/Versions/A/JavaScriptCore+0x10cbf2d)
    #15 0x111fabf2d in llint_entry (/Volumes/Data/slave/elcapitan-asan-release-wk2-tests/build/buildToTest/JavaScriptCore.framework/Versions/A/JavaScriptCore+0x10cbf2d)
    #16 0x111fabf2d in llint_entry (/Volumes/Data/slave/elcapitan-asan-release-wk2-tests/build/buildToTest/JavaScriptCore.framework/Versions/A/JavaScriptCore+0x10cbf2d)
    #17 0x111fa5b7a in vmEntryToJavaScript (/Volumes/Data/slave/elcapitan-asan-release-wk2-tests/build/buildToTest/JavaScriptCore.framework/Versions/A/JavaScriptCore+0x10c5b7a)
    #18 0x111c4b0ed in JSC::JITCode::execute(JSC::VM*, JSC::ProtoCallFrame*) (/Volumes/Data/slave/elcapitan-asan-release-wk2-tests/build/buildToTest/JavaScriptCore.framework/Versions/A/JavaScriptCore+0xd6b0ed)
    #19 0x111bb9865 in JSC::Interpreter::execute(JSC::ProgramExecutable*, JSC::ExecState*, JSC::JSObject*) (/Volumes/Data/slave/elcapitan-asan-release-wk2-tests/build/buildToTest/JavaScriptCore.framework/Versions/A/JavaScriptCore+0xcd9865)
    #20 0x111448e6e in JSC::evaluate(JSC::ExecState*, JSC::SourceCode const&, JSC::JSValue, WTF::NakedPtr<JSC::Exception>&) (/Volumes/Data/slave/elcapitan-asan-release-wk2-tests/build/buildToTest/JavaScriptCore.framework/Versions/A/JavaScriptCore+0x568e6e)
    #21 0x1114490ae in JSC::profiledEvaluate(JSC::ExecState*, JSC::ProfilingReason, JSC::SourceCode const&, JSC::JSValue, WTF::NakedPtr<JSC::Exception>&) (/Volumes/Data/slave/elcapitan-asan-release-wk2-tests/build/buildToTest/JavaScriptCore.framework/Versions/A/JavaScriptCore+0x5690ae)
    #22 0x1161e75a3 in WebCore::JSMainThreadExecState::profiledEvaluate(JSC::ExecState*, JSC::ProfilingReason, JSC::SourceCode const&, JSC::JSValue, WTF::NakedPtr<JSC::Exception>&) (/Volumes/Data/slave/elcapitan-asan-release-wk2-tests/build/buildToTest/WebCore.framework/Versions/A/WebCore+0x1f805a3)
    #23 0x1161e385a in WebCore::ScriptController::evaluateInWorld(WebCore::ScriptSourceCode const&, WebCore::DOMWrapperWorld&, WebCore::ExceptionDetails*) (/Volumes/Data/slave/elcapitan-asan-release-wk2-tests/build/buildToTest/WebCore.framework/Versions/A/WebCore+0x1f7c85a)
    #24 0x1161f4126 in WebCore::ScriptElement::executeScript(WebCore::ScriptSourceCode const&) (/Volumes/Data/slave/elcapitan-asan-release-wk2-tests/build/buildToTest/WebCore.framework/Versions/A/WebCore+0x1f8d126)
    #25 0x1161f1b58 in WebCore::ScriptElement::prepareScript(WTF::TextPosition const&, WebCore::ScriptElement::LegacyTypeSupport) (/Volumes/Data/slave/elcapitan-asan-release-wk2-tests/build/buildToTest/WebCore.framework/Versions/A/WebCore+0x1f8ab58)
    #26 0x114e0fb9f in WebCore::HTMLScriptRunner::runScript(WebCore::Element*, WTF::TextPosition const&) (/Volumes/Data/slave/elcapitan-asan-release-wk2-tests/build/buildToTest/WebCore.framework/Versions/A/WebCore+0xba8b9f)
    #27 0x114e0f8c5 in WebCore::HTMLScriptRunner::execute(WTF::PassRefPtr<WebCore::Element>, WTF::TextPosition const&) (/Volumes/Data/slave/elcapitan-asan-release-wk2-tests/build/buildToTest/WebCore.framework/Versions/A/WebCore+0xba88c5)
    #28 0x114d43742 in WebCore::HTMLDocumentParser::runScriptsForPausedTreeBuilder() (/Volumes/Data/slave/elcapitan-asan-release-wk2-tests/build/buildToTest/WebCore.framework/Versions/A/WebCore+0xadc742)
    #29 0x114d43d12 in WebCore::HTMLDocumentParser::pumpTokenizerLoop(WebCore::HTMLDocumentParser::SynchronousMode, bool, WebCore::PumpSession&) (/Volumes/Data/slave/elcapitan-asan-release-wk2-tests/build/buildToTest/WebCore.framework/Versions/A/WebCore+0xadcd12)
    #30 0x114d42f77 in WebCore::HTMLDocumentParser::pumpTokenizer(WebCore::HTMLDocumentParser::SynchronousMode) (/Volumes/Data/slave/elcapitan-asan-release-wk2-tests/build/buildToTest/WebCore.framework/Versions/A/WebCore+0xadbf77)
    #31 0x114d44bcd in WebCore::HTMLDocumentParser::resumeParsingAfterScriptExecution() (/Volumes/Data/slave/elcapitan-asan-release-wk2-tests/build/buildToTest/WebCore.framework/Versions/A/WebCore+0xaddbcd)
    #32 0x114d44e91 in WebCore::HTMLDocumentParser::notifyFinished(WebCore::CachedResource*) (/Volumes/Data/slave/elcapitan-asan-release-wk2-tests/build/buildToTest/WebCore.framework/Versions/A/WebCore+0xadde91)
    #33 0x1144ac9e7 in WebCore::CachedResource::checkNotify() (/Volumes/Data/slave/elcapitan-asan-release-wk2-tests/build/buildToTest/WebCore.framework/Versions/A/WebCore+0x2459e7)
    #34 0x1164d3298 in WebCore::SubresourceLoader::didFinishLoading(double) (/Volumes/Data/slave/elcapitan-asan-release-wk2-tests/build/buildToTest/WebCore.framework/Versions/A/WebCore+0x226c298)
    #35 0x10dd22785 in void IPC::handleMessage<Messages::WebResourceLoader::DidFinishResourceLoad, WebKit::WebResourceLoader, void (WebKit::WebResourceLoader::*)(double)>(IPC::Decoder&, WebKit::WebResourceLoader*, void (WebKit::WebResourceLoader::*)(double)) (/Volumes/Data/slave/elcapitan-asan-release-wk2-tests/build/buildToTest/WebKit.framework/Versions/A/WebKit+0x835785)
    #36 0x10dd21d5d in WebKit::WebResourceLoader::didReceiveWebResourceLoaderMessage(IPC::Connection&, IPC::Decoder&) (/Volumes/Data/slave/elcapitan-asan-release-wk2-tests/build/buildToTest/WebKit.framework/Versions/A/WebKit+0x834d5d)
    #37 0x10d75f8da in WebKit::NetworkProcessConnection::didReceiveMessage(IPC::Connection&, IPC::Decoder&) (/Volumes/Data/slave/elcapitan-asan-release-wk2-tests/build/buildToTest/WebKit.framework/Versions/A/WebKit+0x2728da)
    #38 0x10d595903 in IPC::Connection::dispatchMessage(std::__1::unique_ptr<IPC::Decoder, std::__1::default_delete<IPC::Decoder> >) (/Volumes/Data/slave/elcapitan-asan-release-wk2-tests/build/buildToTest/WebKit.framework/Versions/A/WebKit+0xa8903)
    #39 0x10d59bf74 in IPC::Connection::dispatchOneMessage() (/Volumes/Data/slave/elcapitan-asan-release-wk2-tests/build/buildToTest/WebKit.framework/Versions/A/WebKit+0xaef74)
    #40 0x11242b55f in WTF::RunLoop::performWork() (/Volumes/Data/slave/elcapitan-asan-release-wk2-tests/build/buildToTest/JavaScriptCore.framework/Versions/A/JavaScriptCore+0x154b55f)
    #41 0x11242bcfe in WTF::RunLoop::performWork(void*) (/Volumes/Data/slave/elcapitan-asan-release-wk2-tests/build/buildToTest/JavaScriptCore.framework/Versions/A/JavaScriptCore+0x154bcfe)
    #42 0x7fff8fbbe880 in __CFRUNLOOP_IS_CALLING_OUT_TO_A_SOURCE0_PERFORM_FUNCTION__ (/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation+0xaa880)
    #43 0x7fff8fb9dfbb in __CFRunLoopDoSources0 (/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation+0x89fbb)
    #44 0x7fff8fb9d4de in __CFRunLoopRun (/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation+0x894de)
    #45 0x7fff8fb9ced7 in CFRunLoopRunSpecific (/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation+0x88ed7)
    #46 0x7fff85d00934 in RunCurrentEventLoopInMode (/System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/HIToolbox.framework/Versions/A/HIToolbox+0x30934)
    #47 0x7fff85d0076e in ReceiveNextEventCommon (/System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/HIToolbox.framework/Versions/A/HIToolbox+0x3076e)
    #48 0x7fff85d005ae in _BlockUntilNextEventMatchingListInModeWithFilter (/System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/HIToolbox.framework/Versions/A/HIToolbox+0x305ae)
    #49 0x7fff86442ef9 in _DPSNextEvent (/System/Library/Frameworks/AppKit.framework/Versions/C/AppKit+0x48ef9)
    #50 0x7fff86442329 in -[NSApplication _nextEventMatchingEventMask:untilDate:inMode:dequeue:] (/System/Library/Frameworks/AppKit.framework/Versions/C/AppKit+0x48329)
    #51 0x7fff86436e83 in -[NSApplication run] (/System/Library/Frameworks/AppKit.framework/Versions/C/AppKit+0x3ce83)
    #52 0x7fff8640046b in NSApplicationMain (/System/Library/Frameworks/AppKit.framework/Versions/C/AppKit+0x646b)
    #53 0x7fff96149193 in _xpc_objc_main (/usr/lib/system/libxpc.dylib+0x11193)
    #54 0x7fff96147bbd in xpc_main (/usr/lib/system/libxpc.dylib+0xfbbd)
    #55 0x10d4d5c3b in main (/Volumes/Data/slave/elcapitan-asan-release-wk2-tests/build/buildToTest/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.WebContent.Development.xpc/Contents/MacOS/com.apple.WebKit.WebContent.Development+0x100001c3b)
    #56 0x7fff8e29d5ac in start (/usr/lib/system/libdyld.dylib+0x35ac)
    #57 0x0  (<unknown module>)

0x615000160260 is located 352 bytes inside of 512-byte region [0x615000160100,0x615000160300)
freed by thread T0 here:
    #0 0x10f876109 in wrap_free (/Applications/Xcode.app/Contents/Developer/Toolchains/OSX10.11.xctoolchain/usr/lib/clang/7.0.0/lib/darwin/libclang_rt.asan_osx_dynamic.dylib+0x43109)
    #1 0x112477fa7 in bmalloc::Deallocator::deallocateSlowCase(void*) (/Volumes/Data/slave/elcapitan-asan-release-wk2-tests/build/buildToTest/JavaScriptCore.framework/Versions/A/JavaScriptCore+0x1597fa7)
    #2 0x115602167 in WTF::Vector<WebCore::CSSParserValue, 4ul, WTF::CrashOnOverflow, 16ul>::expandCapacity(unsigned long, WebCore::CSSParserValue*) (/Volumes/Data/slave/elcapitan-asan-release-wk2-tests/build/buildToTest/WebCore.framework/Versions/A/WebCore+0x139b167)
    #3 0x115602071 in void WTF::Vector<WebCore::CSSParserValue, 4ul, WTF::CrashOnOverflow, 16ul>::appendSlowCase<WebCore::CSSParserValue const&>(WebCore::CSSParserValue const&&&) (/Volumes/Data/slave/elcapitan-asan-release-wk2-tests/build/buildToTest/WebCore.framework/Versions/A/WebCore+0x139b071)
    #4 0x114716d2c in cssyyparse(WebCore::CSSParser*) (/Volumes/Data/slave/elcapitan-asan-release-wk2-tests/build/buildToTest/WebCore.framework/Versions/A/WebCore+0x4afd2c)
    #5 0x1166f4de2 in WebCore::CSSParser::parseSheet(WebCore::StyleSheetContents*, WTF::String const&, WTF::TextPosition const&, WTF::Vector<WTF::Ref<WebCore::CSSRuleSourceData>, 0ul, WTF::CrashOnOverflow, 16ul>*, bool) (/Volumes/Data/slave/elcapitan-asan-release-wk2-tests/build/buildToTest/WebCore.framework/Versions/A/WebCore+0x248dde2)
    #6 0x1164b8f24 in WebCore::StyleSheetContents::parseStringAtPosition(WTF::String const&, WTF::TextPosition const&, bool) (/Volumes/Data/slave/elcapitan-asan-release-wk2-tests/build/buildToTest/WebCore.framework/Versions/A/WebCore+0x2251f24)
    #7 0x1164b8dbf in WebCore::StyleSheetContents::parseString(WTF::String const&) (/Volumes/Data/slave/elcapitan-asan-release-wk2-tests/build/buildToTest/WebCore.framework/Versions/A/WebCore+0x2251dbf)
    #8 0x1146cbbc8 in WebCore::parseUASheet(WTF::String const&) (/Volumes/Data/slave/elcapitan-asan-release-wk2-tests/build/buildToTest/WebCore.framework/Versions/A/WebCore+0x464bc8)
    #9 0x1146cb6ca in WebCore::CSSDefaultStyleSheets::loadFullDefaultStyle() (/Volumes/Data/slave/elcapitan-asan-release-wk2-tests/build/buildToTest/WebCore.framework/Versions/A/WebCore+0x4646ca)
    #10 0x1146cbf56 in WebCore::CSSDefaultStyleSheets::ensureDefaultStyleSheetsForElement(WebCore::Element const&) (/Volumes/Data/slave/elcapitan-asan-release-wk2-tests/build/buildToTest/WebCore.framework/Versions/A/WebCore+0x464f56)
    #11 0x11648c41b in WebCore::StyleResolver::styleForElement(WebCore::Element const&, WebCore::RenderStyle const*, WebCore::RuleMatchingBehavior, WebCore::RenderRegion const*, WebCore::SelectorFilter const*) (/Volumes/Data/slave/elcapitan-asan-release-wk2-tests/build/buildToTest/WebCore.framework/Versions/A/WebCore+0x222541b)
    #12 0x1149f2bd9 in WebCore::Element::resolveStyle(WebCore::RenderStyle const*) (/Volumes/Data/slave/elcapitan-asan-release-wk2-tests/build/buildToTest/WebCore.framework/Versions/A/WebCore+0x78bbd9)
    #13 0x114880bb6 in WebCore::Document::styleForElementIgnoringPendingStylesheets(WebCore::Element&, WebCore::RenderStyle const*) (/Volumes/Data/slave/elcapitan-asan-release-wk2-tests/build/buildToTest/WebCore.framework/Versions/A/WebCore+0x619bb6)
    #14 0x1149fb572 in WebCore::Element::resolveComputedStyle() (/Volumes/Data/slave/elcapitan-asan-release-wk2-tests/build/buildToTest/WebCore.framework/Versions/A/WebCore+0x794572)
    #15 0x1149fb803 in WebCore::Element::computedStyle(WebCore::PseudoId) (/Volumes/Data/slave/elcapitan-asan-release-wk2-tests/build/buildToTest/WebCore.framework/Versions/A/WebCore+0x794803)
    #16 0x114e3cf10 in WebCore::HTMLTitleElement::computedTextWithDirection() (/Volumes/Data/slave/elcapitan-asan-release-wk2-tests/build/buildToTest/WebCore.framework/Versions/A/WebCore+0xbd5f10)
    #17 0x114e3cddf in WebCore::HTMLTitleElement::childrenChanged(WebCore::ContainerNode::ChildChange const&) (/Volumes/Data/slave/elcapitan-asan-release-wk2-tests/build/buildToTest/WebCore.framework/Versions/A/WebCore+0xbd5ddf)
    #18 0x1145b319a in WebCore::ContainerNode::notifyChildInserted(WebCore::Node&, WebCore::ContainerNode::ChildChangeSource) (/Volumes/Data/slave/elcapitan-asan-release-wk2-tests/build/buildToTest/WebCore.framework/Versions/A/WebCore+0x34c19a)
    #19 0x1145b231d in WebCore::ContainerNode::parserAppendChild(WebCore::Node&) (/Volumes/Data/slave/elcapitan-asan-release-wk2-tests/build/buildToTest/WebCore.framework/Versions/A/WebCore+0x34b31d)
    #20 0x114d1eafc in WebCore::executeInsertTask(WebCore::HTMLConstructionSiteTask&) (/Volumes/Data/slave/elcapitan-asan-release-wk2-tests/build/buildToTest/WebCore.framework/Versions/A/WebCore+0xab7afc)
    #21 0x114d1d82c in WebCore::HTMLConstructionSite::insertTextNode(WTF::String const&, WebCore::WhitespaceMode) (/Volumes/Data/slave/elcapitan-asan-release-wk2-tests/build/buildToTest/WebCore.framework/Versions/A/WebCore+0xab682c)
    #22 0x114e59039 in WebCore::HTMLTreeBuilder::processCharacterBuffer(WebCore::HTMLTreeBuilder::ExternalCharacterTokenBuffer&) (/Volumes/Data/slave/elcapitan-asan-release-wk2-tests/build/buildToTest/WebCore.framework/Versions/A/WebCore+0xbf2039)
    #23 0x114e58021 in WebCore::HTMLTreeBuilder::processCharacter(WebCore::AtomicHTMLToken&) (/Volumes/Data/slave/elcapitan-asan-release-wk2-tests/build/buildToTest/WebCore.framework/Versions/A/WebCore+0xbf1021)
    #24 0x114e551de in WebCore::HTMLTreeBuilder::constructTree(WebCore::AtomicHTMLToken&) (/Volumes/Data/slave/elcapitan-asan-release-wk2-tests/build/buildToTest/WebCore.framework/Versions/A/WebCore+0xbee1de)
    #25 0x114d43f48 in WebCore::HTMLDocumentParser::constructTreeFromHTMLToken(WebCore::HTMLTokenizer::TokenPtr&) (/Volumes/Data/slave/elcapitan-asan-release-wk2-tests/build/buildToTest/WebCore.framework/Versions/A/WebCore+0xadcf48)
    #26 0x114d43cb2 in WebCore::HTMLDocumentParser::pumpTokenizerLoop(WebCore::HTMLDocumentParser::SynchronousMode, bool, WebCore::PumpSession&) (/Volumes/Data/slave/elcapitan-asan-release-wk2-tests/build/buildToTest/WebCore.framework/Versions/A/WebCore+0xadccb2)
    #27 0x114d42f77 in WebCore::HTMLDocumentParser::pumpTokenizer(WebCore::HTMLDocumentParser::SynchronousMode) (/Volumes/Data/slave/elcapitan-asan-release-wk2-tests/build/buildToTest/WebCore.framework/Versions/A/WebCore+0xadbf77)
    #28 0x114d44668 in WebCore::HTMLDocumentParser::append(WTF::RefPtr<WTF::StringImpl>&&) (/Volumes/Data/slave/elcapitan-asan-release-wk2-tests/build/buildToTest/WebCore.framework/Versions/A/WebCore+0xadd668)
    #29 0x1148089aa in WebCore::DecodedDataDocumentParser::appendBytes(WebCore::DocumentWriter&, char const*, unsigned long) (/Volumes/Data/slave/elcapitan-asan-release-wk2-tests/build/buildToTest/WebCore.framework/Versions/A/WebCore+0x5a19aa)

previously allocated by thread T0 here:
    #0 0x10f875f40 in wrap_malloc (/Applications/Xcode.app/Contents/Developer/Toolchains/OSX10.11.xctoolchain/usr/lib/clang/7.0.0/lib/darwin/libclang_rt.asan_osx_dynamic.dylib+0x42f40)
    #1 0x11246ce44 in bmalloc::Allocator::allocateSlowCase(unsigned long) (/Volumes/Data/slave/elcapitan-asan-release-wk2-tests/build/buildToTest/JavaScriptCore.framework/Versions/A/JavaScriptCore+0x158ce44)
    #2 0x11240f645 in bmalloc::Allocator::allocate(unsigned long) (/Volumes/Data/slave/elcapitan-asan-release-wk2-tests/build/buildToTest/JavaScriptCore.framework/Versions/A/JavaScriptCore+0x152f645)
    #3 0x11560238f in WTF::VectorBufferBase<WebCore::CSSParserValue>::allocateBuffer(unsigned long) (/Volumes/Data/slave/elcapitan-asan-release-wk2-tests/build/buildToTest/WebCore.framework/Versions/A/WebCore+0x139b38f)
    #4 0x115602213 in WTF::Vector<WebCore::CSSParserValue, 4ul, WTF::CrashOnOverflow, 16ul>::reserveCapacity(unsigned long) (/Volumes/Data/slave/elcapitan-asan-release-wk2-tests/build/buildToTest/WebCore.framework/Versions/A/WebCore+0x139b213)
    #5 0x115602167 in WTF::Vector<WebCore::CSSParserValue, 4ul, WTF::CrashOnOverflow, 16ul>::expandCapacity(unsigned long, WebCore::CSSParserValue*) (/Volumes/Data/slave/elcapitan-asan-release-wk2-tests/build/buildToTest/WebCore.framework/Versions/A/WebCore+0x139b167)
    #6 0x115602071 in void WTF::Vector<WebCore::CSSParserValue, 4ul, WTF::CrashOnOverflow, 16ul>::appendSlowCase<WebCore::CSSParserValue const&>(WebCore::CSSParserValue const&&&) (/Volumes/Data/slave/elcapitan-asan-release-wk2-tests/build/buildToTest/WebCore.framework/Versions/A/WebCore+0x139b071)
    #7 0x114716d14 in cssyyparse(WebCore::CSSParser*) (/Volumes/Data/slave/elcapitan-asan-release-wk2-tests/build/buildToTest/WebCore.framework/Versions/A/WebCore+0x4afd14)
    #8 0x1166f4de2 in WebCore::CSSParser::parseSheet(WebCore::StyleSheetContents*, WTF::String const&, WTF::TextPosition const&, WTF::Vector<WTF::Ref<WebCore::CSSRuleSourceData>, 0ul, WTF::CrashOnOverflow, 16ul>*, bool) (/Volumes/Data/slave/elcapitan-asan-release-wk2-tests/build/buildToTest/WebCore.framework/Versions/A/WebCore+0x248dde2)
    #9 0x1164b8f24 in WebCore::StyleSheetContents::parseStringAtPosition(WTF::String const&, WTF::TextPosition const&, bool) (/Volumes/Data/slave/elcapitan-asan-release-wk2-tests/build/buildToTest/WebCore.framework/Versions/A/WebCore+0x2251f24)
    #10 0x1164b8dbf in WebCore::StyleSheetContents::parseString(WTF::String const&) (/Volumes/Data/slave/elcapitan-asan-release-wk2-tests/build/buildToTest/WebCore.framework/Versions/A/WebCore+0x2251dbf)
    #11 0x1146cbbc8 in WebCore::parseUASheet(WTF::String const&) (/Volumes/Data/slave/elcapitan-asan-release-wk2-tests/build/buildToTest/WebCore.framework/Versions/A/WebCore+0x464bc8)
    #12 0x1146cb6ca in WebCore::CSSDefaultStyleSheets::loadFullDefaultStyle() (/Volumes/Data/slave/elcapitan-asan-release-wk2-tests/build/buildToTest/WebCore.framework/Versions/A/WebCore+0x4646ca)
    #13 0x1146cbf56 in WebCore::CSSDefaultStyleSheets::ensureDefaultStyleSheetsForElement(WebCore::Element const&) (/Volumes/Data/slave/elcapitan-asan-release-wk2-tests/build/buildToTest/WebCore.framework/Versions/A/WebCore+0x464f56)
    #14 0x11648c41b in WebCore::StyleResolver::styleForElement(WebCore::Element const&, WebCore::RenderStyle const*, WebCore::RuleMatchingBehavior, WebCore::RenderRegion const*, WebCore::SelectorFilter const*) (/Volumes/Data/slave/elcapitan-asan-release-wk2-tests/build/buildToTest/WebCore.framework/Versions/A/WebCore+0x222541b)
    #15 0x1149f2bd9 in WebCore::Element::resolveStyle(WebCore::RenderStyle const*) (/Volumes/Data/slave/elcapitan-asan-release-wk2-tests/build/buildToTest/WebCore.framework/Versions/A/WebCore+0x78bbd9)
    #16 0x114880bb6 in WebCore::Document::styleForElementIgnoringPendingStylesheets(WebCore::Element&, WebCore::RenderStyle const*) (/Volumes/Data/slave/elcapitan-asan-release-wk2-tests/build/buildToTest/WebCore.framework/Versions/A/WebCore+0x619bb6)
    #17 0x1149fb572 in WebCore::Element::resolveComputedStyle() (/Volumes/Data/slave/elcapitan-asan-release-wk2-tests/build/buildToTest/WebCore.framework/Versions/A/WebCore+0x794572)
    #18 0x1149fb803 in WebCore::Element::computedStyle(WebCore::PseudoId) (/Volumes/Data/slave/elcapitan-asan-release-wk2-tests/build/buildToTest/WebCore.framework/Versions/A/WebCore+0x794803)
    #19 0x114e3cf10 in WebCore::HTMLTitleElement::computedTextWithDirection() (/Volumes/Data/slave/elcapitan-asan-release-wk2-tests/build/buildToTest/WebCore.framework/Versions/A/WebCore+0xbd5f10)
    #20 0x114e3cddf in WebCore::HTMLTitleElement::childrenChanged(WebCore::ContainerNode::ChildChange const&) (/Volumes/Data/slave/elcapitan-asan-release-wk2-tests/build/buildToTest/WebCore.framework/Versions/A/WebCore+0xbd5ddf)
    #21 0x1145b319a in WebCore::ContainerNode::notifyChildInserted(WebCore::Node&, WebCore::ContainerNode::ChildChangeSource) (/Volumes/Data/slave/elcapitan-asan-release-wk2-tests/build/buildToTest/WebCore.framework/Versions/A/WebCore+0x34c19a)
    #22 0x1145b231d in WebCore::ContainerNode::parserAppendChild(WebCore::Node&) (/Volumes/Data/slave/elcapitan-asan-release-wk2-tests/build/buildToTest/WebCore.framework/Versions/A/WebCore+0x34b31d)
    #23 0x114d1eafc in WebCore::executeInsertTask(WebCore::HTMLConstructionSiteTask&) (/Volumes/Data/slave/elcapitan-asan-release-wk2-tests/build/buildToTest/WebCore.framework/Versions/A/WebCore+0xab7afc)
    #24 0x114d1d82c in WebCore::HTMLConstructionSite::insertTextNode(WTF::String const&, WebCore::WhitespaceMode) (/Volumes/Data/slave/elcapitan-asan-release-wk2-tests/build/buildToTest/WebCore.framework/Versions/A/WebCore+0xab682c)
    #25 0x114e59039 in WebCore::HTMLTreeBuilder::processCharacterBuffer(WebCore::HTMLTreeBuilder::ExternalCharacterTokenBuffer&) (/Volumes/Data/slave/elcapitan-asan-release-wk2-tests/build/buildToTest/WebCore.framework/Versions/A/WebCore+0xbf2039)
    #26 0x114e58021 in WebCore::HTMLTreeBuilder::processCharacter(WebCore::AtomicHTMLToken&) (/Volumes/Data/slave/elcapitan-asan-release-wk2-tests/build/buildToTest/WebCore.framework/Versions/A/WebCore+0xbf1021)
    #27 0x114e551de in WebCore::HTMLTreeBuilder::constructTree(WebCore::AtomicHTMLToken&) (/Volumes/Data/slave/elcapitan-asan-release-wk2-tests/build/buildToTest/WebCore.framework/Versions/A/WebCore+0xbee1de)
    #28 0x114d43f48 in WebCore::HTMLDocumentParser::constructTreeFromHTMLToken(WebCore::HTMLTokenizer::TokenPtr&) (/Volumes/Data/slave/elcapitan-asan-release-wk2-tests/build/buildToTest/WebCore.framework/Versions/A/WebCore+0xadcf48)
    #29 0x114d43cb2 in WebCore::HTMLDocumentParser::pumpTokenizerLoop(WebCore::HTMLDocumentParser::SynchronousMode, bool, WebCore::PumpSession&) (/Volumes/Data/slave/elcapitan-asan-release-wk2-tests/build/buildToTest/WebCore.framework/Versions/A/WebCore+0xadccb2)

SUMMARY: AddressSanitizer: heap-use-after-free ??:0 JSC::WeakSet::vm() const
Shadow bytes around the buggy address:
  0x1c2a0002bff0: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
  0x1c2a0002c000: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
  0x1c2a0002c010: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x1c2a0002c020: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x1c2a0002c030: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
=>0x1c2a0002c040: fd fd fd fd fd fd fd fd fd fd fd fd[fd]fd fd fd
  0x1c2a0002c050: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x1c2a0002c060: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x1c2a0002c070: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x1c2a0002c080: 00 00 00 00 fc fc fc fc fc fc fc fc fc fc fc fc
  0x1c2a0002c090: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Heap right redzone:      fb
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack partial redzone:   f4
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==28827==ABORTING
Comment 1 Filip Pizlo 2016-08-23 15:18:07 PDT
Looking at this now.
Comment 2 Filip Pizlo 2016-08-23 15:37:51 PDT
I think I found the issue.  RegExpConstructor is a large allocation!

I'm working on a fix.
Comment 3 Filip Pizlo 2016-08-23 16:09:26 PDT
Created attachment 286800 [details]
the patch
Comment 4 Geoffrey Garen 2016-08-23 16:13:29 PDT
Comment on attachment 286800 [details]
the patch

r=me
Comment 5 Filip Pizlo 2016-08-23 16:21:49 PDT
Landed in http://trac.webkit.org/changeset/204866