When running mozilla with libumem ...
env LD_PRELOAD=libumem.so.1 UMEM_DEBUG=audit UMEM_LOGGING=transaction \
/usr/sfw/bin/mozilla about:mozilla
... the browser crashes because a heap memory corruption problem
is detected by umem.
% pstack core
core 'core' of 851: /usr/sfw/bin/../lib/mozilla/mozilla-bin -UILocale en-US
-contentLocale
----------------- lwp# 1 / thread# 1 --------------------
d1f19295 _lwp_kill (1, 6) + 15
d1eddfc8 raise (6) + 22
cdac8ef1 __1cNnsProfileLockSFatalSignalHandler6Fi_v_ (6, 0, 80436f0) + bd
d1f17d7f __sighndlr (6, 0, 80436f0, cdac8e34) + f
d1f0db00 call_user_handler (6, 0, 80436f0) + 247
d1f0dc88 sigacthandler (6, 0, 80436f0) + bc
--- called from signal handler with signal 6 (SIGABRT) ---
d1f19295 _lwp_kill (1, 6) + 15
d1eddfc8 raise (6) + 22
d1f76072 umem_do_abort (8c251a4, d1f96000, cd933a70, 80439a0, d1f78e57,
d1f84aec) + 28
d1f761ab umem_err_recoverable (d1f84aec) + 49
d1f78e57 umem_error (1, 80c2a10, 8c22f60) + 481
d1f7afe1 umem_free (8c22f60, f) + f9
d1f77e23 process_free (8c22f68, 1, 0, 8043a3c, d16367af, 8c22f68) + 54
d1f77ed9 free (8c22f68) + 17
d16367af ft_free (8c1c148, 8c22f68) + 1b
d1636d3a FT_Free (8c1c148, 8c308e0) + 2a
d166d2b3 PCF_Face_Done (8c308c8) + d7
d163f3d1 destroy_face (8c1c148, 8c308c8, 8da4008) + 175
d1640fee FT_Done_Face (8c308c8) + 92
d16cbd62 _XftUncacheFiles (81170c8, 9a9d508, d16e4000, 81170c8, 9a9d508,
d16e4000) + aa
d16ccdab XftFontOpenInfo (81170c8, 9a9d508, 8043bcc) + 17f
d16cd1f7 XftFontOpenPattern (81170c8, 9a9d508) + 47
cd96bcad __1cJnsFontXftKGetXftFont6M_pnI_XftFont__ (9aafbe8) + 5b
cd969d10 __1cQnsFontMetricsXftIFindFont6MI_pnJnsFontXft__ (9a96248, 61) + b5
cd96907c __1cQnsFontMetricsXftLRealizeFont6M_I_ (9a96248) + 1c
cd96838e
__1cQnsFontMetricsXftEInit6MrknGnsFont_pnHnsIAtom_pnQnsIDeviceContext__I_
(9a96248, 97dc6d8, 8a5d7f8, 92811c8) + 3ae
d01a0eae
__1cLnsFontCacheNGetMetricsFor6MrknGnsFont_pnHnsIAtom_rpnOnsIFontMetrics__I_
(9979e50, 97dc6d8, 8a5d7f8, 8043de4) + 164
d019f700
__1cRDeviceContextImplNGetMetricsFor6MrknGnsFont_pnHnsIAtom_rpnOnsIFontMetrics__I_
(92811c8, 97dc6d8, 8a5d7f8, 8043de4) + 6e
ce5cb26a __1cNnsPresContextNGetMetricsFor6MrknGnsFont_ppnOnsIFontMetrics__I_
(9784008, 97dc6d8, 8043e20) + 5a
ce63f33c
__1cKCalcLength6FrknKnsCSSValue_pknGnsFont_pnOnsStyleContext_pnOnsIPresContext_ri_i_
(8043fa8, 0, 9843598, 9784008, 8043eb4) + 166
ce63f718
__1cISetCoord6FrknKnsCSSValue_rnMnsStyleCoord_rk3ipnOnsStyleContext_pnOnsIPresContext_ri_i_
(8043fa8, 8043e80, 8043e88, 2c, 9843598, 9784008) + 188
ce6454d4
__1cKnsRuleNodeSComputePaddingData6MpnNnsStyleStruct_rknLnsCSSStruct_pnOnsStyleContext_p0rkn0AKRuleDetail_i_pk1_
(984356c, 97dc4a4, 8043f40, 9843598, 984356c, 8043f14) + 11f
ce6415b6
__1cKnsRuleNodeMWalkRuleTree6MknPnsStyleStructID_pnOnsStyleContext_pnKnsRuleData_pnLnsCSSStruct__pknNnsStyleStruct__
(984356c, 10, 9843598, 80440b0, 8043f40) + 254
ce640c10
__1cKnsRuleNodeOGetPaddingData6MpnOnsStyleContext__pknNnsStyleStruct__
(984356c, 9843598) + c0
ce6479cf
__1cKnsRuleNodeMGetStyleData6MnPnsStyleStructID_pnOnsStyleContext_i_pknNnsStyleStruct__
(984356c, 10, 9843598, 1) + af
ce6583d4
__1cOnsStyleContextMGetStyleData6MnPnsStyleStructID__pknNnsStyleStruct__
(9843598, 10) + 44
ce47f0b3 __1cWIsPercentageAwareChild6FpknInsIFrame__i_ (98435e4) + 43
ce481eb6
__1cMnsBlockFrameRReflowInlineFrame6MrnSnsBlockReflowState_rnMnsLineLayout_nTnsLineList_iterator_pnInsIFrame_pC_I_
(984345c, 80448f8, 8044220, 9843b3c, 98435e4, 80441e4) + 44
ce481cbc
__1cMnsBlockFrameUDoReflowInlineFrames6MrnSnsBlockReflowState_rnMnsLineLayout_nTnsLineList_iterator_pipCii_I_
(984345c, 80448f8, 8044220, 9843b3c, 8044890, 80446b0) + 18c
ce481a9f
__1cMnsBlockFrameYDoReflowInlineFramesAuto6MrnSnsBlockReflowState_nTnsLineList_iterator_pipCii_I_
(984345c, 80448f8, 9843b3c, 8044890, 80446b0, 0) + 7f
ce481901
__1cMnsBlockFrameSReflowInlineFrames6MrnSnsBlockReflowState_nTnsLineList_iterator_piii_I_
(984345c, 80448f8, 9843b3c, 8044890, 0, 0) + 6f
ce48073d
__1cMnsBlockFrameKReflowLine6MrnSnsBlockReflowState_nTnsLineList_iterator_pii_I_
(984345c, 80448f8, 9843b3c, 8044890, 0) + 460
ce47ff1c __1cMnsBlockFrameQReflowDirtyLines6MrnSnsBlockReflowState__I_
(984345c, 80448f8) + 1d0
ce47eb3f
__1cMnsBlockFrameGReflow6MpnOnsIPresContext_rnTnsHTMLReflowMetrics_rknRnsHTMLReflowState_rI_I_
(984345c, 9784008, 8044be4, 8044d0c, 8044e74) + 3a8
ce486d95
__1cUnsBlockReflowContextLReflowBlock6MrknGnsRect_irnSnsCollapsingMargin_irnInsMargin_rnRnsHTMLReflowState_rI_I_
(8044ba0, 8044cf0, 0, 8045118, 1, 8044dc0) + 451
ce48143f
__1cMnsBlockFrameQReflowBlockFrame6MrnSnsBlockReflowState_nTnsLineList_iterator_pi_I_
(9843304, 80450b8, 97dc2f0, 8045050) + 2c8
ce480362
__1cMnsBlockFrameKReflowLine6MrnSnsBlockReflowState_nTnsLineList_iterator_pii_I_
(9843304, 80450b8, 97dc2f0, 8045050, 0) + 85
ce47ff1c __1cMnsBlockFrameQReflowDirtyLines6MrnSnsBlockReflowState__I_
(9843304, 80450b8) + 1d0
ce47eb3f
__1cMnsBlockFrameGReflow6MpnOnsIPresContext_rnTnsHTMLReflowMetrics_rknRnsHTMLReflowState_rI_I_
(9843304, 9784008, 80453a4, 80454cc, 8045634) + 3a8
ce486d95
__1cUnsBlockReflowContextLReflowBlock6MrknGnsRect_irnSnsCollapsingMargin_irnInsMargin_rnRnsHTMLReflowState_rI_I_
(8045360, 80454b0, 1, 80458d8, 1, 8045580) + 451
ce48143f
__1cMnsBlockFrameQReflowBlockFrame6MrnSnsBlockReflowState_nTnsLineList_iterator_pi_I_
(98430a0, 8045878, 97dc41c, 8045810) + 2c8
ce480362
__1cMnsBlockFrameKReflowLine6MrnSnsBlockReflowState_nTnsLineList_iterator_pii_I_
(98430a0, 8045878, 97dc41c, 8045810, 0) + 85
ce47ff1c __1cMnsBlockFrameQReflowDirtyLines6MrnSnsBlockReflowState__I_
(98430a0, 8045878) + 1d0
ce47eb3f
__1cMnsBlockFrameGReflow6MpnOnsIPresContext_rnTnsHTMLReflowMetrics_rknRnsHTMLReflowState_rI_I_
(98430a0, 9784008, 8045ae0, 8045b2c, 8045e64) + 3a8
ce48d54b
__1cQnsContainerFrameLReflowChild6MpnInsIFrame_pnOnsIPresContext_rnTnsHTMLReflowMetrics_rknRnsHTMLReflowState_iiIrI_I_
(832a4e0, 98430a0, 9784008, 8045ae0, 8045b2c, 0) + 7b
ce49fe9a
__1cLCanvasFrameGReflow6MpnOnsIPresContext_rnTnsHTMLReflowMetrics_rknRnsHTMLReflowState_rI_I_
(832a4e0, 9784008, 8045e04, 8045c9c, 8045e64) + 159
ce577692
__1cTnsBoxToBlockAdaptorGReflow6MrnQnsBoxLayoutState_pnOnsIPresContext_rnTnsHTMLReflowMetrics_rknRnsHTMLReflowState_rIiiiii_I_
(9842f0c, 80461d8, 9784008, 8045e04, 8046358, 8045e64) + 352
ce5771ca __1cTnsBoxToBlockAdaptorIDoLayout6MrnQnsBoxLayoutState__I_ (9842f0c,
80461d8) + 106
ce56dd62 __1cFnsBoxGLayout6MrnQnsBoxLayoutState__I_ (9842f0c, 80461d8) + 32
ce5694aa __1cQnsScrollBoxFrameIDoLayout6MrnQnsBoxLayoutState__I_ (832a70c,
80461d8) + 191
ce56dd62 __1cFnsBoxGLayout6MrnQnsBoxLayoutState__I_ (832a740, 80461d8) + 32
ce578d73
__1cOnsContainerBoxNLayoutChildAt6FrnQnsBoxLayoutState_pnGnsIBox_rknGnsRect__I_
(80461d8, 832a740, 8046020) + c1
ce49cede
__1cVnsGfxScrollFrameInnerJLayoutBox6MrnQnsBoxLayoutState_pnGnsIBox_rknGnsRect__I_
(9a52e18, 80461d8, 832a740, 8046020) + 1e
ce49d13a __1cVnsGfxScrollFrameInnerGLayout6MrnQnsBoxLayoutState__I_ (9a52e18,
80461d8) + 14c
ce49cf2d __1cQnsGfxScrollFrameIDoLayout6MrnQnsBoxLayoutState__I_ (832a604,
80461d8) + 3d
ce56dd62 __1cFnsBoxGLayout6MrnQnsBoxLayoutState__I_ (832a638, 80461d8) + 32
ce57298f
__1cKnsBoxFrameGReflow6MpnOnsIPresContext_rnTnsHTMLReflowMetrics_rknRnsHTMLReflowState_rI_I_
(832a604, 9784008, 804630c, 8046358, 804668c) + 1ec
ce49c462
__1cQnsGfxScrollFrameGReflow6MpnOnsIPresContext_rnTnsHTMLReflowMetrics_rknRnsHTMLReflowState_rI_I_
(832a604, 9784008, 804630c, 8046358, 804668c) + 40
ce48d54b
__1cQnsContainerFrameLReflowChild6MpnInsIFrame_pnOnsIPresContext_rnTnsHTMLReflowMetrics_rknRnsHTMLReflowState_iiIrI_I_
(832a3e8, 832a604, 9784008, 804630c, 8046358, 0) + 7b
ce4e9106
__1cNViewportFrameGReflow6MpnOnsIPresContext_rnTnsHTMLReflowMetrics_rknRnsHTMLReflowState_rI_I_
(832a3e8, 9784008, 8046540, 804658c, 804668c) + 129
ce4cbfc7 __1cJPresShellNInitialReflow6Mii_I_ (9717588, 2620, 2410) + 1e3
ce5da94e __1cNnsContentSinkLStartLayout6Mi_v_ (97d8008, 1) + c9
ce7d47cb __1cQnsXMLContentSinkLStartLayout6M_v_ (97d8008) + cb
ce7d2e95 __1cQnsXMLContentSinkNDidBuildModel6M_I_ (97d8008, 0, ce22739c,
8046814, ce1eb12d, 9a069b8) + 245
ce1d3e79
__1cNnsExpatDriverNDidBuildModel6MIipnJnsIParser_pnOnsIContentSink__I_
(9a069b8, 0, 1, 984ad30, 97d8054) + 29
ce1eb12d __1cInsParserNDidBuildModel6MI_I_ (984ad30, 0) + 4b
ce1ec551 __1cInsParserLResumeParse6Miii_I_ (984ad30, 1, 1, 1) + 25a
ce1edc86 __1cInsParserNOnStopRequest6MpnKnsIRequest_pnLnsISupports_I_I_
(984ad30, 8abb390, 0, 0) + 30b
ce053a90
__1cSnsDocumentOpenInfoNOnStopRequest6MpnKnsIRequest_pnLnsISupports_I_I_
(99b0db8, 8abb390, 0, 0) + 80
cef36624 __1cMnsJARChannelNOnStopRequest6MpnKnsIRequest_pnLnsISupports_I_I_
(8abb390, 93943f8, 0, 0) + 43
cee8c74e __1cRnsInputStreamPumpLOnStateStop6M_I_ (93943f8) + 7e
cee8c45a __1cRnsInputStreamPumpSOnInputStreamReady6MpnTnsIAsyncInputStream__I_
(93943f8, 984ade8) + 39
d0274735 __1cXnsInputStreamReadyEventMEventHandler6FpnHPLEvent__pv_ (939445c)
+ 34
d028d43f PL_HandleEvent (939445c) + 1f
d028d353 PL_ProcessPendingEvents (80f9568) + 6d
d028f371 __1cQnsEventQdDueueImplUProcessPendingEvents6M_I_ (81b6e78, 887ab48,
d186f346, 887aba8, 1, 81b6e78) + 3c
cda63062 __1cYevent_processor_callback6FpnL_GIOChannel_nMGIOCondition_pv_i_
(887aba8, 1, 81b6e78, d1851f76, 85b1540) + 12
d186f346 g_io_unix_dispatch (d18af9a8, 2, 80e9bc0, 64, 3, 8) + 32
d18af508 g_source_callback_funcs (81b6e78, 0, feedfabb, 1789, 85b3548,
a94bfda5)
cda63050 __1cYevent_processor_callback6FpnL_GIOChannel_nMGIOCondition_pv_i_ ()
----------------- lwp# 2 / thread# 2 --------------------
d1f18d25 __pollsys (ced1dd04, 1, 0, 0) + 15
d1edb292 poll (ced1dd04, 1, ffffffff) + 52
d1db03bd _pr_poll_with_poll (8112a1c, 1, ffffffff, ced1df64, ceea592a,
8112a1c) + 2d5
d1db0531 PR_Poll (8112a1c, 1, ffffffff) + 11
ceea592a __1cYnsSocketTransportServiceEPoll6M_i_ (81126c8) + 58
ceea5ffd __1cYnsSocketTransportServiceDRun6M_I_ (81126c8) + 18f
d0291262 __1cInsThreadEMain6Fpv_v_ (82551e8) + 32
d1db15d3 _pt_root (81a6308) + 9e
d1f17a30 _thr_setup (d1fb2400) + 51
d1f17c80 _lwp_start (d1fb2400, 0, 0, 0, 0, 0)
----------------- lwp# 3 / thread# 3 --------------------
d1f17cd9 __lwp_park (858c4cc, 8514f18, cdb3dec8) + 19
d1f11fe9 cond_wait_queue (858c4cc, 8514f18, cdb3dec8, 0) + 3e
d1f12390 cond_wait_common (858c4cc, 8514f18, cdb3dec8) + 1e9
d1f125bf _cond_timedwait (858c4cc, 8514f18, cdb3df48) + 4a
d1f12650 cond_timedwait (858c4cc, 8514f18, cdb3df48) + 27
d1f1268f pthread_cond_timedwait (858c4cc, 8514f18, cdb3df48) + 21
d1dac4d8 pt_TimedWait (858c4cc, 8514f18, 5b8d80) + b8
d1dac6a7 PR_WaitCondVar (858c4c8, 5b8d80) + 64
cee82eb7 __1cOnsIOThreadPoolKThreadFunc6Fpv_v_ (8525558) + 75
d1db15d3 _pt_root (846c088) + 9e
d1f17a30 _thr_setup (ce2e0000) + 51
d1f17c80 _lwp_start (ce2e0000, 0, 0, 0, 0, 0)
----------------- lwp# 4 / thread# 4 --------------------
d1f17cd9 __lwp_park (8894e1c, 8834008, cd40deb8) + 19
d1f11fe9 cond_wait_queue (8894e1c, 8834008, cd40deb8, 0) + 3e
d1f12390 cond_wait_common (8894e1c, 8834008, cd40deb8) + 1e9
d1f125bf _cond_timedwait (8894e1c, 8834008, cd40df38) + 4a
d1f12650 cond_timedwait (8894e1c, 8834008, cd40df38) + 27
d1f1268f pthread_cond_timedwait (8894e1c, 8834008, cd40df38) + 21
d1dac4d8 pt_TimedWait (8894e1c, 8834008, 7fe7) + b8
d1dac6a7 PR_WaitCondVar (8894e18, 7fe7) + 64
d029417e __1cLTimerThreadDRun6M_I_ (8865a60) + 16e
d0291262 __1cInsThreadEMain6Fpv_v_ (8894de8) + 32
d1db15d3 _pt_root (887f308) + 9e
d1f17a30 _thr_setup (ce2e0400) + 51
d1f17c80 _lwp_start (ce2e0400, 0, 0, 0, 0, 0)
----------------- lwp# 5 / thread# 5 --------------------
d1f17cd9 __lwp_park (d1f9f7b8, d1f9f7d8, cd27df68) + 19
d1f11fe9 cond_wait_queue (d1f9f7b8, d1f9f7d8, cd27df68, 0) + 3e
d1f12390 cond_wait_common (d1f9f7b8, d1f9f7d8, cd27df68) + 1e9
d1f1261b _cond_timedwait (d1f9f7b8, d1f9f7d8, cd27dfa8) + a6
d1f76800 umem_update_thread (0) + 171
d1f17a30 _thr_setup (ce2e0800) + 51
d1f17c80 _lwp_start (ce2e0800, 0, 0, 0, 0, 0)
% mdb - core
Loading modules: [ libumem.so.1 libc.so.1 libuutil.so.1 ld.so.1 ]
> ::umem_status
Status: ready and active
Concurrency: 2
Logs: transaction=64k (inactive)
Message buffer:
umem allocator: redzone violation: write past end of buffer
buffer=8c22f60 bufctl=8c25140 cache: umem_alloc_16
previous transaction on buffer 8c22f60:
thread=1 time=T-1.302015304 slab=8af26c0 cache: umem_alloc_16
libumem.so.1'?? (0xd1f7a0d5)
libumem.so.1'umem_cache_alloc+0x144
libumem.so.1'umem_alloc+0xcc
libumem.so.1'malloc+0x27
libfreetype.so.6'?? (0xd1636764)
libfreetype.so.6'FT_Alloc+0x30
libfreetype.so.6'?? (0xd166c5e1)
libfreetype.so.6'?? (0xd166cd28)
libfreetype.so.6'?? (0xd166d330)
libfreetype.so.6'?? (0xd163f57a)
libfreetype.so.6'FT_Open_Face+0x24e
libfreetype.so.6'FT_New_Face+0x3c
libXft.so.2'XftFontOpenInfo+0x15c
libXft.so.2'XftFontOpenPattern+0x47
libgfx_gtk.so'?? (0xcd96bcad)
umem: heap corruption detected
stack trace:
libumem.so.1'?? (0xd1f7619b)
libumem.so.1'?? (0xd1f78e57)
libumem.so.1'umem_free+0xf9
libumem.so.1'?? (0xd1f77e23)
libumem.so.1'free+0x17
libfreetype.so.6'?? (0xd16367af)
libfreetype.so.6'FT_Free+0x2a
libfreetype.so.6'?? (0xd166d2b3)
libfreetype.so.6'?? (0xd163f3d1)
libfreetype.so.6'FT_Done_Face+0x92
libXft.so.2'?? (0xd16cbd62)
libXft.so.2'XftFontOpenInfo+0x17f
libXft.so.2'XftFontOpenPattern+0x47
libgfx_gtk.so'?? (0xcd96bcad)
libgfx_gtk.so'?? (0xcd969d10)
libgfx_gtk.so'?? (0xcd96907c)
libgfx_gtk.so'?? (0xcd96838e)
libgkgfx.so'__1cLnsFontCacheNGetMetricsFor6MrknGnsFont_pnHnsIAtom_rpnOnsIFontMetrics__I_+0x164
> 8c25140$<bufctl_audit
ADDR BUFADDR TIMESTAMP THREAD
CACHE LASTLOG CONTENTS
8c25140 8c22f60 290f71f633 1
80c2a10 80bc258 0
libumem.so.1`umem_cache_alloc_debug+0x14f
libumem.so.1`umem_cache_alloc+0x144
libumem.so.1`umem_alloc+0xcc
libumem.so.1`malloc+0x27
libfreetype.so.6`ft_alloc+0x1c
libfreetype.so.6`FT_Alloc+0x30
libfreetype.so.6`pcf_interpret_style+0x409
libfreetype.so.6`pcf_load_font+0x608
libfreetype.so.6`PCF_Face_Init+0x28
libfreetype.so.6`open_face+0xf2
libfreetype.so.6`FT_Open_Face+0x24e
libfreetype.so.6`FT_New_Face+0x3c
libXft.so.2`XftFontOpenInfo+0x15c
libXft.so.2`XftFontOpenPattern+0x47
libgfx_gtk.so`__1cJnsFontXftKGetXftFont6M_pnI_XftFont__+0x5b
=======================================================================
The corruption happens because of the following patch:
X-src-20060331/XW_NV/open-src/lib/freetype/freetype-2.1.10.patch
--- src/pcf/pcfread.c Fri Sep 23 14:50:03 2004
+++ new/src/pcf/pcfread.c Fri Sep 23 14:39:23 2005
...
@@ -947,10 +954,20 @@
if ( !parts || !len )
{
- if ( FT_ALLOC( face->style_name, 8 ) )
- return error;
- ft_strcpy( face->style_name, "Regular" );
- face->style_name[7] = '\0';
+ if ( weight == 0 )
+ {
+ if ( FT_ALLOC( face->style_name, 8 ) )
+ return error;
+ ft_strcpy( face->style_name, "Regular" );
+ face->style_name[7] = '\0';
+ }
+ else
+ {
+ if ( FT_ALLOC( face->style_name, 7 ) )
<<<<<<<<<<<<<<<<<<<<<<<
+ return error;
+ ft_strcpy( face->style_name, "Medium" );
+ face->style_name[7] = '\0';
<<<<<<<<<<<<<<<<<<<<<<<
+ }
}
else
{
It allocates 7 bytes, copies the six character (plus null byte)
string "Medium", and corrupts the byte at offset 7 by writing
an additional null byte. The patch should be fixed, to change
the code like this:
if ( FT_ALLOC( face->style_name, 7 ) )
return error;
ft_strcpy( face->style_name, "Medium" );
face->style_name[6] = '\0';
This message posted from opensolaris.org
