Found in mozilla-inbound: 20170305-11b27d2c87e7 May not be s-s but marking as such to be safe. ==2792==ERROR: AddressSanitizer: use-after-poison on address 0x625000c2bed0 at pc 0x7f5f739f257b bp 0x7ffd96a78ef0 sp 0x7ffd96a78ee8 READ of size 8 at 0x625000c2bed0 thread T0 #0 0x7f5f739f257a in nsTableFrame::GetEffectiveColSpan(nsTableCellFrame const&, nsCellMap*) const /home/worker/workspace/build/src/layout/tables/nsTableFrame.cpp:481:3 #1 0x7f5f73a261e1 in BCMapCellInfo::SetInfo(nsTableRowFrame*, int, BCCellData*, BCMapCellIterator*, nsCellMap*) /home/worker/workspace/build/src/layout/tables/nsTableFrame.cpp:4595:18 #2 0x7f5f73a293e8 in BCMapCellIterator::PeekBEnd(BCMapCellInfo&, unsigned int, BCMapCellInfo&) /home/worker/workspace/build/src/layout/tables/nsTableFrame.cpp:4878:3 #3 0x7f5f73a0723c in nsTableFrame::CalcBCBorders() /home/worker/workspace/build/src/layout/tables/nsTableFrame.cpp:6233:9 #4 0x7f5f73a0b765 in nsTableFrame::GetIncludedOuterBCBorder(mozilla::WritingMode) const /home/worker/workspace/build/src/layout/tables/nsTableFrame.cpp:2839:5 #5 0x7f5f736430b9 in mozilla::SizeComputationInput::InitOffsets(mozilla::WritingMode, mozilla::LogicalSize const&, nsIAtom*, mozilla::SizeComputationInput::ReflowInputFlags, nsMargin const*, nsMargin const*) /home/worker/workspace/build/src/layout/generic/ReflowInput.cpp:2613:9 #6 0x7f5f73642054 in mozilla::SizeComputationInput::SizeComputationInput(nsIFrame*, nsRenderingContext*, mozilla::WritingMode, int) /home/worker/workspace/build/src/layout/generic/ReflowInput.cpp:176:3 #7 0x7f5f73a65bd8 in nsTableWrapperFrame::ChildShrinkWrapISize(nsRenderingContext*, nsIFrame*, mozilla::WritingMode, mozilla::LogicalSize, int, int*) const /home/worker/workspace/build/src/layout/tables/nsTableWrapperFrame.cpp:387:24 #8 0x7f5f73a66ba0 in nsTableWrapperFrame::ComputeAutoSize(nsRenderingContext*, mozilla::WritingMode, mozilla::LogicalSize const&, int, mozilla::LogicalSize const&, mozilla::LogicalSize const&, mozilla::LogicalSize const&, nsIFrame::ComputeSizeFlags) /home/worker/workspace/build/src/layout/tables/nsTableWrapperFrame.cpp:447:18 #9 0x7f5f7370d898 in nsFrame::ComputeSize(nsRenderingContext*, mozilla::WritingMode, mozilla::LogicalSize const&, int, mozilla::LogicalSize const&, mozilla::LogicalSize const&, mozilla::LogicalSize const&, nsIFrame::ComputeSizeFlags) /home/worker/workspace/build/src/layout/generic/nsFrame.cpp:4834:24 #10 0x7f5f7364a4ee in mozilla::ReflowInput::InitConstraints(nsPresContext*, mozilla::LogicalSize const&, nsMargin const*, nsMargin const*, nsIAtom*) /home/worker/workspace/build/src/layout/generic/ReflowInput.cpp:2451:9 #11 0x7f5f73640ed4 in mozilla::ReflowInput::Init(nsPresContext*, mozilla::LogicalSize const*, nsMargin const*, nsMargin const*) /home/worker/workspace/build/src/layout/generic/ReflowInput.cpp:399:3 #12 0x7f5f736aeafa in nsBlockReflowContext::ComputeCollapsedBStartMargin(mozilla::ReflowInput const&, nsCollapsingMargin*, nsIFrame*, bool*, bool*) /home/worker/workspace/build/src/layout/generic/nsBlockReflowContext.cpp:166:25 #13 0x7f5f736a58b7 in nsBlockFrame::ReflowBlockFrame(mozilla::BlockReflowInput&, nsLineList_iterator, bool*) /home/worker/workspace/build/src/layout/generic/nsBlockFrame.cpp:3300:7 #14 0x7f5f73699ab8 in ReflowLine /home/worker/workspace/build/src/layout/generic/nsBlockFrame.cpp:2831:5 #15 0x7f5f73699ab8 in nsBlockFrame::ReflowDirtyLines(mozilla::BlockReflowInput&) /home/worker/workspace/build/src/layout/generic/nsBlockFrame.cpp:2370 #16 0x7f5f7368f9ad in nsBlockFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) /home/worker/workspace/build/src/layout/generic/nsBlockFrame.cpp:1237:3 #17 0x7f5f736f5fe8 in nsContainerFrame::ReflowChild(nsIFrame*, nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, mozilla::WritingMode const&, mozilla::LogicalPoint const&, nsSize const&, unsigned int, nsReflowStatus&, nsOverflowContinuationTracker*) /home/worker/workspace/build/src/layout/generic/nsContainerFrame.cpp:1028:3 #18 0x7f5f736f479f in nsCanvasFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) /home/worker/workspace/build/src/layout/generic/nsCanvasFrame.cpp:716:5 #19 0x7f5f736f5fe8 in nsContainerFrame::ReflowChild(nsIFrame*, nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, mozilla::WritingMode const&, mozilla::LogicalPoint const&, nsSize const&, unsigned int, nsReflowStatus&, nsOverflowContinuationTracker*) /home/worker/workspace/build/src/layout/generic/nsContainerFrame.cpp:1028:3 #20 0x7f5f7379b6b7 in nsHTMLScrollFrame::ReflowScrolledFrame(mozilla::ScrollReflowInput*, bool, bool, mozilla::ReflowOutput*, bool) /home/worker/workspace/build/src/layout/generic/nsGfxScrollFrame.cpp:552:3 #21 0x7f5f7379cbc0 in nsHTMLScrollFrame::ReflowContents(mozilla::ScrollReflowInput*, mozilla::ReflowOutput const&) /home/worker/workspace/build/src/layout/generic/nsGfxScrollFrame.cpp:664:3 #22 0x7f5f737a0418 in nsHTMLScrollFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) /home/worker/workspace/build/src/layout/generic/nsGfxScrollFrame.cpp:1039:3 #23 0x7f5f73706ac4 in nsContainerFrame::ReflowChild(nsIFrame*, nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, int, int, unsigned int, nsReflowStatus&, nsOverflowContinuationTracker*) /home/worker/workspace/build/src/layout/generic/nsContainerFrame.cpp:1072:3 #24 0x7f5f736752ec in mozilla::ViewportFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) /home/worker/workspace/build/src/layout/generic/ViewportFrame.cpp:326:7 #25 0x7f5f7346fd66 in mozilla::PresShell::DoReflow(nsIFrame*, bool) /home/worker/workspace/build/src/layout/base/PresShell.cpp:9250:3 #26 0x7f5f734840e4 in mozilla::PresShell::ProcessReflowCommands(bool) /home/worker/workspace/build/src/layout/base/PresShell.cpp:9423:24 #27 0x7f5f73482ff6 in mozilla::PresShell::DoFlushPendingNotifications(mozilla::ChangesToFlush) /home/worker/workspace/build/src/layout/base/PresShell.cpp:4221:11 #28 0x7f5f7355a96c in FlushPendingNotifications /home/worker/workspace/build/src/obj-firefox/dist/include/nsIPresShell.h:599:5 #29 0x7f5f7355a96c in nsDocumentViewer::LoadComplete(nsresult) /home/worker/workspace/build/src/layout/base/nsDocumentViewer.cpp:972 #30 0x7f5f75a29464 in nsDocShell::EndPageLoad(nsIWebProgress*, nsIChannel*, nsresult) /home/worker/workspace/build/src/docshell/base/nsDocShell.cpp:7636:5 #31 0x7f5f75a25224 in nsDocShell::OnStateChange(nsIWebProgress*, nsIRequest*, unsigned int, nsresult) /home/worker/workspace/build/src/docshell/base/nsDocShell.cpp:7430:7 #32 0x7f5f75a2cc3f in non-virtual thunk to nsDocShell::OnStateChange(nsIWebProgress*, nsIRequest*, unsigned int, nsresult) /home/worker/workspace/build/src/docshell/base/nsDocShell.cpp:7327:13 #33 0x7f5f6e4d0920 in nsDocLoader::DoFireOnStateChange(nsIWebProgress*, nsIRequest*, int&, nsresult) /home/worker/workspace/build/src/uriloader/base/nsDocLoader.cpp:1258:3 #34 0x7f5f6e4cf8b8 in nsDocLoader::doStopDocumentLoad(nsIRequest*, nsresult) /home/worker/workspace/build/src/uriloader/base/nsDocLoader.cpp:842:5 #35 0x7f5f6e4cc616 in nsDocLoader::DocLoaderIsEmpty(bool) /home/worker/workspace/build/src/uriloader/base/nsDocLoader.cpp:732:9 #36 0x7f5f6e4ce714 in nsDocLoader::OnStopRequest(nsIRequest*, nsISupports*, nsresult) /home/worker/workspace/build/src/uriloader/base/nsDocLoader.cpp:614:5 #37 0x7f5f6e4cf2cc in non-virtual thunk to nsDocLoader::OnStopRequest(nsIRequest*, nsISupports*, nsresult) /home/worker/workspace/build/src/uriloader/base/nsDocLoader.cpp:470:14 #38 0x7f5f6ccc697b in mozilla::net::nsLoadGroup::RemoveRequest(nsIRequest*, nsISupports*, nsresult) /home/worker/workspace/build/src/netwerk/base/nsLoadGroup.cpp:634:18 #39 0x7f5f6f52cdbb in nsDocument::DoUnblockOnload() /home/worker/workspace/build/src/dom/base/nsDocument.cpp:8840:7 #40 0x7f5f6f52c95b in nsDocument::UnblockOnload(bool) /home/worker/workspace/build/src/dom/base/nsDocument.cpp:8766:9 #41 0x7f5f6f502b8c in nsDocument::DispatchContentLoadedEvents() /home/worker/workspace/build/src/dom/base/nsDocument.cpp:5293:3 #42 0x7f5f6f5dca02 in applyImpl<nsDocument, void (nsDocument::*)()> /home/worker/workspace/build/src/obj-firefox/dist/include/nsThreadUtils.h:855:12 #43 0x7f5f6f5dca02 in apply<nsDocument, void (nsDocument::*)()> /home/worker/workspace/build/src/obj-firefox/dist/include/nsThreadUtils.h:861 #44 0x7f5f6f5dca02 in mozilla::detail::RunnableMethodImpl<nsDocument*, void (nsDocument::*)(), true, false>::Run() /home/worker/workspace/build/src/obj-firefox/dist/include/nsThreadUtils.h:890 #45 0x7f5f6cb0c9a2 in nsThread::ProcessNextEvent(bool, bool*) /home/worker/workspace/build/src/xpcom/threads/nsThread.cpp:1264:7 #46 0x7f5f6cb09250 in NS_ProcessNextEvent(nsIThread*, bool) /home/worker/workspace/build/src/xpcom/threads/nsThreadUtils.cpp:389:10 #47 0x7f5f6d90de5f in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) /home/worker/workspace/build/src/ipc/glue/MessagePump.cpp:96:21 #48 0x7f5f6d87f1f8 in RunInternal /home/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:238:3 #49 0x7f5f6d87f1f8 in RunHandler /home/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:231 #50 0x7f5f6d87f1f8 in MessageLoop::Run() /home/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:211 #51 0x7f5f72ce639f in nsBaseAppShell::Run() /home/worker/workspace/build/src/widget/nsBaseAppShell.cpp:156:3 #52 0x7f5f76377911 in nsAppStartup::Run() /home/worker/workspace/build/src/toolkit/components/startup/nsAppStartup.cpp:283:19 #53 0x7f5f7654369c in XREMain::XRE_mainRun() /home/worker/workspace/build/src/toolkit/xre/nsAppRunner.cpp:4476:10 #54 0x7f5f76545198 in XREMain::XRE_main(int, char**, mozilla::BootstrapConfig const&) /home/worker/workspace/build/src/toolkit/xre/nsAppRunner.cpp:4654:8 #55 0x7f5f7654645c in XRE_main(int, char**, mozilla::BootstrapConfig const&) /home/worker/workspace/build/src/toolkit/xre/nsAppRunner.cpp:4745:16 #56 0x4dffaf in do_main /home/worker/workspace/build/src/browser/app/nsBrowserApp.cpp:236:10 #57 0x4dffaf in main /home/worker/workspace/build/src/browser/app/nsBrowserApp.cpp:307 #58 0x7f5f87f3382f in __libc_start_main /build/glibc-t3gR2i/glibc-2.23/csu/../csu/libc-start.c:291 #59 0x41c3d8 in _start (/home/user/workspace/browsers/firefox_cnt/firefox+0x41c3d8) 0x625000c2bed0 is located 3536 bytes inside of 8192-byte region [0x625000c2b100,0x625000c2d100) allocated by thread T0 here: #0 0x4b2e4b in malloc /builds/slave/moz-toolchain/src/llvm/projects/compiler-rt/lib/asan/asan_malloc_linux.cc:52:3 #1 0x7f5f85510a24 in PL_ArenaAllocate /home/worker/workspace/build/src/nsprpub/lib/ds/plarena.c:127:27 #2 0x7f5f733eb031 in nsPresArena::Allocate(unsigned int, unsigned long) /home/worker/workspace/build/src/layout/base/nsPresArena.cpp:165:3 #3 0x7f5f7330ebac in AllocateByObjectID /home/worker/workspace/build/src/layout/base/nsPresArena.h:65:12 #4 0x7f5f7330ebac in AllocateByObjectID /home/worker/workspace/build/src/layout/base/nsIPresShell.h:240 #5 0x7f5f7330ebac in operator new /home/worker/workspace/build/src/obj-firefox/dist/include/nsStyleStruct.h:1251 #6 0x7f5f7330ebac in nsRuleNode::ComputeBorderData(void*, nsRuleData const*, nsStyleContext*, nsRuleNode*, nsRuleNode::RuleDetail, mozilla::RuleNodeCacheConditions) /home/worker/workspace/build/src/layout/style/nsRuleNode.cpp:7635 #7 0x7f5f732dac33 in nsRuleNode::WalkRuleTree(nsStyleStructID, nsStyleContext*) /home/worker/workspace/build/src/layout/style/nsRuleNode.cpp:2641:10 #8 0x7f5f71776227 in nsStyleBorder const* nsRuleNode::GetStyleBorder<true>(nsStyleContext*) /home/worker/workspace/build/src/obj-firefox/dist/include/nsStyleStructList.h:124:1 #9 0x7f5f736da687 in DoGetStyleBorder<true> /home/worker/workspace/build/src/obj-firefox/dist/include/nsStyleStructList.h:124:1 #10 0x7f5f736da687 in StyleBorder /home/worker/workspace/build/src/obj-firefox/dist/include/nsStyleStructList.h:124 #11 0x7f5f736da687 in StyleBorder /home/worker/workspace/build/src/obj-firefox/dist/include/nsStyleStructList.h:124 #12 0x7f5f736da687 in nsFrame::DidSetStyleContext(nsStyleContext*) /home/worker/workspace/build/src/layout/generic/nsFrame.cpp:951 #13 0x7f5f73a3ed50 in nsTableRowFrame::DidSetStyleContext(nsStyleContext*) /home/worker/workspace/build/src/layout/tables/nsTableRowFrame.cpp:190:3 #14 0x7f5f736d3713 in nsFrame::Init(nsIContent*, nsContainerFrame*, nsIFrame*) /home/worker/workspace/build/src/layout/generic/nsFrame.cpp:665:3 #15 0x7f5f738cdb61 in nsSplittableFrame::Init(nsIContent*, nsContainerFrame*, nsIFrame*) /home/worker/workspace/build/src/layout/generic/nsSplittableFrame.cpp:22:3 #16 0x7f5f736d1471 in nsContainerFrame::Init(nsIContent*, nsContainerFrame*, nsIFrame*) /home/worker/workspace/build/src/layout/generic/nsContainerFrame.cpp:58:3 #17 0x7f5f73a3eb41 in nsTableRowFrame::Init(nsIContent*, nsContainerFrame*, nsIFrame*) /home/worker/workspace/build/src/layout/tables/nsTableRowFrame.cpp:162:3 #18 0x7f5f734fb3a6 in nsCSSFrameConstructor::InitAndRestoreFrame(nsFrameConstructorState const&, nsIContent*, nsContainerFrame*, nsIFrame*, bool) /home/worker/workspace/build/src/layout/base/nsCSSFrameConstructor.cpp:4973:3 #19 0x7f5f734fe4f1 in nsCSSFrameConstructor::ConstructTableRowOrRowGroup(nsFrameConstructorState&, nsCSSFrameConstructor::FrameConstructionItem&, nsContainerFrame*, nsStyleDisplay const*, nsFrameItems&) /home/worker/workspace/build/src/layout/base/nsCSSFrameConstructor.cpp:2203:3 #20 0x7f5f73510069 in nsCSSFrameConstructor::ConstructFrameFromItemInternal(nsCSSFrameConstructor::FrameConstructionItem&, nsFrameConstructorState&, nsContainerFrame*, nsFrameItems&) /home/worker/workspace/build/src/layout/base/nsCSSFrameConstructor.cpp:3881:7 #21 0x7f5f7351c0c6 in nsCSSFrameConstructor::ConstructFramesFromItem(nsFrameConstructorState&, nsCSSFrameConstructor::FrameConstructionItemList::Iterator&, nsContainerFrame*, nsFrameItems&) /home/worker/workspace/build/src/layout/base/nsCSSFrameConstructor.cpp:6209:3 #22 0x7f5f734fcff4 in ConstructFramesFromItemList /home/worker/workspace/build/src/layout/base/nsCSSFrameConstructor.cpp:10705:5 #23 0x7f5f734fcff4 in nsCSSFrameConstructor::ProcessChildren(nsFrameConstructorState&, nsIContent*, nsStyleContext*, nsContainerFrame*, bool, nsFrameItems&, bool, PendingBinding*, nsIFrame*) /home/worker/workspace/build/src/layout/base/nsCSSFrameConstructor.cpp:10994 #24 0x7f5f734fe640 in nsCSSFrameConstructor::ConstructTableRowOrRowGroup(nsFrameConstructorState&, nsCSSFrameConstructor::FrameConstructionItem&, nsContainerFrame*, nsStyleDisplay const*, nsFrameItems&) /home/worker/workspace/build/src/layout/base/nsCSSFrameConstructor.cpp:2219:5 #25 0x7f5f73510069 in nsCSSFrameConstructor::ConstructFrameFromItemInternal(nsCSSFrameConstructor::FrameConstructionItem&, nsFrameConstructorState&, nsContainerFrame*, nsFrameItems&) /home/worker/workspace/build/src/layout/base/nsCSSFrameConstructor.cpp:3881:7 #26 0x7f5f7351c0c6 in nsCSSFrameConstructor::ConstructFramesFromItem(nsFrameConstructorState&, nsCSSFrameConstructor::FrameConstructionItemList::Iterator&, nsContainerFrame*, nsFrameItems&) /home/worker/workspace/build/src/layout/base/nsCSSFrameConstructor.cpp:6209:3 #27 0x7f5f734fcff4 in ConstructFramesFromItemList /home/worker/workspace/build/src/layout/base/nsCSSFrameConstructor.cpp:10705:5 #28 0x7f5f734fcff4 in nsCSSFrameConstructor::ProcessChildren(nsFrameConstructorState&, nsIContent*, nsStyleContext*, nsContainerFrame*, bool, nsFrameItems&, bool, PendingBinding*, nsIFrame*) /home/worker/workspace/build/src/layout/base/nsCSSFrameConstructor.cpp:10994 #29 0x7f5f734fa96c in nsCSSFrameConstructor::ConstructTable(nsFrameConstructorState&, nsCSSFrameConstructor::FrameConstructionItem&, nsContainerFrame*, nsStyleDisplay const*, nsFrameItems&) /home/worker/workspace/build/src/layout/base/nsCSSFrameConstructor.cpp:2136:5 #30 0x7f5f73510069 in nsCSSFrameConstructor::ConstructFrameFromItemInternal(nsCSSFrameConstructor::FrameConstructionItem&, nsFrameConstructorState&, nsContainerFrame*, nsFrameItems&) /home/worker/workspace/build/src/layout/base/nsCSSFrameConstructor.cpp:3881:7 #31 0x7f5f7351c0c6 in nsCSSFrameConstructor::ConstructFramesFromItem(nsFrameConstructorState&, nsCSSFrameConstructor::FrameConstructionItemList::Iterator&, nsContainerFrame*, nsFrameItems&) /home/worker/workspace/build/src/layout/base/nsCSSFrameConstructor.cpp:6209:3 #32 0x7f5f7352a4bb in ConstructFramesFromItemList /home/worker/workspace/build/src/layout/base/nsCSSFrameConstructor.cpp:10705:5 #33 0x7f5f7352a4bb in nsCSSFrameConstructor::ContentAppended(nsIContent*, nsIContent*, bool) /home/worker/workspace/build/src/layout/base/nsCSSFrameConstructor.cpp:7564 #34 0x7f5f73524d88 in nsCSSFrameConstructor::CreateNeededFrames(nsIContent*) /home/worker/workspace/build/src/layout/base/nsCSSFrameConstructor.cpp:7183:5 #35 0x7f5f73524e35 in nsCSSFrameConstructor::CreateNeededFrames(nsIContent*) /home/worker/workspace/build/src/layout/base/nsCSSFrameConstructor.cpp:7190:7 #36 0x7f5f73436632 in mozilla::GeckoRestyleManager::ProcessPendingRestyles() /home/worker/workspace/build/src/layout/base/GeckoRestyleManager.cpp:464:3 #37 0x7f5f73482e20 in ProcessPendingRestyles /home/worker/workspace/build/src/obj-firefox/dist/include/mozilla/RestyleManagerInlines.h:44:3 #38 0x7f5f73482e20 in mozilla::PresShell::DoFlushPendingNotifications(mozilla::ChangesToFlush) /home/worker/workspace/build/src/layout/base/PresShell.cpp:4184 #39 0x7f5f733f3f77 in FlushPendingNotifications /home/worker/workspace/build/src/layout/base/nsIPresShell.h:608:5 #40 0x7f5f733f3f77 in nsRefreshDriver::Tick(long, mozilla::TimeStamp) /home/worker/workspace/build/src/layout/base/nsRefreshDriver.cpp:1898 SUMMARY: AddressSanitizer: use-after-poison /home/worker/workspace/build/src/layout/tables/nsTableFrame.cpp:481:3 in nsTableFrame::GetEffectiveColSpan(nsTableCellFrame const&, nsCellMap*) const Shadow bytes around the buggy address: 0x0c4a8017d780: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0c4a8017d790: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0c4a8017d7a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0c4a8017d7b0: 00 00 00 00 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 0x0c4a8017d7c0: f7 f7 f7 f7 f7 f7 f7 00 00 00 00 00 00 00 00 00 =>0x0c4a8017d7d0: 00 00 00 00 00 00 00 00 00 00[f7]f7 f7 f7 f7 f7 0x0c4a8017d7e0: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 0x0c4a8017d7f0: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 0x0c4a8017d800: f7 f7 f7 f7 00 00 00 00 00 00 00 00 00 00 00 00 0x0c4a8017d810: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0c4a8017d820: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Heap right redzone: fb Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack partial redzone: f4 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb ==2792==ABORTING

As with bug 1344429, I believe this is a regression from bug 1285874 -- at least, I can reproduce an "AddressSanitizer: use-after-poison" in an ASAN build from that bug's commit: https://treeherder.mozilla.org/#/jobs?repo=mozilla-inbound&revision=85613fa0c5fe&filter-searchStr=asan%20Bo ...but not from the previous commit: https://treeherder.mozilla.org/#/jobs?repo=mozilla-inbound&revision=ae20c5a91d7b&filter-searchStr=asan%20Bo However, note that this bug's testcase doesn't crash 100% reliably. But if I hold down Ctrl+R to trigger a stream of many continuous reloads, I hit the crash within a few seconds. I can also trigger a crash in an up-to-date Nightly build (fresh profile) if I repeatedly reload, too -- so ASAN is not required to trigger the problems here.