asan/msan/tsan fails on morx tests #1225
Description
https://circleci.com/gh/harfbuzz/harfbuzz/37738
https://circleci.com/gh/harfbuzz/harfbuzz/37734
https://circleci.com/gh/harfbuzz/harfbuzz/37740
asan gives a good clue I guess.
Running tests in ./tests/MORX-34.tests
../../../../util/hb-shape fonts/TestMORXThirtyfour.ttf --shaper=ot --unicodes U+0068,U+0061
=================================================================
==49097==ERROR: AddressSanitizer: heap-use-after-free on address 0x6160000009d0 at pc 0x7fe8d03baea0 bp 0x7ffe2aa9f790 sp 0x7ffe2aa9f788
READ of size 4 at 0x6160000009d0 thread T0
#0 0x7fe8d03bae9f in void AAT::StateTableDriver<AAT::InsertionSubtable::EntryData>::drive<AAT::InsertionSubtable::driver_context_t>(AAT::InsertionSubtable::driver_context_t*) /root/project/src/./hb-aat-layout-common.hh:559
#1 0x7fe8d03bae9f in ?? ??:0
#2 0x7fe8d03ba484 in AAT::InsertionSubtable::apply(AAT::hb_aat_apply_context_t*) const /root/project/src/./hb-aat-layout-morx-table.hh:696
#3 0x7fe8d03ba484 in ?? ??:0
#4 0x7fe8d03b4f01 in AAT::hb_aat_apply_context_t::return_t AAT::ChainSubtable::dispatch<AAT::hb_aat_apply_context_t>(AAT::hb_aat_apply_context_t*) const /root/project/src/./hb-aat-layout-morx-table.hh:784
#5 0x7fe8d03b4f01 in ?? ??:0
#6 0x7fe8d03b4a60 in AAT::Chain::apply(AAT::hb_aat_apply_context_t*) const /root/project/src/./hb-aat-layout-morx-table.hh:887
#7 0x7fe8d03b4a60 in ?? ??:0
#8 0x7fe8d03aef3a in AAT::morx::apply(AAT::hb_aat_apply_context_t*) const /root/project/src/./hb-aat-layout-morx-table.hh:960
#9 0x7fe8d03aef3a in ?? ??:0
#10 0x7fe8d03ae67e in hb_aat_layout_substitute(hb_font_t*, hb_buffer_t*) /root/project/src/hb-aat-layout.cc:71
#11 0x7fe8d03ae67e in ?? ??:0
#12 0x7fe8d0428ccc in hb_ot_shape_internal(hb_ot_shape_context_t*) /root/project/src/hb-ot-shape.cc:917
#13 0x7fe8d0428ccc in ?? ??:0
#14 0x7fe8d042884c in _hb_ot_shape /root/project/src/hb-ot-shape.cc:945
#15 0x7fe8d042884c in ?? ??:0
#16 0x7fe8d03aa36a in hb_shape_plan_execute /root/project/src/./hb-shaper-list.hh:43
#17 0x7fe8d03aa36a in ?? ??:0
#18 0x7fe8d03a92a8 in hb_shape_full /root/project/src/hb-shape.cc:141
#19 0x7fe8d03a92a8 in ?? ??:0
#20 0x52eeec in shape_options_t::shape(hb_font_t*, hb_buffer_t*, char const**) /root/project/util/./options.hh:238
#21 0x52eeec in ?? ??:0
#22 0x52e27f in shape_consumer_t<output_buffer_t>::consume_line(char const*, unsigned int, char const*, char const*) /root/project/util/./shape-consumer.hh:67
#23 0x52e27f in ?? ??:0
#24 0x52cef6 in main_font_text_t<shape_consumer_t<output_buffer_t>, 2147483647, 0>::main(int, char**) /root/project/util/./main-font-text.hh:81
#25 0x52cef6 in ?? ??:0
#26 0x52c7b5 in main /root/project/util/hb-shape.cc:164
#27 0x52c7b5 in ?? ??:0
#28 0x7fe8cfa5a09a in __libc_start_main ??:?
#29 0x7fe8cfa5a09a in ?? ??:0
#30 0x41d8c9 in _start ??:?
#31 0x41d8c9 in ?? ??:0
0x6160000009d0 is located 80 bytes inside of 640-byte region [0x616000000980,0x616000000c00)
freed by thread T0 here:
#0 0x4ed4d6 in realloc ??:?
#1 0x4ed4d6 in ?? ??:0
#2 0x7fe8d037bb26 in hb_buffer_t::enlarge(unsigned int) /root/project/src/hb-buffer.cc:138
#3 0x7fe8d037bb26 in ?? ??:0
#4 0x7fe8d037bdae in hb_buffer_t::make_room_for(unsigned int, unsigned int) /root/project/src/hb-buffer.cc:161
#5 0x7fe8d037bdae in ?? ??:0
#6 0x7fe8d03bb88b in hb_buffer_t::output_glyph(unsigned int) /root/project/src/./hb-buffer.hh:229
#7 0x7fe8d03bb88b in ?? ??:0
#8 0x7fe8d03bb592 in AAT::InsertionSubtable::driver_context_t::transition(AAT::StateTableDriver<AAT::InsertionSubtable::EntryData>*, AAT::Entry<AAT::InsertionSubtable::EntryData> const*) /root/project/src/./hb-aat-layout-morx-table.hh:651
#9 0x7fe8d03bb592 in ?? ??:0
#10 0x7fe8d03baaad in void AAT::StateTableDriver<AAT::InsertionSubtable::EntryData>::drive<AAT::InsertionSubtable::driver_context_t>(AAT::InsertionSubtable::driver_context_t*) /root/project/src/./hb-aat-layout-common.hh:585
#11 0x7fe8d03baaad in ?? ??:0
#12 0x7fe8d03ba484 in AAT::InsertionSubtable::apply(AAT::hb_aat_apply_context_t*) const /root/project/src/./hb-aat-layout-morx-table.hh:696
#13 0x7fe8d03ba484 in ?? ??:0
#14 0x7fe8d03b4f01 in AAT::hb_aat_apply_context_t::return_t AAT::ChainSubtable::dispatch<AAT::hb_aat_apply_context_t>(AAT::hb_aat_apply_context_t*) const /root/project/src/./hb-aat-layout-morx-table.hh:784
#15 0x7fe8d03b4f01 in ?? ??:0
#16 0x7fe8d03b4a60 in AAT::Chain::apply(AAT::hb_aat_apply_context_t*) const /root/project/src/./hb-aat-layout-morx-table.hh:887
#17 0x7fe8d03b4a60 in ?? ??:0
#18 0x7fe8d03aef3a in AAT::morx::apply(AAT::hb_aat_apply_context_t*) const /root/project/src/./hb-aat-layout-morx-table.hh:960
#19 0x7fe8d03aef3a in ?? ??:0
#20 0x7fe8d03ae67e in hb_aat_layout_substitute(hb_font_t*, hb_buffer_t*) /root/project/src/hb-aat-layout.cc:71
#21 0x7fe8d03ae67e in ?? ??:0
#22 0x7fe8d0428ccc in hb_ot_shape_internal(hb_ot_shape_context_t*) /root/project/src/hb-ot-shape.cc:917
#23 0x7fe8d0428ccc in ?? ??:0
#24 0x7fe8d042884c in _hb_ot_shape /root/project/src/hb-ot-shape.cc:945
#25 0x7fe8d042884c in ?? ??:0
#26 0x7fe8d03aa36a in hb_shape_plan_execute /root/project/src/./hb-shaper-list.hh:43
#27 0x7fe8d03aa36a in ?? ??:0
#28 0x7fe8d03a92a8 in hb_shape_full /root/project/src/hb-shape.cc:141
#29 0x7fe8d03a92a8 in ?? ??:0
#30 0x52eeec in shape_options_t::shape(hb_font_t*, hb_buffer_t*, char const**) /root/project/util/./options.hh:238
#31 0x52eeec in ?? ??:0
#32 0x52e27f in shape_consumer_t<output_buffer_t>::consume_line(char const*, unsigned int, char const*, char const*) /root/project/util/./shape-consumer.hh:67
#33 0x52e27f in ?? ??:0
#34 0x52cef6 in main_font_text_t<shape_consumer_t<output_buffer_t>, 2147483647, 0>::main(int, char**) /root/project/util/./main-font-text.hh:81
#35 0x52cef6 in ?? ??:0
#36 0x52c7b5 in main /root/project/util/hb-shape.cc:164
#37 0x52c7b5 in ?? ??:0
#38 0x7fe8cfa5a09a in __libc_start_main ??:?
#39 0x7fe8cfa5a09a in ?? ??:0
previously allocated by thread T0 here:
#0 0x4ed4d6 in realloc ??:?
#1 0x4ed4d6 in ?? ??:0
#2 0x7fe8d037bb02 in hb_buffer_t::enlarge(unsigned int) /root/project/src/hb-buffer.cc:137
#3 0x7fe8d037bb02 in ?? ??:0
#4 0x7fe8d037c6b2 in hb_buffer_t::add(unsigned int, unsigned int) /root/project/src/hb-buffer.cc:260
#5 0x7fe8d037c6b2 in ?? ??:0
#6 0x7fe8d0380363 in void hb_buffer_add_utf<hb_utf8_t>(hb_buffer_t*, hb_utf8_t::codepoint_t const*, int, unsigned int, int) /root/project/src/hb-buffer.cc:1522
#7 0x7fe8d0380363 in ?? ??:0
#8 0x52ec28 in shape_options_t::populate_buffer(hb_buffer_t*, char const*, int, char const*, char const*) /root/project/util/./options.hh:209
#9 0x52ec28 in ?? ??:0
#10 0x52e20b in shape_consumer_t<output_buffer_t>::consume_line(char const*, unsigned int, char const*, char const*) /root/project/util/./shape-consumer.hh:64
#11 0x52e20b in ?? ??:0
#12 0x52cef6 in main_font_text_t<shape_consumer_t<output_buffer_t>, 2147483647, 0>::main(int, char**) /root/project/util/./main-font-text.hh:81
#13 0x52cef6 in ?? ??:0
#14 0x52c7b5 in main /root/project/util/hb-shape.cc:164
#15 0x52c7b5 in ?? ??:0
#16 0x7fe8cfa5a09a in __libc_start_main ??:?
#17 0x7fe8cfa5a09a in ?? ??:0
SUMMARY: AddressSanitizer: heap-use-after-free (/root/project/src/.libs/libharfbuzz.so.0+0x5ee9f)
Shadow bytes around the buggy address:
0x0c2c7fff80e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c2c7fff80f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c2c7fff8100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c2c7fff8110: 00 00 00 00 fa fa fa fa fa fa fa fa fa fa fa fa
0x0c2c7fff8120: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
=>0x0c2c7fff8130: fd fd fd fd fd fd fd fd fd fd[fd]fd fd fd fd fd
0x0c2c7fff8140: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x0c2c7fff8150: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x0c2c7fff8160: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x0c2c7fff8170: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x0c2c7fff8180: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
Shadow gap: cc
==49097==ABORTING