1165799 - Skia crash in SkPixelRef::unlockPixels(); gfx/skia/trunk/src/core/SkBitmap.cpp:1401: failed assertion "SkColorTypeIsValid(fColorType)"

Status: RESOLVED DUPLICATE of bug 1165710

(Core :: Graphics: Canvas2D, defect)

Description

[Chris Peterson [:cpeterson]]

This bug was filed from the Socorro interface and is 
report bp-723c0dd8-a318-478e-96b2-b754b2150518.
=============================================================

STR:
1. Change "shumway.swf.whitelist" perf to "*" to whitelist Shumway for all Flash content.
2. Load http://www.forbes.com/sites/erikkain/2015/05/14/the-biggest-best-looking-video-games-of-may-2015/
3. Wait for the large ad to expand at the top of the page.
4. Scroll down the page.

RESULT:

Crash! bp-723c0dd8-a318-478e-96b2-b754b2150518

In a debug build, I hit this assertion:

gfx/skia/trunk/src/core/SkBitmap.cpp:1401: failed assertion "SkColorTypeIsValid(fColorType)"

#0  SkImageInfo::validate (this=0x1432407e8) at SkBitmap.cpp:1401
#1  0x0000000104a9b770 in SkImageInfo::colorType () at gfx/skia/trunk/include/core/SkImageInfo.h:1323
#2  0x0000000104a9b770 in SkBitmap::validate (this=0x1432407c0) at SkBitmap.cpp:1327
#3  0x0000000104a9eb50 in SkBitmap::freePixels () at gfx/skia/trunk/include/core/SkBitmap.h:991
#4  SkBitmap::~SkBitmap () at SkBitmap.h:45
#5  SkBitmap::~SkBitmap () at gfx/skia/trunk/include/core/SkBitmap.h:43
#6  0x0000000104a9eb50 in SkBitmap::copyTo (this=<value temporarily unavailable, due to optimizations>, dst=<value temporarily unavailable, due to optimizations>, dstColorType=<value temporarily unavailable, due to optimizations>, alloc=<value temporarily unavailable, due to optimizations>) at SkBitmap.cpp:991
#7  0x000000010211ca85 in mozilla::gfx::SourceSurfaceSkia::DrawTargetWillChange (this=<value temporarily unavailable, due to optimizations>) at SourceSurfaceSkia.cpp:143
#8  0x00000001020d67b4 in mozilla::gfx::DrawTargetSkia::MarkChanged () at gfx/2d/DrawTargetSkia.h:997
#9  0x00000001020d67b4 in mozilla::gfx::DrawTargetSkia::ClearRect (this=0x143f3e180, aRect=@0x13f7cec68) at DrawTargetSkia.cpp:937
#10 0x00000001020c01d1 in mozilla::gfx::DrawTarget::DrawCapturedDT (this=0x143f3e180, aCaptureDT=0x143f3e480, aTransform=@0x143240b88) at DrawTargetCapture.cpp:205
#11 0x00000001031602e1 in mozilla::dom::DrawCaptureTask::Run (this=<value temporarily unavailable, due to optimizations>) at CanvasRenderingContext2D.cpp:1575
#12 0x000000010347bce2 in mozilla::MediaTaskQueue::AutoTaskGuard::~AutoTaskGuard () at objdir-osx/dist/include/MediaTaskQueue.h:258
#13 0x000000010347bce2 in mozilla::MediaTaskQueue::Runner::Run (this=0x127482860) at MediaTaskQueue.cpp:259
#14 0x00000001015f4165 in nsCOMPtr<nsIRunnable>::~nsCOMPtr () at nsThreadPool.cpp:226
#15 0x00000001015f4165 in nsCOMPtr<nsIRunnable>::~nsCOMPtr () at objdir-osx/dist/include/nsCOMPtr.h:228
#16 0x00000001015f4165 in nsThreadPool::Run (this=0x129610690) at nsThreadPool.cpp:388
#17 0x00000001015f429d in non-virtual thunk to nsThreadPool::Run() (this=<value temporarily unavailable, due to optimizations>) at nsThreadPool.cpp:240
#18 0x00000001015f1187 in nsCOMPtr<nsIRunnable>::~nsCOMPtr () at nsThread.cpp:866
#19 0x00000001015f1187 in nsCOMPtr<nsIRunnable>::~nsCOMPtr () at objdir-osx/dist/include/nsCOMPtr.h:872
#20 0x00000001015f1187 in nsThread::ProcessNextEvent (this=0x2ce25c7a0, aMayWait=<value temporarily unavailable, due to optimizations>, aResult=0x143240dcf) at nsThread.cpp:388
#21 0x000000010161f09e in NS_ProcessNextEvent (aThread=<value temporarily unavailable, due to optimizations>, aMayWait=false) at nsThreadUtils.cpp:265
#22 0x00000001019a7f1c in mozilla::ipc::MessagePumpForNonMainThreads::Run (this=0x5d4c73700, aDelegate=0x2ceeb15e0) at MessagePump.cpp:326
#23 0x00000001019728ac in MessageLoop::AutoRunState::~AutoRunState () at message_loop.cc:226
#24 0x00000001019728ac in MessageLoop::AutoRunState::~AutoRunState () at ipc/chromium/src/base/message_loop.h:201
#25 0x00000001019728ac in MessageLoop::Run (this=0x400000004103) at message_loop.cc:516
#26 0x00000001015efaef in nsThread::ThreadFunc (aArg=0x2ce25c7a0) at nsThread.cpp:362
#27 0x000000010132df89 in _pt_root (arg=0x144934d90) at nsprpub/pr/src/pthreads/ptthread.c:212
#28 0x00007fff8c41c268 in _pthread_body ()
#29 0x00007fff8c41c1e5 in _pthread_start ()
#30 0x00007fff8c41a41d in thread_start ()

Comment 1

[Chris Peterson [:cpeterson]]

[Tracking Requested - why for this release]:

This is crash regression in Nightly 41.

Matt, I think this crash is a regression from your async canvas bug 857895. I'm running OS X on a Retina MBP. I bisected this regression to this pushlog:

https://hg.mozilla.org/integration/mozilla-inbound/pushloghtml?fromchange=d11b9d29d909&tochange=e01d80922187

Comment 2

[Matt Woodrow (:mattwoodrow)]

I've attached a patch for this to bug 1165710