1254456 - crash in SkPoint::setRectFan

Status: RESOLVED FIXED

(Core :: Graphics, defect)

Description

[adrian]

This bug was filed from the Socorro interface and is 
report bp-951ec2e3-1ec7-44f9-b6ac-da2c02160308.
=============================================================
Firefox crashes when attempting to draw two different fonts to a 2d canvas that will be used as a texture atlas for a webgl context.  The 2d canvas has ctx.globalCompositeOperation = "lighter"; enabled if that has any effect?

it is also broken in beta, but works in aurora as it seem that code no longer exists.

Thanks in advance, this is a huge blocker for us.

Comment 1

[Loic]

Crashes are flagged as critical, not blocker in general.

Could you provide a testcase to reproduce the crash, please.

Comment 2

[Lee Salzman [:lsalzman]]

Attachment: check that SkPaint::textToGlyphs succeeds

Comment 4

[Lee Salzman [:lsalzman]]

Comment on attachment 8729265 [details] [diff] [review]
check that SkPaint::textToGlyphs succeeds

Approval Request Comment
[Feature/regressing bug #]: This works around an issue that has been present at least since 2014 when we were using an old version of Skia before we updated in 46. 45 and below are all affected. 
[User impact if declined]: Specific strings may be used to crash the browser on a null-pointer deference with canvas quite easily. The Skia update that is in 46+ uses incompatible code from what is being patched here and which is not affected at all by this particular bug, which is why this patch can only be applied to release/45 ESR and must bypass aurora/beta/central. Since we can't backport an entire Skia update, it is rather better to just patch the issue in the older Skia.
[Describe test coverage new/current, TreeHerder]: mochitests, reftests
[Risks and why]: The risk is currently low as in the absence of this change, the browser already crashes on these inputs. This simply makes the Skia canvas backend correctly ignore them, which is what it should be doing on these particular inputs (instead of crashing).
[String/UUID change made/needed]: None

Comment 5

[Sylvestre Ledru [:Sylvestre]]

Comment on attachment 8729265 [details] [diff] [review]
check that SkPaint::textToGlyphs succeeds

The number of crashes is quite low, not taking it in release but taking it in esr as we will maintain it for a while

Comment 6

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/releases/mozilla-esr45/rev/e8a805e5f3b09fb7023a17cb20316056f1d539aa