1278305 - NULL deref crash [@ gfxContext::ChangeTransform]

Status: RESOLVED WORKSFORME

(Core :: Graphics: Layers, defect, P3)

Description

[Jesse Schwartzentruber (:truber)]

The attached testcase crashes on mozilla-central revision e27fe24a746f. Not sure if this is graphics or layout but doesn't reproduce on Linux.

Backtrace (m-c-e27fe24a746f-opt-asan)
Crash Annotation GraphicsCriticalError: |[0][GFX1-]: Invalid target in gfxContext::ForDrawTarget 0x0 (t=7.88986) [GFX1-]: Invalid target in gfxContext::ForDrawTarget 0x0
ASAN:DEADLYSIGNAL
=================================================================
==14290==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000068 (pc 0x000110acb97f bp 0x7fff5584ca90 sp 0x7fff5584c840 T0)
    #0 0x110acb97e in gfxContext::ChangeTransform(mozilla::gfx::Matrix const&, bool) (/Users/truber/src/m/c/ff64-asan-release/dist/Nightly.app/Contents/MacOS/XUL+0x28cc97e)
    #1 0x110abd9e9 in gfxContext::SetMatrix(gfxMatrix const&) (/Users/truber/src/m/c/ff64-asan-release/dist/Nightly.app/Contents/MacOS/XUL+0x28be9e9)
    #2 0x116d0de2b in nsSVGIntegrationUtils::PaintFramesWithEffects(nsSVGIntegrationUtils::PaintFramesParams const&) (/Users/truber/src/m/c/ff64-asan-release/dist/Nightly.app/Contents/MacOS/XUL+0x8b0ee2b)
    #3 0x116749f93 in nsDisplaySVGEffects::PaintAsLayer(nsDisplayListBuilder*, nsRenderingContext*, mozilla::layers::LayerManager*) (/Users/truber/src/m/c/ff64-asan-release/dist/Nightly.app/Contents/MacOS/XUL+0x854af93)
    #4 0x1165d41f0 in mozilla::FrameLayerBuilder::PaintItems(nsTArray<mozilla::FrameLayerBuilder::ClippedDisplayItem>&, mozilla::gfx::IntRectTyped<mozilla::gfx::UnknownUnits> const&, gfxContext*, nsRenderingContext*, nsDisplayListBuilder*, nsPresContext*, mozilla::gfx::IntPointTyped<mozilla::gfx::UnknownUnits> const&, float, float, int) (/Users/truber/src/m/c/ff64-asan-release/dist/Nightly.app/Contents/MacOS/XUL+0x83d51f0)


Backtrace (tinderbox debug build m-c-1465207052-dbg)
[GFX1-]: Invalid target in gfxContext::ForDrawTarget 0x0
Assertion failure: mRawPtr != 0 (You can't dereference a NULL RefPtr with operator->().), at /builds/slave/m-cen-m64-d-000000000000000000/build/src/obj-firefox/dist/include/mozilla/RefPtr.h:297
#01: mozilla::FrameLayerBuilder::PaintItems(nsTArray<mozilla::FrameLayerBuilder::ClippedDisplayItem>&, mozilla::gfx::IntRectTyped<mozilla::gfx::UnknownUnits> const&, gfxContext*, nsRenderingContext*, nsDisplayListBuilder*, nsPresContext*, mozilla::gfx::IntPointTyped<mozilla::gfx::UnknownUnits> const&, float, float, int) [gfx/layers/basic/BasicLayers.h:127]
#02: mozilla::FrameLayerBuilder::DrawPaintedLayer(mozilla::layers::PaintedLayer*, gfxContext*, mozilla::gfx::IntRegionTyped<mozilla::gfx::UnknownUnits> const&, mozilla::gfx::IntRegionTyped<mozilla::gfx::UnknownUnits> const&, mozilla::layers::DrawRegionClip, mozilla::gfx::IntRegionTyped<mozilla::gfx::UnknownUnits> const&, void*) [layout/base/FrameLayerBuilder.cpp:5851]
#03: mozilla::layers::ClientMultiTiledLayerBuffer::Update(mozilla::gfx::IntRegionTyped<mozilla::gfx::UnknownUnits> const&, mozilla::gfx::IntRegionTyped<mozilla::gfx::UnknownUnits> const&, mozilla::gfx::IntRegionTyped<mozilla::gfx::UnknownUnits> const&) [gfx/src/nsRegion.h:75]

Comment 1

[Jesse Schwartzentruber (:truber)]

Attachment: Testcase

Comment 2

[Jesse Schwartzentruber (:truber)]

Attachment: m-c-1465207052-dbg.txt

Comment 3

[Jesse Schwartzentruber (:truber)]

Attachment: m-c-e27fe24a746f-opt-asan.txt

Comment 4

[Daniel Veditz [:dveditz]]

regression from when or what?

Comment 5

[Jesse Schwartzentruber (:truber)]

(In reply to Daniel Veditz [:dveditz] from comment #4)
> regression from when or what?

By accident. The keyword is in the template I used and I didn't catch it.

Comment 6

[Ryan VanderMeulen [:RyanVM]]

Does this still reproduce for you?

Comment 7

[Jesse Schwartzentruber (:truber)]

No, I can't reproduce this with/without stylo or e10s on OSX m-c rev e897e367d3bd489422d86fbdfac54925c18329d2.

Comment 8

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/mozilla-inbound/rev/636dbf70e08c
Add crashtest. r=me

Comment 9

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

https://hg.mozilla.org/mozilla-central/rev/636dbf70e08c