1260178 - crash in cairo_pattern_get_color_stop_rgba

Status: RESOLVED FIXED

(Core :: Widget: Gtk, defect)

Description

[Calixte Denizet (:calixte)]

This bug was filed from the Socorro interface and is 
report bp-22ca161d-794d-4b57-b1b0-a7eee2160327.
=============================================================

This signature just appeared the 2016-03-27, only at #64 in topcrash, it's a startup crash and it has been probably introduced by:
http://hg.mozilla.org/releases/mozilla-aurora/rev/62de4de10ebb (bug 1211892)

Stack

cairo_pattern_get_color_stop_rgba
nsLookAndFeel::Init()
nsXPLookAndFeel::GetInstance()
mozilla::LookAndFeel::GetInt(mozilla::LookAndFeel::IntID, int*)
nsChromeRegistryChrome::CheckForOSAccessibility()
ScopedXPCOMStartup::SetWindowCreator(nsINativeAppSupport*)
XREMain::XRE_mainRun()
XREMain::XRE_main(int, char**, nsXREAppData const*)
XRE_main
do_main
main
libc-2.15.so@0x2176c
_init
firefox@0x84fb
__libc_csu_fini
firefox@0x84fb
_start

Comment 1

[Karl Tomlinson (:karlt)]

% /home/karl/moz/dev/obj/toolkit/crashreporter/google-breakpad/src/tools/linux/dump_syms/dump_syms usr/lib/x86_64-linux-gnu/libcairo.so.2 2>/dev/null | grep MODULE
MODULE Linux x86_64 110FD9AE8D2F08986E0A29E36278C31C0 libcairo.so.2

% addr2line -if -e usr/lib/debug/usr/lib/x86_64-linux-gnu/libcairo.so.2.11000.2 0x3cc60
cairo_pattern_get_color_stop_rgba
/build/buildd/cairo-1.10.2/src/cairo-pattern.c:3185

Looks like there is a null pattern
https://cgit.freedesktop.org/cgit/?url=cairo/tree/src/cairo-pattern.c&id=1.10.2#n3185

Offset 0x8 is consistent with
https://cgit.freedesktop.org/cgit/?url=cairo/tree/src/cairo-types-private.h&id=1.10.2#n384

Can reproduce by commenting out the -unico-border-gradient declaration in this
rule in gtk-widgets.css in Ambiance:

.button,
.frame,
.notebook {
    border-style: solid;

    -unico-border-gradient: -gtk-gradient (linear, left top, left bottom,
                                           from (shade (@bg_color, 0.8)),
                                           to (shade (@bg_color, 0.76)));
}

Custom style property values are given their associated types, even when their
(initial) values are null/none.

https://git.gnome.org/browse/gtk+/tree/gtk/gtkcsscustomproperty.c?h=3.4.2#n89

Comment 2

[Karl Tomlinson (:karlt)]

[Tracking Requested - why for this release]:
Null deref crash with non-default Ubuntu 12.04 theme.

Comment 3

[Karl Tomlinson (:karlt)]

Attachment: MozReview Request: bug 1260178 null check pattern from -unico-border-gradient r?acomminos

Review commit: https://reviewboard.mozilla.org/r/42921/diff/#index_header
See other reviews: https://reviewboard.mozilla.org/r/42921/

Comment 4

[Andrew Comminos [:acomminos]]

Comment on attachment 8735706 [details]
MozReview Request: bug 1260178 null check pattern from -unico-border-gradient r?acomminos

https://reviewboard.mozilla.org/r/42921/#review39417

Comment 5

[Pulsebot]

https://hg.mozilla.org/integration/mozilla-inbound/rev/323653e6a3d9

Comment 6

[Liz Henry (:lizzard) (relman/hg->git project)]

Tracking for 46, we can uplift this once it look ok on m-c.

Comment 7

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

https://hg.mozilla.org/mozilla-central/rev/323653e6a3d9

Comment 8

[Karl Tomlinson (:karlt)]

Comment on attachment 8735706 [details]
MozReview Request: bug 1260178 null check pattern from -unico-border-gradient r?acomminos

Approval Request Comment
[Feature/regressing bug #]: bug 1211892
[User impact if declined]:
Null deref start-up crash with non-default Ubuntu 12.04 theme.
[Describe test coverage new/current, TreeHerder]:
none.  (Test machines use default Ubuntu 12.04 theme.)
[Risks and why]: 
none.  null check.
[String/UUID change made/needed]:
none (except for risks associated with continuing to run instead of crashing).

Comment 9

[Liz Henry (:lizzard) (relman/hg->git project)]

I see some crashes here for 47 aurora but none for 46. Let's uplift this to aurora. 
If you feel strongly about beta 46 uplift please let me know.

Comment 10

[Ritu Kothari (:ritu) (Inactive, please n-i to RyanVM, jcristau, or pascal)]

Comment on attachment 8735706 [details]
MozReview Request: bug 1260178 null check pattern from -unico-border-gradient r?acomminos

Null check, Aurora47+

Comment 11

[Liz Henry (:lizzard) (relman/hg->git project)]

Oh wait. startup crash, gtk related? Maybe we should take this on beta.

Comment 12

[Liz Henry (:lizzard) (relman/hg->git project)]

Comment on attachment 8735706 [details]
MozReview Request: bug 1260178 null check pattern from -unico-border-gradient r?acomminos

Prevent potential startup crash for non default themes

Comment 13

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/releases/mozilla-aurora/rev/84d924134d13

Comment 14

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/releases/mozilla-beta/rev/bd3a8572be86