1267271 - Crash at SkBitmap::getAddr8 SkBitmap::extractAlpha mozilla::gfx::DrawTargetSkia::DrawSurfaceWithShadow mozilla::dom::AdjustedTargetForShadow::~AdjustedTargetForShadow mozilla::dom::AdjustedTarget::~AdjustedTarget

Status: RESOLVED FIXED

(Core :: Graphics, defect)

Description

[Carsten Book [:Tomcat]]

Attachment: crash stack

found via bughunter and reproduced on a win7 debug build based on todays m-c tip

Steps to reproduce:
-> Load https://asicw.playngonetwork.com/Casino/PlayMobile?pid=185&gid=pimped&lang=zh_CN&ticket=52640-592P537D497W148L

--> Crash

Comment 1

[Lee Salzman [:lsalzman]]

Attachment: skip empty surfaces in DrawTargetSkia::DrawSurfaceWithShadow

It appears that we're trying to draw a shadow for an empty surface. Skia is calling tmpBitmap.getAddr(0, 0) to get a result to the bitmap pixels, even though it will never actually use them because of the empty size. It is doing that right around here: https://dxr.mozilla.org/mozilla-central/source/gfx/skia/skia/src/core/SkBitmap.cpp#1049

The simplest fix for this is just to bail out before we have get there and end up calling extractAlpha on an empty bitmap.

Comment 2

[Pulsebot]

https://hg.mozilla.org/integration/mozilla-inbound/rev/a5d69f1eaa2a

Comment 3

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

https://hg.mozilla.org/mozilla-central/rev/a5d69f1eaa2a

Comment 4

[Lee Salzman [:lsalzman]]

Comment on attachment 8744978 [details] [diff] [review]
skip empty surfaces in DrawTargetSkia::DrawSurfaceWithShadow

Approval Request Comment
[Feature/regressing bug #]: bug 1259621, 48+
[User impact if declined]: Possible canvas crash regression introduced by bug 1259621 against 48+. Fix needed for bug 1266106 as well. 
[Describe test coverage new/current, TreeHerder]: mochitest, reftest
[Risks and why]: Basically none. Just skips drawing something in a case we shouldn't even be trying to.
[String/UUID change made/needed]: None

Comment 5

[Al Billings [:abillings - ex-MoCo]]

Comment on attachment 8744978 [details] [diff] [review]
skip empty surfaces in DrawTargetSkia::DrawSurfaceWithShadow

Approved for Aurora, check 'er in.

Comment 7

[Ritu Kothari (:ritu) (Inactive, please n-i to RyanVM, jcristau, or pascal)]

(In reply to Al Billings [:abillings] from comment #5)
> Comment on attachment 8744978 [details] [diff] [review]
> skip empty surfaces in DrawTargetSkia::DrawSurfaceWithShadow
> 
> Approved for Aurora, check 'er in.

This makes sense. Abilling beat me to it, ;) let's uplift to Aurora48.

Comment 8

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

https://hg.mozilla.org/releases/mozilla-aurora/rev/7f2af3c9b754