1269960 - crash in CanvasRenderingContext2D::EnsureErrorTarget on big endian platform (non-skia)

Status: RESOLVED FIXED

(Core :: Graphics, defect)

Description

[Steve Singer (:stevensn)]

I am now regularly getting crashes on many web pages

CanvasRenderingContext2D::EnsureErrorTarget on my ppc64 (big endian with --disable-skia) builds.

#0  0x00003fff7fe89114 in .raise () at /lib64/libpthread.so.0
#1  0x00003fff7b178cc4 in nsProfileLock::FatalSignalHandler(int, siginfo_t*, void*) (signo=<optimized out>, info=<optimized out>, context=<optimized out>) at /home/ssinger/mozilla-central/toolkit/profile/nsProfileLock.cpp:181
#2  0x00003fff7fee0478 in <signal handler called> () at arch/powerpc/kernel/vdso64/sigtramp.S
#3  0x00003fff7a285c6c in mozilla::dom::CanvasRenderingContext2D::EnsureErrorTarget() (this=<optimized out>)
    at /home/ssinger/build-out.ppc64/dist/include/mozilla/RefCounted.h:103
#4  0x00003fff7a285c6c in mozilla::dom::CanvasRenderingContext2D::EnsureErrorTarget() ()
    at /home/ssinger/mozilla-central/dom/canvas/CanvasRenderingContext2D.cpp:5350
#5  0x00003fff7a291008 in mozilla::dom::CanvasRenderingContext2D::EnsureTarget(mozilla::dom::CanvasRenderingContext2D::RenderingMode) (this=this@entry=0x3fff3faa2800, aRenderingMode=aRenderingMode@entry=mozilla::dom::CanvasRenderingContext2D::DefaultBackendMode) at /home/ssinger/mozilla-central/dom/canvas/CanvasRenderingContext2D.cpp:1525
#6  0x00003fff7a296738 in mozilla::dom::CanvasRenderingContext2D::PutImageData_explicit(int, int, unsigned int, unsigned int, mozilla::dom::TypedArray<unsigned char, &js::UnwrapUint8ClampedArray, &(JS_GetUint8ClampedArrayData(JSObject*, bool*, JS::AutoCheckCannotGC const&)), &js::GetUint8ClampedArrayLengthAndData, &(JS_NewUint8ClampedArray(JSContext*, unsigned int))>*, bool, int, int, int, int) (this=0x3fff3faa2800, aX=<optimized out>, aY=<optimized out>, aW=<optimized out>, aH=<optimized out>, aArray=0x3ffffc265328, aHasDirtyRect=<optimized out>, aDirtyX=<optimized out>, aDirtyY=0, aDirtyWidth=0, aDirtyHeight=0) at /home/ssinger/mozilla-central/dom/canvas/CanvasRenderingContext2D.cpp:5401
#7  0x00003fff7a296d58 in mozilla::dom::CanvasRenderingContext2D::PutImageData(mozilla::dom::ImageData&, double, double, mozilla::ErrorResult&) (this=0x3fff3faa2800, aImageData=..., aDx=<optimized out>, aDy=0, aError=...)
    at /home/ssinger/mozilla-central/dom/canvas/CanvasRenderingContext2D.cpp:5370
#8  0x00003fff79f0fb84 in mozilla::dom::CanvasRenderingContext2DBinding::putImageData(JSContext*, JS::Handle<JSObject*>, mozilla::dom::CanvasRenderingContext2D*, JSJitMethodCallArgs const&) (cx=0x3fff48e8bc00, obj=..., self=0x3fff3faa2800, args=...) at /home/ssinger/build-out.ppc64/dom/bindings/CanvasRenderingContext2DBinding.cpp:4620
#9  0x00003fff7a2569c8 in mozilla::dom::GenericBindingMethod(JSContext*, unsigned int, JS::Value*) (cx=0x3fff48e8bc00, ar

Comment 1

[Milan Sreckovic [:milan] (needinfo for best results)]

We'll take patches, it looks like this could be in our code.

Comment 2

[Ian Stakenvicius]

I'm getting the same problem on regular x86_64 builds in Gentoo linux, too.  My segfault happens at frame #4 in the above backtrace without any debugging enabled, the rest looks pretty much the same.

Primary trigger culprint for me is the google search results page.

Comment 3

[Ian Stakenvicius]

Still hitting this with firefox-48.0_beta7 ...  its worth noting on a clean profile that it segfaults even before the content of the default tabs are finished fully loading..

Comment 4

[Ian Stakenvicius]

(In reply to Steve Singer (:stevensn) from comment #0)
> I am now regularly getting crashes on many web pages
> 
> CanvasRenderingContext2D::EnsureErrorTarget on my ppc64 (big endian with
> --disable-skia) builds.


So I found my issue, and it may relate to yours as well.  Firefox-48 apparently decides to use a default of 'skia' for gfx.canvas.azure.backends even if skia is disabled at build time.  Try forcing that pref to 'cairo' and see if you still get crashes.

Comment 5

[Lee Salzman [:lsalzman]]

Attachment: only enable Skia as an available backend when it is compiled in

When Skia is disabled as a build option, we still flag it as an available backend in gfxPlatformGtk. This prevents the code from selecting the default Cairo backend as an alternate.

Therefor, we only want to flag Skia as available when it is actually available.

Comment 6

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/mozilla-inbound/rev/d15df91ece81
only enable Skia as an available backend when it is compiled in. r=mchang

Comment 7

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/d15df91ece81