1286593 - MOZ_CRASH "!(nullptr == fPoints && 0 != fFreeSpace)" in [@SkPathRef::validate()]

Status: RESOLVED DUPLICATE of bug 1287515

(Core :: Graphics: Canvas2D, defect)

Description

[Tyson Smith [:tsmith]]

Attachment: test_case.html

Found with debug build.

/builds/slave/m-cen-l64-asan-d-0000000000000/build/src/gfx/skia/skia/src/core/SkPathRef.cpp:616: fatal error: ""!(nullptr == fPoints && 0 != fFreeSpace)""
Abort from sk_abort
Hit MOZ_CRASH() at /builds/slave/m-cen-l64-asan-d-0000000000000/build/src/memory/mozalloc/mozalloc_abort.cpp:33
ASAN:DEADLYSIGNAL
=================================================================
==11612==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x0000004e19d3 bp 0x7ffed58e6de0 sp 0x7ffed58e6dd0 T0)
    #0 0x4e19d2 in mozalloc_abort(char const*) /builds/slave/m-cen-l64-asan-d-0000000000000/build/src/memory/mozalloc/mozalloc_abort.cpp:33:5
    #1 0x7fcd47e103f4 in sk_abort_no_print() /builds/slave/m-cen-l64-asan-d-0000000000000/build/src/gfx/skia/skia/src/ports/SkMemory_mozalloc.cpp:16:5
    #2 0x7fcd47ee7437 in SkPathRef::validate() const /builds/slave/m-cen-l64-asan-d-0000000000000/build/src/gfx/skia/skia/src/core/SkPathRef.cpp:616:5
    #3 0x7fcd47ef619c in SkPathRef::copy(SkPathRef const&, int, int) /builds/slave/m-cen-l64-asan-d-0000000000000/build/src/gfx/skia/skia/src/core/SkPathRef.cpp:292:5
    #4 0x7fcd47ef5e93 in SkPathRef::Editor::Editor(SkAutoTUnref<SkPathRef>*, int, int) /builds/slave/m-cen-l64-asan-d-0000000000000/build/src/gfx/skia/skia/src/core/SkPathRef.cpp:23:9
    #5 0x7fcd47ee4606 in SkPath::incReserve(unsigned int) /builds/slave/m-cen-l64-asan-d-0000000000000/build/src/gfx/skia/skia/src/core/SkPath.cpp:719:5
    #6 0x7fcd47e140ba in SpecialLineRec::init(SkPath const&, SkPath*, SkStrokeRec*, int, float) /builds/slave/m-cen-l64-asan-d-0000000000000/build/src/gfx/skia/skia/src/utils/SkDashPath.cpp:180:9
    #7 0x7fcd47e134f1 in SkDashPath::InternalFilter(SkPath*, SkPath const&, SkStrokeRec*, SkRect const*, float const*, int, float, int, float) /builds/slave/m-cen-l64-asan-d-0000000000000/build/src/gfx/skia/skia/src/utils/SkDashPath.cpp:237:24
    #8 0x7fcd47b9a90e in SkDashPathEffect::filterPath(SkPath*, SkPath const&, SkStrokeRec*, SkRect const*) const /builds/slave/m-cen-l64-asan-d-0000000000000/build/src/gfx/skia/skia/src/effects/SkDashPathEffect.cpp:40:12
    #9 0x7fcd47edefed in SkPaint::getFillPath(SkPath const&, SkPath*, SkRect const*, float) const /builds/slave/m-cen-l64-asan-d-0000000000000/build/src/gfx/skia/skia/src/core/SkPaint.cpp:1971:24
    #10 0x7fcd41eca7c9 in mozilla::gfx::PathSkia::StrokeContainsPoint(mozilla::gfx::StrokeOptions const&, mozilla::gfx::PointTyped<mozilla::gfx::UnknownUnits, float> const&, mozilla::gfx::Matrix const&) const /builds/slave/m-cen-l64-asan-d-0000000000000/build/src/gfx/2d/PathSkia.cpp:166:3
    #11 0x7fcd441b1143 in mozilla::dom::CanvasRenderingContext2D::IsPointInStroke(double, double) /builds/slave/m-cen-l64-asan-d-0000000000000/build/src/dom/canvas/CanvasRenderingContext2D.cpp:4486:10
    #12 0x7fcd435773ca in mozilla::dom::CanvasRenderingContext2DBinding::isPointInStroke(JSContext*, JS::Handle<JSObject*>, mozilla::dom::CanvasRenderingContext2D*, JSJitMethodCallArgs const&) /builds/slave/m-cen-l64-asan-d-0000000000000/build/src/obj-firefox/dom/bindings/CanvasRenderingContext2DBinding.cpp:3906:19
...
see log.txt for full log.

Comment 1

[Tyson Smith [:tsmith]]

Attachment: log.txt