Closed Bug 1287652 Opened 4 years ago Closed 4 years ago

SEGV on unknown address 0x44 in [@mozilla::gfx::SetPaintPattern]

Categories

(Core :: Canvas: 2D, defect, critical)

50 Branch
defect
Not set
critical

Tracking

()

RESOLVED FIXED
mozilla50
Tracking Status
firefox50 --- fixed

People

(Reporter: tsmith, Assigned: ethlin)

References

(Blocks 2 open bugs)

Details

(Keywords: crash, testcase, Whiteboard: [fuzzblocker])

Attachments

(4 files)

Attached file log.txt
This is a fuzz blocker. It is triggered every 5 or so iterations. Please fix ASAP.

Repros on non ASan and non debug builds.

Log from an ASan build:
==60217==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000044 (pc 0x7fa8351d91aa bp 0x7ffe09054b30 sp 0x7ffe090547e0 T0)
    #0 0x7fa8351d91a9 in mozilla::gfx::SetPaintPattern(SkPaint&, mozilla::gfx::Pattern const&, float) /builds/slave/m-cen-l64-asan-000000000000000/build/src/gfx/2d/DrawTargetSkia.cpp:229:61
    #1 0x7fa8351d7f18 in AutoPaintSetup /builds/slave/m-cen-l64-asan-000000000000000/build/src/gfx/2d/DrawTargetSkia.cpp:319:5
    #2 0x7fa8351d7f18 in mozilla::gfx::DrawTargetSkia::FillGlyphs(mozilla::gfx::ScaledFont*, mozilla::gfx::GlyphBuffer const&, mozilla::gfx::Pattern const&, mozilla::gfx::DrawOptions const&, mozilla::gfx::GlyphRenderingOptions const*) /builds/slave/m-cen-l64-asan-000000000000000/build/src/gfx/2d/DrawTargetSkia.cpp:1029
    #3 0x7fa8358a4863 in GlyphBufferAzure::Flush(bool) /builds/slave/m-cen-l64-asan-000000000000000/build/src/gfx/thebes/gfxFont.cpp:1667:21
    #4 0x7fa83586efa3 in ~GlyphBufferAzure /builds/slave/m-cen-l64-asan-000000000000000/build/src/gfx/thebes/gfxFont.cpp:1570:9
    #5 0x7fa83586efa3 in gfxFont::DrawGlyphs(gfxShapedText const*, unsigned int, unsigned int, gfxPoint*, TextRunDrawParams const&, FontDrawParams const&) /builds/slave/m-cen-l64-asan-000000000000000/build/src/gfx/thebes/gfxFont.cpp:1968
    #6 0x7fa835872bc8 in gfxFont::Draw(gfxTextRun const*, unsigned int, unsigned int, gfxPoint*, TextRunDrawParams const&, unsigned short) /builds/slave/m-cen-l64-asan-000000000000000/build/src/gfx/thebes/gfxFont.cpp:2152:9
    #7 0x7fa8358e0a4d in gfxTextRun::DrawGlyphs(gfxFont*, gfxTextRun::Range, gfxPoint*, gfxTextRun::PropertyProvider*, gfxTextRun::Range, TextRunDrawParams&, unsigned short) const /builds/slave/m-cen-l64-asan-000000000000000/build/src/gfx/thebes/gfxTextRun.cpp:412:5
...
see log.txt for full log.
Attached file test_case.html
Whiteboard: [fuzzblocker]
We should have some error handling for the CanvasGradient which has no ColorStop. D2D1 has handled it[1]. Skia and Cairo should do this as well.

[1] https://dxr.mozilla.org/mozilla-central/source/gfx/2d/DrawTargetD2D1.cpp#1634
Assignee: nobody → ethlin
Attached patch error handlingSplinter Review
Check if the 'stops' is nullptr. After study, I think cairo works well in this case.
Attachment #8772321 - Flags: review?(mchang)
Attachment #8772321 - Flags: review?(mchang) → review+
Keywords: checkin-needed
Any particular reason we aren't landing the testcase as a crashtest?
Flags: needinfo?(ethlin)
Flags: in-testsuite?
Pushed by ryanvm@gmail.com:
https://hg.mozilla.org/integration/mozilla-inbound/rev/1afe2708eef5
Add error handling while colorstop is empty. r=mchang
Keywords: checkin-needed
Yes sorry my mistake, can we also please check in the testcase as a crash test.
Attached patch crash testcaseSplinter Review
I should add the crash testcase for this bug.
Flags: needinfo?(ethlin)
Attachment #8773117 - Flags: review?(mchang)
https://hg.mozilla.org/mozilla-central/rev/1afe2708eef5
Status: NEW → RESOLVED
Closed: 4 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla50
Comment on attachment 8773117 [details] [diff] [review]
crash testcase

Review of attachment 8773117 [details] [diff] [review]:
-----------------------------------------------------------------

Thanks!
Attachment #8773117 - Flags: review?(mchang) → review+
Blocks: 1289929, grizzly
Flags: in-testsuite? → in-testsuite+
Keywords: checkin-needed
You need to log in before you can comment on or make changes to this bug.