1316866 - AddressSanitizer: heap-use-after-free in [@ CanvasRenderingContext2D::DrawImage] with READ size 8

Status: RESOLVED FIXED

(Core :: Graphics: Canvas2D, defect)

Description

[Jesse Schwartzentruber (:truber)]

Attachment: testcase.html

The attached testcase crashes m-c b2b359340a84.

==24127==ERROR: AddressSanitizer: heap-use-after-free on address 0x60d000474b70 at pc 0x7fc276e2cffd bp 0x7ffd9373e490 sp 0x7ffd9373e488
READ of size 8 at 0x60d000474b70 thread T0
    #0 0x7fc276e2cffc in mozilla::dom::CanvasRenderingContext2D::DrawImage(mozilla::dom::HTMLImageElementOrHTMLCanvasElementOrHTMLVideoElementOrImageBitmap const&, double, double, double, double, double, double, double, double, unsigned char, mozilla::ErrorResult&) dom/canvas/CanvasRenderingContext2D.cpp:4984:5
    #1 0x7fc27619bb84 in DrawImage obj-firefox/dist/include/mozilla/dom/CanvasRenderingContext2D.h:218:5
    #2 0x7fc27619bb84 in mozilla::dom::CanvasRenderingContext2DBinding::drawImage(JSContext*, JS::Handle<JSObject*>, mozilla::dom::CanvasRenderingContext2D*, JSJitMethodCallArgs const&) obj-firefox/dom/bindings/CanvasRenderingContext2DBinding.cpp:4289
    #3 0x7fc276d38f90 in mozilla::dom::GenericBindingMethod(JSContext*, unsigned int, JS::Value*) dom/bindings/BindingUtils.cpp:2879:13

Comment 1

[Jesse Schwartzentruber (:truber)]

Attachment: log.txt

Comment 2

[Milan Sreckovic [:milan] (needinfo for best results)]

Would not surprise me if this was somewhat related to bug 1318283.

Comment 3

[Frederik Braun [:freddy]]

Milan, can you poke at this bug again? It seems you had a hunch, about what is causing this.

Comment 4

[Milan Sreckovic [:milan] (needinfo for best results)]

Is this still happening?  It could be related to other "real" bugs in here, but if this was a single day issue only, it is likely the result of bug 1313884 patch that landed on 11/10 and got backed out on 11/11 (comment 0 has us finding this problem on 11/11 so the timing works.)

Comment 5

[Jesse Schwartzentruber (:truber)]

No, I can't reproduce it. Your explanation fits my recollection, I think I had to get the exact build it was found on to reproduce it, a newer one didn't work.

Comment 6

[Milan Sreckovic [:milan] (needinfo for best results)]

Calling this fixed by the bug 1313884 backout.