1323821 - Crash in SkImage::peekPixels

Status: RESOLVED FIXED

(Core :: Graphics: Canvas2D, defect)

Description

[u279076]

This bug was filed from the Socorro interface and is 
report bp-2809b4d7-7a20-4831-8848-ab80c2161214.
=============================================================
0 	libxul.so 	SkImage::peekPixels 	gfx/skia/skia/src/image/SkImage.cpp:48
1 	libxul.so 	mozilla::gfx::SourceSurfaceSkia::GetData 	gfx/2d/SourceSurfaceSkia.cpp:126
2 	libxul.so 	mozilla::gfx::DataSourceSurface::Map 	gfx/2d/2D.h:475
3 	libxul.so 	mozilla::dom::CanvasRenderingContext2D::GetImageDataArray 	dom/canvas/CanvasRenderingContext2D.cpp:5557
4 	libxul.so 	mozilla::dom::CanvasRenderingContext2D::GetImageData 	dom/canvas/CanvasRenderingContext2D.cpp:5486
5 	libxul.so 	mozilla::dom::CanvasRenderingContext2DBinding::getImageData 	obj-firefox/dom/bindings/CanvasRenderingContext2DBinding.cpp:4689
6 	libxul.so 	mozilla::dom::GenericBindingMethod 	dom/bindings/BindingUtils.cpp:2879
7 	libxul.so 	js::InternalCallOrConstruct 	js/src/jscntxtinlines.h:239
8 	libxul.so 	Interpret 	js/src/vm/Interpreter.cpp:510
9 	libxul.so 	js::RunScript 	js/src/vm/Interpreter.cpp:405
10 	libxul.so 	js::Execute 	js/src/vm/Interpreter.cpp:686
11 	libxul.so 	Evaluate 	js/src/jsapi.cpp:4440
12 	libxul.so 	JS::Evaluate 	js/src/jsapi.cpp:4466
13 	libxul.so 	nsJSUtils::EvaluateString 	dom/base/nsJSUtils.cpp:207
14 	libxul.so 	nsJSUtils::EvaluateString 	dom/base/nsJSUtils.cpp:275
15 	libxul.so 	nsScriptLoader::EvaluateScript 	dom/base/nsScriptLoader.cpp:2194
16 	libxul.so 	nsScriptLoader::ProcessRequest 	dom/base/nsScriptLoader.cpp:1979
17 	libxul.so 	nsScriptLoader::ProcessScriptElement 	dom/base/nsScriptLoader.cpp:1712
18 	libxul.so 	nsScriptElement::MaybeProcessScript 	dom/base/nsScriptElement.cpp:149
19 	libxul.so 	nsIScriptElement::AttemptToExecute 	dom/base/nsIScriptElement.h:222
20 	libxul.so 	nsHtml5TreeOpExecutor::RunScript 	parser/html/nsHtml5TreeOpExecutor.cpp:666
21 	libxul.so 	nsHtml5TreeOpExecutor::RunFlushLoop 	parser/html/nsHtml5TreeOpExecutor.cpp:489
22 	libxul.so 	nsHtml5ExecutorFlusher::Run 	parser/html/nsHtml5StreamParser.cpp:128
23 	libxul.so 	nsThread::ProcessNextEvent 	xpcom/threads/nsThread.cpp:1216
24 	libxul.so 	NS_ProcessNextEvent 	xpcom/glue/nsThreadUtils.cpp:361
25 	libxul.so 	mozilla::ipc::MessagePump::Run 	ipc/glue/MessagePump.cpp:96
26 	libxul.so 	MessageLoop::Run 	ipc/chromium/src/base/message_loop.cc:225
27 	libxul.so 	nsBaseAppShell::Run 	widget/nsBaseAppShell.cpp:156
28 	libxul.so 	nsAppStartup::Run 	toolkit/components/startup/nsAppStartup.cpp:283
29 	libxul.so 	XREMain::XRE_mainRun 	toolkit/xre/nsAppRunner.cpp:4467
30 	libxul.so 	XREMain::XRE_main 	toolkit/xre/nsAppRunner.cpp:4600
31 	libxul.so 	XRE_main 	toolkit/xre/nsAppRunner.cpp:4691
32 	libxul.so 	GeckoStart 	toolkit/xre/nsAndroidStartup.cpp:51
33 	libmozglue.so 	Java_org_mozilla_gecko_mozglue_GeckoLoader_nativeRun 	mozglue/android/APKOpen.cpp:425
Ø 34 	libdvm.so 	libdvm.so@0x1ec32 	
Ø 35 	dalvik-heap (deleted) 	dalvik-heap (deleted)@0x5b7a6e 	
Ø 36 	libdvm.so 	libdvm.so@0x59909 	
Ø 37 	data@[e-mail][e-mail] 	data@[e-mail][e-mail]@0x542c04 	
38 	libmozglue.so 	Java_org_mozilla_gecko_mozglue_GeckoLoader_loadNSSLibsNative 	mozglue/android/APKOpen.cpp:405
39 		@0x37cfffff 	
Ø 40 	data@[e-mail][e-mail] 	data@[e-mail][e-mail]@0x50d0d7 	
Ø 41 	libc.so 	libc.so@0x14b0b 	
Ø 42 	libdvm.so 	libdvm.so@0x996dd 	
Ø 43 	libc.so 	libc.so@0x1596f 	
Ø 44 	data@[e-mail][e-mail] 	data@[e-mail][e-mail]@0x50d0d7 	
Ø 45 	libc.so 	libc.so@0x1596f 	
46 	libmozglue.so 	Java_org_mozilla_gecko_mozglue_GeckoLoader_loadNSSLibsNative 	mozglue/android/APKOpen.cpp:405
Ø 47 	libdvm.so 	libdvm.so@0x5b8a9 	
Ø 48 	dalvik-heap (deleted) 	dalvik-heap (deleted)@0x5d57b6 	
Ø 49 	dalvik-heap (deleted) 	dalvik-heap (deleted)@0x5d57b6 	
Ø 50 	libdvm.so 	libdvm.so@0x60c33 	
Ø 51 	dalvik-heap (deleted) 	dalvik-heap (deleted)@0x5d57b6 	
Ø 52 	dalvik-heap (deleted) 	dalvik-heap (deleted)@0x4b1016 	
Ø 53 	dalvik-heap (deleted) 	dalvik-heap (deleted)@0x4b1016 	
Ø 54 	libdvm.so 	libdvm.so@0xb8c56 	
Ø 55 	dalvik-LinearAlloc (deleted) 	dalvik-LinearAlloc (deleted)@0x1b6522 	
Ø 56 	dalvik-LinearAlloc (deleted) 	dalvik-LinearAlloc (deleted)@0x1b650e 	
Ø 57 	dalvik-LinearAlloc (deleted) 	dalvik-LinearAlloc (deleted)@0x1b650e 	
Ø 58 	data@[e-mail][e-mail] 	data@[e-mail][e-mail]@0x59a1bf 	
Ø 59 	libdvm.so 	libdvm.so@0x8f14f 	
Ø 60 	libdvm.so 	libdvm.so@0x751fb 	
Ø 61 	dalvik-heap (deleted) 	dalvik-heap (deleted)@0x5b7a6e 	
Ø 62 	dalvik-LinearAlloc (deleted) 	dalvik-LinearAlloc (deleted)@0x1b650e 	
Ø 63 	dalvik-LinearAlloc (deleted) 	dalvik-LinearAlloc (deleted)@0x1b650e 	
Ø 64 	libdvm.so 	libdvm.so@0x59763 	
Ø 65 	dalvik-heap (deleted) 	dalvik-heap (deleted)@0x5b7a6e 	
Ø 66 	libdvm.so 	libdvm.so@0x5b639 	
Ø 67 	dalvik-LinearAlloc (deleted) 	dalvik-LinearAlloc (deleted)@0x1b650e 	
Ø 68 	data@[e-mail][e-mail] 	data@[e-mail][e-mail]@0x353d14 	
Ø 69 	dalvik-heap (deleted) 	dalvik-heap (deleted)@0x5b7a6e 	
Ø 70 	libdvm.so 	libdvm.so@0x1edbe 	
Ø 71 	libdvm.so 	libdvm.so@0x30a4e 	
Ø 72 	libdvm.so 	libdvm.so@0xb3f8e 	
Ø 73 	dalvik-LinearAlloc (deleted) 	dalvik-LinearAlloc (deleted)@0x141436 	
Ø 74 	libdvm.so 	libdvm.so@0x33fae 	
Ø 75 	libdvm.so 	libdvm.so@0x60373 	
Ø 76 	dalvik-LinearAlloc (deleted) 	dalvik-LinearAlloc (deleted)@0x141436 	
Ø 77 	dalvik-heap (deleted) 	dalvik-heap (deleted)@0x51e106 	
Ø 78 	data@[e-mail][e-mail] 	data@[e-mail][e-mail]@0x54245c 	
Ø 79 	libdvm.so 	libdvm.so@0x6d2e7 	
Ø 80 	dalvik-LinearAlloc (deleted) 	dalvik-LinearAlloc (deleted)@0x141436 	
Ø 81 	dalvik-heap (deleted) 	dalvik-heap (deleted)@0x51e106 	
Ø 82 	libdvm.so 	libdvm.so@0xb8c56 	
Ø 83 	libdvm.so 	libdvm.so@0x60373 	
Ø 84 	libdvm.so 	libdvm.so@0x6d30b 	
Ø 85 	libdvm.so 	libdvm.so@0xb8c56 	
Ø 86 	libdvm.so 	libdvm.so@0x60373 	
Ø 87 	libdvm.so 	libdvm.so@0xb3f8e 	
Ø 88 	libdvm.so 	libdvm.so@0x60423 	
Ø 89 	libdvm.so 	libdvm.so@0x60373 	
Ø 90 	libc.so 	libc.so@0x12d16 	
Ø 91 	libc.so 	libc.so@0x1286a 	
Ø 92 	libEGL.so 	libEGL.so@0x23e82 	
=============================================================
More reports: https://crash-stats.mozilla.com/signature/?product=FennecAndroid&signature=SkImage%3A%3ApeekPixels

Devices:
> 70.60% Odys Tablo w/Android Jellybean
> 17.60% Rockchip RMD-1026 w/Android Jellybean
> 11.80% Bauhn AMID-972XS w/Android Icecream Sandwich

Correlations:
> (100.0% in signature vs 01.55% overall) GFX_ERROR "Failed making Skia raster image for GPU surface" = true
> (100.0% in signature vs 02.46% overall) CPU Info = ARMv7 ARM Cortex-A9 features: swp,half,thumb,fastmult,vfpv2,edsp,neon,vfpv3
> (100.0% in signature vs 10.29% overall) adapter_device_id = Mali-400 MP
> (100.0% in signature vs 14.66% overall) adapter_driver_version = OpenGL ES 2.0
> (100.0% in signature vs 14.66% overall) adapter_driver_version_clean = OpenGL ES 2.0
> (100.0% in signature vs 34.15% overall) adapter_vendor_id = ARM
> (82.35% in signature vs 04.83% overall) build_id = 20161206004003
> (100.0% in signature vs 38.71% overall) address = 0x0
> (70.59% in signature vs 01.09% overall) platform_version = 0.0.0 Linux 3.0.8+ #504 SMP PREEMPT Tue Jan 29 15:56:29 CST 2013 armv7l
> (70.59% in signature vs 03.83% overall) useragent_locale = es-ES

Reports start in Fennec Aurora 52.0a2 20161206004003 which suggests the following pushlog although I believe this is a red herring.
http://hg.mozilla.org/releases/mozilla-aurora/pushloghtml?fromchange=d10b8f6cce8d37787855c210e9b9f8110ceb45d1&tochange=46049b21980d67b13d6915c052a3025c273a1788

Comment 1

[Lee Salzman [:lsalzman]]

Attachment: only replace texture-backed SkImage on success in SourceSurfaceSkia::GetData

Just a small change to let SourceSurfaceSkia::GetData be properly fallible in release builds. GetData is allowed to return null on failure. So if reading the texture back image fails, it will try to peek at the pixels, and otherwise just return nullptr from the empty pixmap.

Comment 2

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/mozilla-inbound/rev/09a4e9d9b8fa
only replace texture-backed SkImage on success in SourceSurfaceSkia::GetData. r=jrmuizel

Comment 3

[Phil Ringnalda (:philor)]

https://hg.mozilla.org/mozilla-central/rev/09a4e9d9b8fa

Comment 4

[Lee Salzman [:lsalzman]]

Comment on attachment 8820342 [details] [diff] [review]
only replace texture-backed SkImage on success in SourceSurfaceSkia::GetData

Approval Request Comment
[Feature/Bug causing the regression]: 1299435, as of 52+
[User impact if declined]: Crashes with SkiaGL canvas in memory constrained situations.
[Is this code covered by automated tests?]: yes
[Has the fix been verified in Nightly?]: yes
[Needs manual test from QE? If yes, steps to reproduce]: no 
[List of other uplifts needed for the feature/fix]: aurora
[Is the change risky?]: No
[Why is the change risky/not risky?]: Just a simple change to prevent a null pointer from being read.
[String changes made/needed]: None

Comment 5

[Julien Cristau [:jcristau]]

Comment on attachment 8820342 [details] [diff] [review]
only replace texture-backed SkImage on success in SourceSurfaceSkia::GetData

avoid crashes with skiagl canvas in aurora52

Comment 6

[Ryan VanderMeulen (PTO, back July 27)]

https://hg.mozilla.org/releases/mozilla-aurora/rev/8d9fb8fa1f3d