Closed Bug 1331894 Opened 3 years ago Closed 3 years ago

Crash in InvalidArrayIndex_CRASH | mozilla::layers::BuildPathFromPolygon

Categories

(Core :: Graphics: Layers, defect, critical)

Unspecified
All
defect
Not set
critical

Tracking

()

RESOLVED FIXED
mozilla53
Tracking Status
firefox51 --- unaffected
firefox52 --- unaffected
firefox53 --- fixed

People

(Reporter: jseward, Assigned: miko)

References

Details

(Keywords: crash)

Crash Data

Attachments

(1 file)

This bug was filed from the Socorro interface and is 
report bp-8a59c80a-242f-451b-9322-f78812170118.
=============================================================

This is ranked #22 in the windows build from 17 Jan.  It may be
fallout from bug 1323797.  See for example

https://crash-stats.mozilla.com/report/index/8a59c80a-242f-451b-9322-f78812170118
Assignee: nobody → mikokm
The signature looks similar to the one in bug 1331566
I think this crash might be caused by layer geometry overlapping with visible area so that the resulting polygon from clipping will be degenerate (point count < 3). This might happen if the visible area is only a couple of pixels. Such polygons should never get into BasicCompositor in the first place.

I already have a fix for this ready, just need a couple of hours to verify that the my hypothesis is correct, and that the fix works.
Duplicate of this bug: 1331566
Comment on attachment 8827957 [details]
Bug 1331894 - Crash in InvalidArrayIndex_CRASH | mozilla::layers::BuildPathFromPolygon - Cull polygons with no area

https://reviewboard.mozilla.org/r/105526/#review106354

This looks good but please add a crash test that would reproduce the problem that triggered this.
Attachment #8827957 - Flags: review?(jmuizelaar) → review+
Keywords: checkin-needed
OS: Windows 7 → All
Pushed by ryanvm@gmail.com:
https://hg.mozilla.org/integration/autoland/rev/5b25f62eff46
Crash in InvalidArrayIndex_CRASH | mozilla::layers::BuildPathFromPolygon - Cull polygons with no area r=jrmuizel
Keywords: checkin-needed
https://hg.mozilla.org/mozilla-central/rev/5b25f62eff46
Status: NEW → RESOLVED
Closed: 3 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla53
Crash Signature: [@ InvalidArrayIndex_CRASH | mozilla::layers::BuildPathFromPolygon] → [@ InvalidArrayIndex_CRASH | mozilla::layers::BuildPathFromPolygon] [@ InvalidArrayIndex_CRASH | nsTArray_Impl<T>::ElementAt | mozilla::layers::BuildPathFromPolygon]
You need to log in before you can comment on or make changes to this bug.