1358795 - crash at null [@DataAtOffset] in gfx/2d/DataSurfaceHelpers.cpp:92

Status: RESOLVED DUPLICATE of bug 1332980

(Core :: Graphics, defect)

Description

[Tyson Smith [:tsmith] (PTO)]

Attachment: log.txt

This bug looks a lot like bug 1329849
==25378==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x7f6ba94afbe6 bp 0x7ffc2dd0adb0 sp 0x7ffc2dd0ad70 T0)
==25378==The signal is caused by a WRITE memory access.
==25378==Hint: address points to the zero page.
    #0 0x7f6ba94afbe5 in AnnotateMozCrashReason /home/worker/workspace/build/src/obj-firefox/dist/include/mozilla/Assertions.h:40:19
    #1 0x7f6ba94afbe5 in mozilla::gfx::DataAtOffset(mozilla::gfx::DataSourceSurface*, mozilla::gfx::DataSourceSurface::MappedSurface const*, mozilla::gfx::IntPointTyped<mozilla::gfx::UnknownUnits>) /home/worker/workspace/build/src/gfx/2d/DataSurfaceHelpers.cpp:92
    #2 0x7f6ba954a41a in DoRender<int> /home/worker/workspace/build/src/gfx/2d/FilterNodeSoftware.cpp:3549:25
    #3 0x7f6ba954a41a in mozilla::gfx::FilterNodeLightingSoftware<mozilla::gfx::(anonymous namespace)::PointLightSoftware, mozilla::gfx::(anonymous namespace)::SpecularLightingSoftware>::Render(mozilla::gfx::IntRectTyped<mozilla::gfx::UnknownUnits> const&) /home/worker/workspace/build/src/gfx/2d/FilterNodeSoftware.cpp:3487
    #4 0x7f6ba94ebcf2 in mozilla::gfx::FilterNodeSoftware::GetOutput(mozilla::gfx::IntRectTyped<mozilla::gfx::UnknownUnits> const&) /home/worker/workspace/build/src/gfx/2d/FilterNodeSoftware.cpp:627:21
    #5 0x7f6ba94f36e9 in mozilla::gfx::FilterNodeSoftware::GetInputDataSourceSurface(unsigned int, mozilla::gfx::IntRectTyped<mozilla::gfx::UnknownUnits> const&, mozilla::gfx::FilterNodeSoftware::FormatHint, mozilla::gfx::ConvolveMatrixEdgeMode, mozilla::gfx::IntRectTyped<mozilla::gfx::UnknownUnits> const*) /home/worker/workspace/build/src/gfx/2d/FilterNodeSoftware.cpp:728:25
    #6 0x7f6ba951f145 in mozilla::gfx::FilterNodeCropSoftware::Render(mozilla::gfx::IntRectTyped<mozilla::gfx::UnknownUnits> const&) /home/worker/workspace/build/src/gfx/2d/FilterNodeSoftware.cpp:3140:10
    #7 0x7f6ba94ebcf2 in mozilla::gfx::FilterNodeSoftware::GetOutput(mozilla::gfx::IntRectTyped<mozilla::gfx::UnknownUnits> const&) /home/worker/workspace/build/src/gfx/2d/FilterNodeSoftware.cpp:627:21
...
see log.txt

Comment 1

[Tyson Smith [:tsmith] (PTO)]

Attachment: test_case.html

Comment 2

[Kevin Chen[:kechen] (UTC + 8)]

The reason of the crash is that the value we set to kernelUnitLength is 4398046511104 which is bigger than the maximum number that a 32bit integer can present.
So when passing this number to function "Render" in [1] and casting it to a 32bit integer, we will get an assertion in [2].

Not sure why we cast the number to 32bit integer in [1], but perhaps we should check the number range in the if branch.

[1] https://hg.mozilla.org/mozilla-central/annotate/48c0fd9c9ec5d68061ea7b59358874ae8da72572/gfx/2d/FilterNodeSoftware.cpp#l3487
[2] https://dxr.mozilla.org/mozilla-central/rev/48c0fd9c9ec5d68061ea7b59358874ae8da72572/gfx/2d/FilterNodeSoftware.cpp#3509

Comment 3

[Kevin Chen[:kechen] (UTC + 8)]

Also IntRect in [1] is not enough in this case.

[1] https://dxr.mozilla.org/mozilla-central/rev/48c0fd9c9ec5d68061ea7b59358874ae8da72572/gfx/2d/FilterNodeSoftware.cpp#3513

Comment 4

[Kevin Chen[:kechen] (UTC + 8)]

Hello Vincent, do you have any idea about this?

Comment 5

[Kevin Chen[:kechen] (UTC + 8)]

I think this is duplicate of Bug 1332980.