crash at null [@DataAtOffset] in gfx/2d/DataSurfaceHelpers.cpp:92

RESOLVED DUPLICATE of bug 1332980

Status

()

Core
Graphics
--
critical
RESOLVED DUPLICATE of bug 1332980
a year ago
a year ago

People

(Reporter: tsmith, Unassigned)

Tracking

(Blocks: 1 bug, {crash, csectype-nullptr, testcase})

Trunk
crash, csectype-nullptr, testcase
Points:
---
Bug Flags:
in-testsuite ?

Firefox Tracking Flags

(firefox55 affected)

Details

Attachments

(2 attachments)

(Reporter)

Description

a year ago
Created attachment 8860671 [details]
log.txt

This bug looks a lot like bug 1329849
==25378==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x7f6ba94afbe6 bp 0x7ffc2dd0adb0 sp 0x7ffc2dd0ad70 T0)
==25378==The signal is caused by a WRITE memory access.
==25378==Hint: address points to the zero page.
    #0 0x7f6ba94afbe5 in AnnotateMozCrashReason /home/worker/workspace/build/src/obj-firefox/dist/include/mozilla/Assertions.h:40:19
    #1 0x7f6ba94afbe5 in mozilla::gfx::DataAtOffset(mozilla::gfx::DataSourceSurface*, mozilla::gfx::DataSourceSurface::MappedSurface const*, mozilla::gfx::IntPointTyped<mozilla::gfx::UnknownUnits>) /home/worker/workspace/build/src/gfx/2d/DataSurfaceHelpers.cpp:92
    #2 0x7f6ba954a41a in DoRender<int> /home/worker/workspace/build/src/gfx/2d/FilterNodeSoftware.cpp:3549:25
    #3 0x7f6ba954a41a in mozilla::gfx::FilterNodeLightingSoftware<mozilla::gfx::(anonymous namespace)::PointLightSoftware, mozilla::gfx::(anonymous namespace)::SpecularLightingSoftware>::Render(mozilla::gfx::IntRectTyped<mozilla::gfx::UnknownUnits> const&) /home/worker/workspace/build/src/gfx/2d/FilterNodeSoftware.cpp:3487
    #4 0x7f6ba94ebcf2 in mozilla::gfx::FilterNodeSoftware::GetOutput(mozilla::gfx::IntRectTyped<mozilla::gfx::UnknownUnits> const&) /home/worker/workspace/build/src/gfx/2d/FilterNodeSoftware.cpp:627:21
    #5 0x7f6ba94f36e9 in mozilla::gfx::FilterNodeSoftware::GetInputDataSourceSurface(unsigned int, mozilla::gfx::IntRectTyped<mozilla::gfx::UnknownUnits> const&, mozilla::gfx::FilterNodeSoftware::FormatHint, mozilla::gfx::ConvolveMatrixEdgeMode, mozilla::gfx::IntRectTyped<mozilla::gfx::UnknownUnits> const*) /home/worker/workspace/build/src/gfx/2d/FilterNodeSoftware.cpp:728:25
    #6 0x7f6ba951f145 in mozilla::gfx::FilterNodeCropSoftware::Render(mozilla::gfx::IntRectTyped<mozilla::gfx::UnknownUnits> const&) /home/worker/workspace/build/src/gfx/2d/FilterNodeSoftware.cpp:3140:10
    #7 0x7f6ba94ebcf2 in mozilla::gfx::FilterNodeSoftware::GetOutput(mozilla::gfx::IntRectTyped<mozilla::gfx::UnknownUnits> const&) /home/worker/workspace/build/src/gfx/2d/FilterNodeSoftware.cpp:627:21
...
see log.txt
Flags: in-testsuite?
(Reporter)

Comment 1

a year ago
Created attachment 8860672 [details]
test_case.html
Assignee: nobody → kechen
The reason of the crash is that the value we set to kernelUnitLength is 4398046511104 which is bigger than the maximum number that a 32bit integer can present.
So when passing this number to function "Render" in [1] and casting it to a 32bit integer, we will get an assertion in [2].

Not sure why we cast the number to 32bit integer in [1], but perhaps we should check the number range in the if branch.

[1] https://hg.mozilla.org/mozilla-central/annotate/48c0fd9c9ec5d68061ea7b59358874ae8da72572/gfx/2d/FilterNodeSoftware.cpp#l3487
[2] https://dxr.mozilla.org/mozilla-central/rev/48c0fd9c9ec5d68061ea7b59358874ae8da72572/gfx/2d/FilterNodeSoftware.cpp#3509
Hello Vincent, do you have any idea about this?
Assignee: kechen → nobody
Flags: needinfo?(vliu)
I think this is duplicate of Bug 1332980.
Status: NEW → RESOLVED
Last Resolved: a year ago
Flags: needinfo?(vliu)
Resolution: --- → DUPLICATE
Duplicate of bug: 1332980
You need to log in before you can comment on or make changes to this bug.