Closed Bug 1358795 Opened 8 years ago Closed 8 years ago

crash at null [@DataAtOffset] in gfx/2d/DataSurfaceHelpers.cpp:92

Categories

(Core :: Graphics, defect)

defect
Not set
critical

Tracking

()

RESOLVED DUPLICATE of bug 1332980
Tracking Status
firefox55 --- affected

People

(Reporter: tsmith, Unassigned)

References

(Blocks 1 open bug)

Details

(Keywords: crash, csectype-nullptr, testcase)

Attachments

(2 files)

Attached file log.txt
This bug looks a lot like bug 1329849 ==25378==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x7f6ba94afbe6 bp 0x7ffc2dd0adb0 sp 0x7ffc2dd0ad70 T0) ==25378==The signal is caused by a WRITE memory access. ==25378==Hint: address points to the zero page. #0 0x7f6ba94afbe5 in AnnotateMozCrashReason /home/worker/workspace/build/src/obj-firefox/dist/include/mozilla/Assertions.h:40:19 #1 0x7f6ba94afbe5 in mozilla::gfx::DataAtOffset(mozilla::gfx::DataSourceSurface*, mozilla::gfx::DataSourceSurface::MappedSurface const*, mozilla::gfx::IntPointTyped<mozilla::gfx::UnknownUnits>) /home/worker/workspace/build/src/gfx/2d/DataSurfaceHelpers.cpp:92 #2 0x7f6ba954a41a in DoRender<int> /home/worker/workspace/build/src/gfx/2d/FilterNodeSoftware.cpp:3549:25 #3 0x7f6ba954a41a in mozilla::gfx::FilterNodeLightingSoftware<mozilla::gfx::(anonymous namespace)::PointLightSoftware, mozilla::gfx::(anonymous namespace)::SpecularLightingSoftware>::Render(mozilla::gfx::IntRectTyped<mozilla::gfx::UnknownUnits> const&) /home/worker/workspace/build/src/gfx/2d/FilterNodeSoftware.cpp:3487 #4 0x7f6ba94ebcf2 in mozilla::gfx::FilterNodeSoftware::GetOutput(mozilla::gfx::IntRectTyped<mozilla::gfx::UnknownUnits> const&) /home/worker/workspace/build/src/gfx/2d/FilterNodeSoftware.cpp:627:21 #5 0x7f6ba94f36e9 in mozilla::gfx::FilterNodeSoftware::GetInputDataSourceSurface(unsigned int, mozilla::gfx::IntRectTyped<mozilla::gfx::UnknownUnits> const&, mozilla::gfx::FilterNodeSoftware::FormatHint, mozilla::gfx::ConvolveMatrixEdgeMode, mozilla::gfx::IntRectTyped<mozilla::gfx::UnknownUnits> const*) /home/worker/workspace/build/src/gfx/2d/FilterNodeSoftware.cpp:728:25 #6 0x7f6ba951f145 in mozilla::gfx::FilterNodeCropSoftware::Render(mozilla::gfx::IntRectTyped<mozilla::gfx::UnknownUnits> const&) /home/worker/workspace/build/src/gfx/2d/FilterNodeSoftware.cpp:3140:10 #7 0x7f6ba94ebcf2 in mozilla::gfx::FilterNodeSoftware::GetOutput(mozilla::gfx::IntRectTyped<mozilla::gfx::UnknownUnits> const&) /home/worker/workspace/build/src/gfx/2d/FilterNodeSoftware.cpp:627:21 ... see log.txt
Flags: in-testsuite?
Attached file test_case.html
Assignee: nobody → kechen
The reason of the crash is that the value we set to kernelUnitLength is 4398046511104 which is bigger than the maximum number that a 32bit integer can present. So when passing this number to function "Render" in [1] and casting it to a 32bit integer, we will get an assertion in [2]. Not sure why we cast the number to 32bit integer in [1], but perhaps we should check the number range in the if branch. [1] https://hg.mozilla.org/mozilla-central/annotate/48c0fd9c9ec5d68061ea7b59358874ae8da72572/gfx/2d/FilterNodeSoftware.cpp#l3487 [2] https://dxr.mozilla.org/mozilla-central/rev/48c0fd9c9ec5d68061ea7b59358874ae8da72572/gfx/2d/FilterNodeSoftware.cpp#3509
Hello Vincent, do you have any idea about this?
Assignee: kechen → nobody
Flags: needinfo?(vliu)
I think this is duplicate of Bug 1332980.
Status: NEW → RESOLVED
Closed: 8 years ago
Flags: needinfo?(vliu)
Resolution: --- → DUPLICATE
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Created:
Updated:
Size: