1371946 - Canvas2D crash: "assert(edge->fPrev->fPrev == nullptr || edge->fPrev->fX <= edge->fX)" [@SkScan::AAAFillPath]

Status: RESOLVED WONTFIX

(Core :: Graphics: Canvas2D, defect, P5)

Description

[Christoph Diehl [:posidron]]

Attachment: testcase-canvas2d.html

gfx/skia/skia/src/core/SkScan_AAAPath.cpp:1306: fatal error: "assert(edge->fPrev->fPrev == nullptr || edge->fPrev->fX <= edge->fX)"


Hit MOZ_CRASH() at /Users/posidron/.dev/repos/mozilla/mozilla-inbound/memory/mozalloc/mozalloc_abort.cpp:33


#0 0x110837584 in mozalloc_abort(char const*) (/Users/posidron/.dev/repos/mozilla/mozilla-inbound/obj/ff-asan-debug/dist/NightlyDebug.app/Contents/MacOS/libmozglue.dylib:x86_64+0x1584)
#1 0x12313dd87 in sk_abort_no_print() (/Users/posidron/.dev/repos/mozilla/mozilla-inbound/obj/ff-asan-debug/dist/NightlyDebug.app/Contents/MacOS/XUL:x86_64+0xaa03d87)
#2 0x123430231 in SkScan::AAAFillPath(SkPath const&, SkRegion const&, SkBlitter*, bool) (/Users/posidron/.dev/repos/mozilla/mozilla-inbound/obj/ff-asan-debug/dist/NightlyDebug.app/Contents/MacOS/XUL:x86_64+0xacf6231)
#3 0x12343e60b in SkScan::AAAFillPath(SkPath const&, SkRasterClip const&, SkBlitter*) (/Users/posidron/.dev/repos/mozilla/mozilla-inbound/obj/ff-asan-debug/dist/NightlyDebug.app/Contents/MacOS/XUL:x86_64+0xad0460b)
#4 0x122a3287e in SkScan::AntiFillPath(SkPath const&, SkRasterClip const&, SkBlitter*) (/Users/posidron/.dev/repos/mozilla/mozilla-inbound/obj/ff-asan-debug/dist/NightlyDebug.app/Contents/MacOS/XUL:x86_64+0xa2f887e)
#5 0x122fc2270 in SkDraw::drawDevPath(SkPath const&, SkPaint const&, bool, SkBlitter*, bool) const (/Users/posidron/.dev/repos/mozilla/mozilla-inbound/obj/ff-asan-debug/dist/NightlyDebug.app/Contents/MacOS/XUL:x86_64+0xa888270)
#6 0x122fc2d3b in SkDraw::drawPath(SkPath const&, SkPaint const&, SkMatrix const*, bool, bool, SkBlitter*) const (/Users/posidron/.dev/repos/mozilla/mozilla-inbound/obj/ff-asan-debug/dist/NightlyDebug.app/Contents/MacOS/XUL:x86_64+0xa888d3b)
#7 0x122dde3a4 in GrSWMaskHelper::drawShape(GrShape const&, SkRegion::Op, GrAA, unsigned char) (/Users/posidron/.dev/repos/mozilla/mozilla-inbound/obj/ff-asan-debug/dist/NightlyDebug.app/Contents/MacOS/XUL:x86_64+0xa6a43a4)
#8 0x122ddfa55 in GrSWMaskHelper::DrawShapeMaskToTexture(GrContext*, GrShape const&, SkIRect const&, GrAA, SkBackingFit, SkMatrix const*) (/Users/posidron/.dev/repos/mozilla/mozilla-inbound/obj/ff-asan-debug/dist/NightlyDebug.app/Contents/MacOS/XUL:x86_64+0xa6a5a55)
#9 0x122dee4d7 in GrSoftwarePathRenderer::onDrawPath(GrPathRenderer::DrawPathArgs const&) (/Users/posidron/.dev/repos/mozilla/mozilla-inbound/obj/ff-asan-debug/dist/NightlyDebug.app/Contents/MacOS/XUL:x86_64+0xa6b44d7)
#10 0x122b5abae in GrPathRenderer::drawPath(GrPathRenderer::DrawPathArgs const&) (/Users/posidron/.dev/repos/mozilla/mozilla-inbound/obj/ff-asan-debug/dist/NightlyDebug.app/Contents/MacOS/XUL:x86_64+0xa420bae)
#11 0x122dc9f34 in GrRenderTargetContext::internalDrawPath(GrClip const&, GrPaint&&, GrAA, SkMatrix const&, SkPath const&, GrStyle const&) (/Users/posidron/.dev/repos/mozilla/mozilla-inbound/obj/ff-asan-debug/dist/NightlyDebug.app/Contents/MacOS/XUL:x86_64+0xa68ff34)
#12 0x122dd26f7 in GrRenderTargetContext::drawPath(GrClip const&, GrPaint&&, GrAA, SkMatrix const&, SkPath const&, GrStyle const&) (/Users/posidron/.dev/repos/mozilla/mozilla-inbound/obj/ff-asan-debug/dist/NightlyDebug.app/Contents/MacOS/XUL:x86_64+0xa6986f7)
#13 0x122d44af4 in GrBlurUtils::drawPathWithMaskFilter(GrContext*, GrRenderTargetContext*, GrClip const&, SkPath const&, SkPaint const&, SkMatrix const&, SkMatrix const*, SkIRect const&, bool) (/Users/posidron/.dev/repos/mozilla/mozilla-inbound/obj/ff-asan-debug/dist/NightlyDebug.app/Contents/MacOS/XUL:x86_64+0xa60aaf4)
#14 0x122f53cbf in GrTextUtils::DrawPosTextAsPath(GrContext*, GrRenderTargetContext*, SkSurfaceProps const&, GrClip const&, SkPaint const&, SkMatrix const&, char const*, unsigned long, float const*, int, SkPoint const&, SkIRect const&) (/Users/posidron/.dev/repos/mozilla/mozilla-inbound/obj/ff-asan-debug/dist/NightlyDebug.app/Contents/MacOS/XUL:x86_64+0xa819cbf)
#15 0x122f65a8f in GrAtlasTextContext::drawPosText(GrContext*, GrRenderTargetContext*, GrClip const&, SkPaint const&, SkMatrix const&, SkSurfaceProps const&, char const*, unsigned long, float const*, int, SkPoint const&, SkIRect const&) (/Users/posidron/.dev/repos/mozilla/mozilla-inbound/obj/ff-asan-debug/dist/NightlyDebug.app/Contents/MacOS/XUL:x86_64+0xa82ba8f)
#16 0x122dbd6b0 in GrRenderTargetContext::drawPosText(GrClip const&, SkPaint const&, SkMatrix const&, char const*, unsigned long, float const*, int, SkPoint const&, SkIRect const&) (/Users/posidron/.dev/repos/mozilla/mozilla-inbound/obj/ff-asan-debug/dist/NightlyDebug.app/Contents/MacOS/XUL:x86_64+0xa6836b0)
#17 0x122e43b69 in SkGpuDevice::drawPosText(void const*, unsigned long, float const*, int, SkPoint const&, SkPaint const&) (/Users/posidron/.dev/repos/mozilla/mozilla-inbound/obj/ff-asan-debug/dist/NightlyDebug.app/Contents/MacOS/XUL:x86_64+0xa709b69)
#18 0x122c8a811 in SkCanvas::onDrawPosText(void const*, unsigned long, SkPoint const*, SkPaint const&) (/Users/posidron/.dev/repos/mozilla/mozilla-inbound/obj/ff-asan-debug/dist/NightlyDebug.app/Contents/MacOS/XUL:x86_64+0xa550811)
#19 0x122c8cafa in SkCanvas::drawPosText(void const*, unsigned long, SkPoint const*, SkPaint const&) (/Users/posidron/.dev/repos/mozilla/mozilla-inbound/obj/ff-asan-debug/dist/NightlyDebug.app/Contents/MacOS/XUL:x86_64+0xa552afa)
#20 0x11aeee4c8 in mozilla::gfx::DrawTargetSkia::DrawGlyphs(mozilla::gfx::ScaledFont*, mozilla::gfx::GlyphBuffer const&, mozilla::gfx::Pattern const&, mozilla::gfx::StrokeOptions const*, mozilla::gfx::DrawOptions const&, mozilla::gfx::GlyphRenderingOptions const*) (/Users/posidron/.dev/repos/mozilla/mozilla-inbound/obj/ff-asan-debug/dist/NightlyDebug.app/Contents/MacOS/XUL:x86_64+0x27b44c8)
#21 0x11aeeebe9 in mozilla::gfx::DrawTargetSkia::FillGlyphs(mozilla::gfx::ScaledFont*, mozilla::gfx::GlyphBuffer const&, mozilla::gfx::Pattern const&, mozilla::gfx::DrawOptions const&, mozilla::gfx::GlyphRenderingOptions const*) (/Users/posidron/.dev/repos/mozilla/mozilla-inbound/obj/ff-asan-debug/dist/NightlyDebug.app/Contents/MacOS/XUL:x86_64+0x27b4be9)
#22 0x11b79f4a1 in GlyphBufferAzure::Flush(bool) (/Users/posidron/.dev/repos/mozilla/mozilla-inbound/obj/ff-asan-debug/dist/NightlyDebug.app/Contents/MacOS/XUL:x86_64+0x30654a1)
#23 0x11b75e895 in gfxFont::DrawGlyphs(gfxShapedText const*, unsigned int, unsigned int, gfxPoint*, TextRunDrawParams const&, FontDrawParams const&) (/Users/posidron/.dev/repos/mozilla/mozilla-inbound/obj/ff-asan-debug/dist/NightlyDebug.app/Contents/MacOS/XUL:x86_64+0x3024895)
#24 0x11b76224c in gfxFont::Draw(gfxTextRun const*, unsigned int, unsigned int, gfxPoint*, TextRunDrawParams const&, mozilla::gfx::ShapedTextFlags) (/Users/posidron/.dev/repos/mozilla/mozilla-inbound/obj/ff-asan-debug/dist/NightlyDebug.app/Contents/MacOS/XUL:x86_64+0x302824c)
#25 0x11b7d321d in gfxTextRun::DrawGlyphs(gfxFont*, gfxTextRun::Range, gfxPoint*, gfxTextRun::PropertyProvider*, gfxTextRun::Range, TextRunDrawParams&, mozilla::gfx::ShapedTextFlags) const (/Users/posidron/.dev/repos/mozilla/mozilla-inbound/obj/ff-asan-debug/dist/NightlyDebug.app/Contents/MacOS/XUL:x86_64+0x309921d)
#26 0x11b7d5876 in gfxTextRun::Draw(gfxTextRun::Range, gfxPoint, gfxTextRun::DrawParams const&) const (/Users/posidron/.dev/repos/mozilla/mozilla-inbound/obj/ff-asan-debug/dist/NightlyDebug.app/Contents/MacOS/XUL:x86_64+0x309b876)
#27 0x11e400ec8 in mozilla::dom::CanvasBidiProcessor::DrawText(int, int) (/Users/posidron/.dev/repos/mozilla/mozilla-inbound/obj/ff-asan-debug/dist/NightlyDebug.app/Contents/MacOS/XUL:x86_64+0x5cc6ec8)
#28 0x121076a5f in nsBidiPresUtils::ProcessText(char16_t const*, int, unsigned char, nsPresContext*, nsBidiPresUtils::BidiProcessor&, nsBidiPresUtils::Mode, nsBidiPositionResolve*, int, int*, nsBidi*) (/Users/posidron/.dev/repos/mozilla/mozilla-inbound/obj/ff-asan-debug/dist/NightlyDebug.app/Contents/MacOS/XUL:x86_64+0x893ca5f)
#29 0x11e36cb7d in mozilla::dom::CanvasRenderingContext2D::DrawOrMeasureText(nsAString const&, float, float, mozilla::dom::Optional<double> const&, mozilla::dom::CanvasRenderingContext2D::TextDrawOperation, float*) (/Users/posidron/.dev/repos/mozilla/mozilla-inbound/obj/ff-asan-debug/dist/NightlyDebug.app/Contents/MacOS/XUL:x86_64+0x5c32b7d)
#30 0x11e36b69a in mozilla::dom::CanvasRenderingContext2D::FillText(nsAString const&, double, double, mozilla::dom::Optional<double> const&, mozilla::ErrorResult&) (/Users/posidron/.dev/repos/mozilla/mozilla-inbound/obj/ff-asan-debug/dist/NightlyDebug.app/Contents/MacOS/XUL:x86_64+0x5c3169a)
#31 0x11d22a82a in mozilla::dom::CanvasRenderingContext2DBinding::fillText(JSContext*, JS::Handle<JSObject*>, mozilla::dom::CanvasRenderingContext2D*, JSJitMethodCallArgs const&) (/Users/posidron/.dev/repos/mozilla/mozilla-inbound/obj/ff-asan-debug/dist/NightlyDebug.app/Contents/MacOS/XUL:x86_64+0x4af082a)
#32 0x11e25be25 in mozilla::dom::GenericBindingMethod(JSContext*, unsigned int, JS::Value*) (/Users/posidron/.dev/repos/mozilla/mozilla-inbound/obj/ff-asan-debug/dist/NightlyDebug.app/Contents/MacOS/XUL:x86_64+0x5b21e25)
#33 0x124dfa31d in js::CallJSNative(JSContext*, bool (*)(JSContext*, unsigned int, JS::Value*), JS::CallArgs const&) (/Users/posidron/.dev/repos/mozilla/mozilla-inbound/obj/ff-asan-debug/dist/NightlyDebug.app/Contents/MacOS/XUL:x86_64+0xc6c031d)
#34 0x124df9a23 in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct) (/Users/posidron/.dev/repos/mozilla/mozilla-inbound/obj/ff-asan-debug/dist/NightlyDebug.app/Contents/MacOS/XUL:x86_64+0xc6bfa23)
#35 0x124dccf13 in Interpret(JSContext*, js::RunState&) (/Users/posidron/.dev/repos/mozilla/mozilla-inbound/obj/ff-asan-debug/dist/NightlyDebug.app/Contents/MacOS/XUL:x86_64+0xc692f13)
#36 0x124dc529e in js::RunScript(JSContext*, js::RunState&) (/Users/posidron/.dev/repos/mozilla/mozilla-inbound/obj/ff-asan-debug/dist/NightlyDebug.app/Contents/MacOS/XUL:x86_64+0xc68b29e)

Comment 1

[Lee Salzman [:lsalzman]]

This bug doesn't seem to cause any actual crashes/problems in release when assertions are disabled. Further, we don't have a standalone Skia testcase for this, so there is no way to refer this to upstream. So I am going to mark this as WONTFIX for now.

As of bug 1305151, we made the collective decision that if Skia is going to be fuzzed in debug, it would be with the env var MOZ_SKIA_DISABLE_ASSERTS=1 set, so that we only catch actual crashes, and thus mirror upstream's fuzzing process. Otherwise, we get too much noise for upstream and ourselves with bugs that are not actually going to impact the release.

I believe Tyson Smith was working on fuzzing using a Skia harness directly so that we could generate testcases that upstream could actually investigate. For now, I would recommend rather to only fuzz with MOZ_SKIA_DISABLE_ASSERTS set, so that only actual release crashes are caught.