1378130 - fatal error: "assert(edge->fPrev->fPrev == nullptr || edge->fPrev->fX <= edge->fX)"

Status: RESOLVED FIXED

(Core :: Graphics, defect, P3)

Description

[Carsten Book [:Tomcat]]

Attachment: bughunter stack

found via bughunter and reproduced on latest m-c tinderbox trunk debug build on latest ubuntu 

Steps to reproduce:
-> Load https://www.collegesearch.in/colleges/national-institute-of-construction-management-and-research-nicmar-pune#alumni
--> after some crazy redirects the debug build crash after 15-30 seconds 


home/worker/workspace/build/src/gfx/skia/skia/src/core/SkScan_AAAPath.cpp:1306: fatal error: "assert(edge->fPrev->fPrev == nullptr || edge->fPrev->fX <= edge->fX)"
Abort from sk_abort
Hit MOZ_CRASH() at /home/worker/workspace/build/src/memory/mozalloc/mozalloc_abort.cpp:33

Comment 1

[Carsten Book [:Tomcat]]

Lee: could you take a look thanks!

Comment 2

[Lee Salzman [:lsalzman]]

Upstream Skia bug report: https://bugs.chromium.org/p/skia/issues/detail?id=6947

Comment 3

[Lee Salzman [:lsalzman]]

Attachment: backport of fix for bounds violation in Skia's AAA path rendering

Just a straight backport of upstream fix here: https://skia-review.googlesource.com/c/33420

Comment 4

[Lee Salzman [:lsalzman]]

Attachment: backport of fix for bounds violation in Skia's AAA path rendering

Needed to add some small amount of extra fuzz to two tests where some AA pixels changed by 1 unit or so.

Comment 5

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/mozilla-inbound/rev/a0249586bdc1
backport of fix for bounds violation in Skia's AAA path rendering. r=jrmuizel

Comment 6

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

I had to back this out for quantum render reftest failures like https://treeherder.mozilla.org/logviewer.html#?job_id=123089464&repo=mozilla-inbound and https://treeherder.mozilla.org/logviewer.html#?job_id=123089457&repo=mozilla-inbound

https://hg.mozilla.org/integration/mozilla-inbound/rev/8062a6549a1d8e2797dc85e3023c960110df5f75

Comment 7

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/mozilla-inbound/rev/47b298a10edc
backport of fix for bounds violation in Skia's AAA path rendering. r=jrmuizel

Comment 8

[Lee Salzman [:lsalzman]]

Adjusted fuzz.

Comment 9

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/47b298a10edc

Comment 10

[Ryan VanderMeulen [:RyanVM]]

Is there a user impact here that justifies backport to Beta or can this ride the 57 train?

Comment 11

[Lee Salzman [:lsalzman]]

This does not seem to cause an observable issue outside of debug builds, so I am inclined to just let it ride the trains.

Comment 12

[Career Convey]

(In reply to Carsten Book [:Tomcat] from comment #0)
> Created attachment 8883298 [details]
> bughunter stack
> 
> found via bughunter and reproduced on latest m-c tinderbox trunk debug build
> on latest ubuntu 
> 
> Steps to reproduce:
> -> Load
> https://www.collegesearch.in/colleges/national-institute-of-construction-
> management-and-research-nicmar-pune#alumni
> --> after some crazy redirects the debug build crash after 15-30 seconds 
> 
> 
> home/worker/workspace/build/src/gfx/skia/skia/src/core/SkScan_AAAPath.cpp:
> 1306: fatal error: "assert(edge->fPrev->fPrev == nullptr || edge->fPrev->fX
> <= edge->fX)"
> Abort from sk_abort
> Hit MOZ_CRASH() at
> /home/worker/workspace/build/src/memory/mozalloc/mozalloc_abort.cpp:33

https://www.careerconvey.com/articles/

Comment 13

[Career Convey]

https://www.careerconvey.com/
https://www.careerconvey.com/exam