1429413 - Crash in mozilla::gfx::DataSourceSurface::ScopedMap::ScopedMap

Status: RESOLVED FIXED

(Core :: Graphics, defect, P3)

Description

[Andrew Osmond [:aosmond] (he/him)]

This bug was filed from the Socorro interface and is
report bp-e98dd697-9881-4ad4-852b-16bcd0180109.
=============================================================

Top 10 frames of crashing thread:

0 xul.dll mozilla::gfx::DataSourceSurface::ScopedMap::ScopedMap gfx/2d/2D.h:465
1 xul.dll mozilla::gfx::ConvertToB8G8R8A8_SIMD<__m128i> gfx/2d/FilterProcessingSIMD-inl.h:24
2 xul.dll mozilla::gfx::GetAlignedStride<16> gfx/2d/Tools.h:259
3 xul.dll mozilla::gfx::FilterNodeSoftware::GetInputDataSourceSurface gfx/2d/FilterNodeSoftware.cpp:791
4 xul.dll mozilla::gfx::FilterNodeCompositeSoftware::Render gfx/2d/FilterNodeSoftware.cpp:2901
5 xul.dll mozilla::gfx::FilterNodeSoftware::GetOutput gfx/2d/FilterNodeSoftware.cpp:628
6 xul.dll mozilla::gfx::FilterNodeSoftware::GetInputDataSourceSurface gfx/2d/FilterNodeSoftware.cpp:729
7 xul.dll mozilla::gfx::FilterNodeCompositeSoftware::Render gfx/2d/FilterNodeSoftware.cpp:2888
8 xul.dll mozilla::gfx::FilterNodeSoftware::GetOutput gfx/2d/FilterNodeSoftware.cpp:628
9 xul.dll mozilla::gfx::FilterNodeSoftware::GetInputDataSourceSurface gfx/2d/FilterNodeSoftware.cpp:729

=============================================================

It looks like Factory::CreateDataSourceSurface failed, but we don't actually check the allocation.

Comment 1

[Andrew Osmond [:aosmond] (he/him)]

Attachment: 0001-Bug-1429413-Ensure-Factory-CreateDataSourceSurface-a.patch, v1

There are a few places we make the same mistake.

try: https://treeherder.mozilla.org/#/jobs?repo=try&revision=95f767079fcf6d5e557ed39028682e5c87b374f6

Comment 2

[Bas Schouten (:bas.schouten)]

Comment on attachment 8941426 [details] [diff] [review]
0001-Bug-1429413-Ensure-Factory-CreateDataSourceSurface-a.patch, v1

Review of attachment 8941426 [details] [diff] [review]:
-----------------------------------------------------------------

::: dom/canvas/ImageBitmap.cpp
@@ +235,5 @@
>      Factory::CreateDataSourceSurfaceWithStride(rgbaDataSurface->GetSize(),
>                                                 SurfaceFormat::B8G8R8A8,
>                                                 rgbaMap.mStride);
> +  if (NS_WARN_IF(!bgraDataSurface)) {
> +    rgbaDataSurface->Unmap();

nit: We should have RAII classes for this too iirc.

::: gfx/2d/FilterProcessingSIMD-inl.h
@@ +13,5 @@
>  namespace gfx {
>  
>  template<typename u8x16_t>
>  inline already_AddRefed<DataSourceSurface>
>  ConvertToB8G8R8A8_SIMD(SourceSurface* aSurface)

Do all callers for this function handle getting a nullptr back correctly?

Comment 3

[Andrew Osmond [:aosmond] (he/him)]

(In reply to Bas Schouten (:bas.schouten) from comment #2)
> Comment on attachment 8941426 [details] [diff] [review]
> 0001-Bug-1429413-Ensure-Factory-CreateDataSourceSurface-a.patch, v1
> 
> Review of attachment 8941426 [details] [diff] [review]:
> -----------------------------------------------------------------
> 
> ::: dom/canvas/ImageBitmap.cpp
> @@ +235,5 @@
> >      Factory::CreateDataSourceSurfaceWithStride(rgbaDataSurface->GetSize(),
> >                                                 SurfaceFormat::B8G8R8A8,
> >                                                 rgbaMap.mStride);
> > +  if (NS_WARN_IF(!bgraDataSurface)) {
> > +    rgbaDataSurface->Unmap();
> 
> nit: We should have RAII classes for this too iirc.
> 

Will switch to ScopedMap before landing.

> ::: gfx/2d/FilterProcessingSIMD-inl.h
> @@ +13,5 @@
> >  namespace gfx {
> >  
> >  template<typename u8x16_t>
> >  inline already_AddRefed<DataSourceSurface>
> >  ConvertToB8G8R8A8_SIMD(SourceSurface* aSurface)
> 
> Do all callers for this function handle getting a nullptr back correctly?

Yes, it all checks out a few levels up.

Comment 4

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/mozilla-inbound/rev/cc133159ed92
Ensure Factory::CreateDataSourceSurface allocation failures are gracefully handled. r=bas

Comment 5

[Noemi Erli[:noemi_erli]]

https://hg.mozilla.org/mozilla-central/rev/cc133159ed92