1486198 - Crash in static bool mozilla::wr::Moz2DRenderCallback (aBlob.length() > sizeof(size_t)) [Google Slides]

Status: RESOLVED FIXED

(Core :: Graphics: WebRender, defect, P1)

Description

[Calixte Denizet (:calixte)]

This bug was filed from the Socorro interface and is
report bp-1a6f231e-f58f-4637-ae9b-2ff320180825.
=============================================================

Top 10 frames of crashing thread:

0 xul.dll static bool mozilla::wr::Moz2DRenderCallback gfx/webrender_bindings/Moz2DImageRenderer.cpp:311
1 xul.dll wr_moz2d_render_cb gfx/webrender_bindings/Moz2DImageRenderer.cpp:377
2 xul.dll static void rayon::iter::plumbing::bridge_producer_consumer::helper<rayon::vec::VecProducer<webrender_bindings::moz2d_renderer::{{impl}}::rasterize::Job>, rayon::iter::map::MapConsumer<rayon::iter::collect::consumer::CollectConsumer< third_party/rust/rayon/src/iter/plumbing/mod.rs:418
3 xul.dll static void rayon_core::job::{{impl}}::execute<rayon_core::latch::SpinLatch, closure,  third_party/rust/rayon-core/src/job.rs:113
4 xul.dll static void rayon_core::registry::WorkerThread::wait_until_cold<rayon_core::latch::CountLatch> third_party/rust/rayon-core/src/registry.rs:567
5 xul.dll static void std::sys_common::backtrace::__rust_begin_short_backtrace<closure,  src/libstd/sys_common/backtrace.rs:137
6 xul.dll static void alloc::boxed::{{impl}}::call_box< src/liballoc/boxed.rs:640
7 xul.dll static void std::sys::windows::thread::{{impl}}::new::thread_start src/libstd/sys/windows/thread.rs:55
8 kernel32.dll BaseThreadInitThunk 
9 mozglue.dll static void patched_BaseThreadInitThunk mozglue/build/WindowsDllBlocklist.cpp:662

=============================================================

There is 1 crash in nightly 63 with buildid 20180824100112. In analyzing the backtrace, the regression may have been introduced by patch [1] to fix bug 1473943.

[1] https://hg.mozilla.org/mozilla-central/rev?node=73ffc23ea21b

Comment 1

[Darkspirit]

> MOZ_CRASH Reason 	MOZ_RELEASE_ASSERT(aBlob.length() > sizeof(size_t))

Comment 2

[Darkspirit]

Attachment: 2018-09-09_13-51-22.mp4

(Asif Youssuff from bug 1466613 comment 15)
> I am seeing this crash when navigating to
> https://movielens.org/profile/about-your-ratings

> bp-0367742f-d339-4caf-b85e-27c9a0180908

(Mayank Bansal from bug 1466613 comment 19)
> I created a test account, and did some random ratings to generate the graphs.
> You can use this login:   testing123456:testing123

Debian Testing, KDE, Xorg, GTX 1060
I zoomed to 110%, pressed F5 and zommed in to 120% and back to 110% by Ctrl+Mousewheel.
If it crashed once, just resuming the seession is enough: The tab loads at 110% zoom and automatically crashes. Resetting to 100% zoom does not help.
It seems that the top left diagram does not expand to the right when it crashes.
bp-037ee29e-5941-42cf-a48b-376000180909

Comment 3

[Darkspirit]

(Mayank Bansal from bug 1466613 comment 17)
> I got crashes like  these when opening blank google sheets and typing something. But its not 100% reproducible.
> https://crash-stats.mozilla.com/report/index/85aaeae6-440d-4664-ac92-35f760180909

(Francois Guerraz from bug 1466613 comment 7)
> Created attachment 9007176 [details]
> ASAN crash report
> 
> I can reproduce it reliably while editing a google slide presentation, attached is the ASAN crash report.

(Francois Guerraz from bug 1466613 comment 9)
> Yes, create a new presentation:
> https://docs.google.com/presentation/
> Click the "blank template", start typing a title in the big title box, and voilà.
> 
> It's pretty much unusable, anything I try to do with slides leads to a crash.

Comment 4

[Josh Matthews [:jdm]]

I'm hitting this on http://questionablecontent.net/. Beware if it gets into your session history, because it crashes early during the page load.

Comment 5

[Jeff Muizelaar [:jrmuizel]]

I've reproduced this locally on movielens

Comment 6

[Jeff Muizelaar [:jrmuizel]]

I was able to trace this a bit. It looks like we're ending up with extra-short blob after merging.

Comment 7

[Jeff Muizelaar [:jrmuizel]]

Attachment: Bug 1486198. Be more accepting of empty blob images

Comment 8

[Markus Stange [:mstange]]

Comment on attachment 9008246 [details]
Bug 1486198. Be more accepting of empty blob images

Markus Stange [:mstange] has approved the revision.

Comment 9

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/1c34d1145c5e
Be more accepting of empty blob images r=mstange

Comment 10

[Raul Gurzau (:RaulG)]

https://hg.mozilla.org/mozilla-central/rev/1c34d1145c5e