Closed Bug 1551745 Opened 1 year ago Closed 1 year ago

Assertion failure: initialBytes + nbytes > initialBytes, at src/js/src/gc/Scheduling.h:680

Categories

(Core :: JavaScript: GC, defect, P1)

defect

Tracking

()

RESOLVED FIXED
mozilla68
Tracking Status
firefox-esr60 --- wontfix
firefox67 --- wontfix
firefox68 --- fixed

People

(Reporter: tsmith, Assigned: jonco)

References

(Blocks 1 open bug)

Details

(Keywords: assertion, testcase)

Attachments

(2 files)

Attached file testcase.html

Assertion failure: initialBytes + nbytes > initialBytes, at src/js/src/gc/Scheduling.h:680

#0 js::gc::MemoryTracker::addMemory(js::gc::Cell*, unsigned long, js::MemoryUse) src/js/src/gc/Scheduling.h:678:5
#1 JS::AddAssociatedMemory(JSObject*, unsigned long, JS::MemoryUse) src/js/src/jsapi.cpp:1165:9
#2 mozilla::dom::CanvasRenderingContext2D::ClearTarget(int, int) src/dom/canvas/CanvasRenderingContext2D.cpp:1502:7
#3 mozilla::dom::CanvasRenderingContext2D::SetDimensions(int, int) src/dom/canvas/CanvasRenderingContext2D.cpp:1475:3
#4 mozilla::dom::CanvasRenderingContextHelper::UpdateContext(JSContext*, JS::Handle<JS::Value>, mozilla::ErrorResult&) src/dom/canvas/CanvasRenderingContextHelper.cpp:216:24
#5 mozilla::dom::HTMLCanvasElement::AfterMaybeChangeAttr(int, nsAtom*, bool) src/dom/html/HTMLCanvasElement.cpp:461:5
#6 mozilla::dom::HTMLCanvasElement::AfterSetAttr(int, nsAtom*, nsAttrValue const*, nsAttrValue const*, nsIPrincipal*, bool) src/dom/html/HTMLCanvasElement.cpp:440:3
#7 mozilla::dom::Element::SetAttrAndNotify(int, nsAtom*, nsAtom*, nsAttrValue const*, nsAttrValue&, nsIPrincipal*, unsigned char, bool, bool, bool, mozilla::dom::Document*, mozAutoDocUpdate const&) src/dom/base/Element.cpp:2541:10
#8 mozilla::dom::Element::SetAttr(int, nsAtom*, nsAtom*, nsTSubstring<char16_t> const&, nsIPrincipal*, bool) src/dom/base/Element.cpp:2405:10
#9 mozilla::dom::Element::SetAttribute(nsTSubstring<char16_t> const&, nsTSubstring<char16_t> const&, nsIPrincipal*, mozilla::ErrorResult&) src/dom/base/Element.cpp:1408:12
#10 mozilla::dom::Element_Binding::setAttribute(JSContext*, JS::Handle<JSObject*>, mozilla::dom::Element*, JSJitMethodCallArgs const&) src/obj-firefox/dom/bindings/ElementBinding.cpp:1490:9
#11 bool mozilla::dom::binding_detail::GenericMethod<mozilla::dom::binding_detail::NormalThisPolicy, mozilla::dom::binding_detail::ThrowExceptions>(JSContext*, unsigned int, JS::Value*) src/dom/bindings/BindingUtils.cpp:3165:13
#12 CallJSNative(JSContext*, bool (*)(JSContext*, unsigned int, JS::Value*), JS::CallArgs const&) src/js/src/vm/Interpreter.cpp:443:13
#13 js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct) src/js/src/vm/Interpreter.cpp:535:12
#14 InternalCall(JSContext*, js::AnyInvokeArgs const&) src/js/src/vm/Interpreter.cpp:590:10
#15 Interpret(JSContext*, js::RunState&) src/js/src/vm/Interpreter.cpp:3082:16
#16 js::RunScript(JSContext*, js::RunState&) src/js/src/vm/Interpreter.cpp:423:10
#17 js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct) src/js/src/vm/Interpreter.cpp:563:13
#18 InternalCall(JSContext*, js::AnyInvokeArgs const&) src/js/src/vm/Interpreter.cpp:590:10
#19 js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>) src/js/src/vm/Interpreter.cpp:606:8
#20 JS::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::HandleValueArray const&, JS::MutableHandle<JS::Value>) src/js/src/jsapi.cpp:2655:10
#21 mozilla::dom::EventListener::HandleEvent(JSContext*, JS::Handle<JS::Value>, mozilla::dom::Event&, mozilla::ErrorResult&) src/obj-firefox/dom/bindings/EventListenerBinding.cpp:52:8
#22 void mozilla::dom::EventListener::HandleEvent<mozilla::dom::EventTarget*>(mozilla::dom::EventTarget* const&, mozilla::dom::Event&, mozilla::ErrorResult&, char const*, mozilla::dom::CallbackObject::ExceptionHandling, JS::Realm*) src/obj-firefox/dist/include/mozilla/dom/EventListenerBinding.h:66:12
#23 mozilla::EventListenerManager::HandleEventSubType(mozilla::EventListenerManager::Listener*, mozilla::dom::Event*, mozilla::dom::EventTarget*) src/dom/events/EventListenerManager.cpp:1038:43
#24 mozilla::EventListenerManager::HandleEventInternal(nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event**, mozilla::dom::EventTarget*, nsEventStatus*, bool) src/dom/events/EventListenerManager.cpp:1239:17
#25 mozilla::EventTargetChainItem::HandleEvent(mozilla::EventChainPostVisitor&, mozilla::ELMCreationDetector&) src/dom/events/EventDispatcher.cpp:349:17
#26 mozilla::EventTargetChainItem::HandleEventTargetChain(nsTArray<mozilla::EventTargetChainItem>&, mozilla::EventChainPostVisitor&, mozilla::EventDispatchingCallback*, mozilla::ELMCreationDetector&) src/dom/events/EventDispatcher.cpp:551:16
#27 mozilla::EventDispatcher::Dispatch(nsISupports*, nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event*, nsEventStatus*, mozilla::EventDispatchingCallback*, nsTArray<mozilla::dom::EventTarget*>*) src/dom/events/EventDispatcher.cpp:1047:11
#28 nsDocumentViewer::LoadComplete(nsresult) src/layout/base/nsDocumentViewer.cpp:1104:7
#29 nsDocShell::EndPageLoad(nsIWebProgress*, nsIChannel*, nsresult) src/docshell/base/nsDocShell.cpp:6646:20
#30 nsDocShell::OnStateChange(nsIWebProgress*, nsIRequest*, unsigned int, nsresult) src/docshell/base/nsDocShell.cpp:6446:7
#31 non-virtual thunk to nsDocShell::OnStateChange(nsIWebProgress*, nsIRequest*, unsigned int, nsresult) src/docshell/base/nsDocShell.cpp
#32 nsDocLoader::DoFireOnStateChange(nsIWebProgress*, nsIRequest*, int&, nsresult) src/uriloader/base/nsDocLoader.cpp:1313:3
#33 nsDocLoader::doStopDocumentLoad(nsIRequest*, nsresult) src/uriloader/base/nsDocLoader.cpp:872:14
#34 nsDocLoader::DocLoaderIsEmpty(bool) src/uriloader/base/nsDocLoader.cpp:710:9
#35 nsDocLoader::OnStopRequest(nsIRequest*, nsresult) src/uriloader/base/nsDocLoader.cpp:598:5
#36 non-virtual thunk to nsDocLoader::OnStopRequest(nsIRequest*, nsresult) src/uriloader/base/nsDocLoader.cpp
#37 mozilla::net::nsLoadGroup::RemoveRequest(nsIRequest*, nsISupports*, nsresult) src/netwerk/base/nsLoadGroup.cpp:568:22
#38 imgRequestProxy::RemoveFromLoadGroup() src/image/imgRequestProxy.cpp:404:15
#39 imgRequestProxy::OnLoadComplete(bool) src/image/imgRequestProxy.cpp:1032:7
#40 void mozilla::image::ImageObserverNotifier<mozilla::image::ObserverTable const*>::operator()<void mozilla::image::SyncNotifyInternal<mozilla::image::ObserverTable const*>(mozilla::image::ObserverTable const* const&, bool, unsigned int, mozilla::gfx::IntRectTyped<mozilla::gfx::UnknownUnits> const&)::'lambda5'(mozilla::image::IProgressObserver*)>(mozilla::image::ObserverTable const*) src/image/ProgressTracker.cpp:260:9
#41 void mozilla::image::SyncNotifyInternal<mozilla::image::ObserverTable const*>(mozilla::image::ObserverTable const* const&, bool, unsigned int, mozilla::gfx::IntRectTyped<mozilla::gfx::UnknownUnits> const&) src/image/ProgressTracker.cpp:329:5
#42 mozilla::image::ProgressTracker::SyncNotifyProgress(unsigned int, mozilla::gfx::IntRectTyped<mozilla::gfx::UnknownUnits> const&)::$_1::operator()(mozilla::image::ObserverTable const*) const src/image/ProgressTracker.cpp:348:5
#43 decltype(fp(static_cast<mozilla::image::ObserverTable const*>(std::nullptr_t))) mozilla::image::CopyOnWrite<mozilla::image::ObserverTable>::Read<mozilla::image::ProgressTracker::SyncNotifyProgress(unsigned int, mozilla::gfx::IntRectTyped<mozilla::gfx::UnknownUnits> const&)::$_1>(mozilla::image::ProgressTracker::SyncNotifyProgress(unsigned int, mozilla::gfx::IntRectTyped<mozilla::gfx::UnknownUnits> const&)::$_1) const src/image/CopyOnWrite.h:155:12
#44 mozilla::image::ProgressTracker::SyncNotifyProgress(unsigned int, mozilla::gfx::IntRectTyped<mozilla::gfx::UnknownUnits> const&) src/image/ProgressTracker.cpp:347:14
#45 mozilla::image::RasterImage::NotifyProgress(unsigned int, mozilla::gfx::IntRectTyped<mozilla::gfx::UnknownUnits> const&, mozilla::Maybe<unsigned int> const&, mozilla::image::DecoderFlags, mozilla::image::SurfaceFlags) src/image/RasterImage.cpp:1614:28
#46 mozilla::image::RasterImage::NotifyForLoadEvent(unsigned int) src/image/RasterImage.cpp:938:3
#47 mozilla::image::RasterImage::OnImageDataComplete(nsIRequest*, nsISupports*, nsresult, bool) src/image/RasterImage.cpp:921:3
#48 imgRequest::OnStopRequest(nsIRequest*, nsresult) src/image/imgRequest.cpp:787:16
#49 nsJARChannel::OnStopRequest(nsIRequest*, nsresult) src/modules/libjar/nsJARChannel.cpp:1026:16
#50 non-virtual thunk to nsJARChannel::OnStopRequest(nsIRequest*, nsresult) src/modules/libjar/nsJARChannel.cpp
#51 nsInputStreamPump::OnStateStop() src/netwerk/base/nsInputStreamPump.cpp:655:16
#52 nsInputStreamPump::OnInputStreamReady(nsIAsyncInputStream*) src/netwerk/base/nsInputStreamPump.cpp:403:21
#53 non-virtual thunk to nsInputStreamPump::OnInputStreamReady(nsIAsyncInputStream*) src/netwerk/base/nsInputStreamPump.cpp
#54 nsInputStreamReadyEvent::Run() src/xpcom/io/nsStreamUtils.cpp:91:20
#55 nsThread::ProcessNextEvent(bool, bool*) src/xpcom/threads/nsThread.cpp:1175:14
#56 NS_ProcessNextEvent(nsIThread*, bool) src/xpcom/threads/nsThreadUtils.cpp:486:10
#57 mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) src/ipc/glue/MessagePump.cpp:88:21
#58 MessageLoop::RunInternal() src/ipc/chromium/src/base/message_loop.cc:315:10
#59 MessageLoop::Run() src/ipc/chromium/src/base/message_loop.cc:290:3
#60 nsBaseAppShell::Run() src/widget/nsBaseAppShell.cpp:137:27
#61 XRE_RunAppShell() src/toolkit/xre/nsEmbedFunctions.cpp:919:20
#62 mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*) src/ipc/glue/MessagePump.cpp:238:9
#63 MessageLoop::RunInternal() src/ipc/chromium/src/base/message_loop.cc:315:10
#64 MessageLoop::Run() src/ipc/chromium/src/base/message_loop.cc:290:3
#65 XRE_InitChildProcess(int, char**, XREChildData const*) src/toolkit/xre/nsEmbedFunctions.cpp:757:34
#66 content_process_main(mozilla::Bootstrap*, int, char**) src/browser/app/../../ipc/contentproc/plugin-container.cpp:56:28
#67 main src/browser/app/nsBrowserApp.cpp:263:18
Flags: in-testsuite?
Assignee: nobody → jcoppeard
Priority: -- → P1

The patch changes the calculation for the allocation size associated with a canvas rendering context to return zero when the width or height are greater than allowed (the is will result in an error when creating the target later on) and also if the size calculation overflows (which shouldn't normally happen given the previous check).

Pushed by jcoppeard@mozilla.com:
https://hg.mozilla.org/integration/mozilla-inbound/rev/a0464187dbfa
Check max size and fix overflow calculating canvas allocation size r=smaug

The call to gfxPrefs::MaxCanvasSize() is causing a rooting hazard as below. I'm pretty sure this is a false positive but I'm going to remove this part of the code and leave the overflow check while I figure this out. This should still fix the original problem.

Function '_ZN7mozilla3dom32CanvasRenderingContext2D_BindingL9_finalizeEPN2js6FreeOpEP8JSObject$CanvasRenderingContext2DBinding.cpp:void mozilla::dom::CanvasRenderingContext2D_Binding::_finalize(js::FreeOp*, JSObject*)' has unrooted 'obj' of type 'JSObject*' live across GC call '_ZN7mozilla3dom26BindingJSObjectMallocBytesEPNS0_24CanvasRenderingContext2DE$uint64 mozilla::dom::BindingJSObjectMallocBytes(mozilla::dom::CanvasRenderingContext2D*)' at obj-analyzed/dom/bindings/CanvasRenderingContext2DBinding.cpp:7151
    CanvasRenderingContext2DBinding.cpp:7147: Call(1,2, self := UnwrapPossiblyNotInitializedDOMObject(obj*))
    CanvasRenderingContext2DBinding.cpp:7148: Assume(2,3, !null(self*), true)
    CanvasRenderingContext2DBinding.cpp:7149: Call(3,4, __temp_1 := UndefinedValue())
    CanvasRenderingContext2DBinding.cpp:7149: Call(4,5, SetReservedSlot(obj*,0,__temp_1))
    CanvasRenderingContext2DBinding.cpp:7150: Assume(5,7, !null(self*), false)
    CanvasRenderingContext2DBinding.cpp:7150: Assign(7,8, __temp_2 := 0)
    CanvasRenderingContext2DBinding.cpp:7150: Call(8,9, ClearWrapper(self*,__temp_2*,obj*))
    CanvasRenderingContext2DBinding.cpp:7151: Call(9,10, mallocBytes := BindingJSObjectMallocBytes(self*)) [[GC call]]
    CanvasRenderingContext2DBinding.cpp:7151: Assume(10,11, (mallocBytes* != 0), true)
    CanvasRenderingContext2DBinding.cpp:7152: Call(11,12, RemoveAssociatedMemory(obj*,mallocBytes*,1))
GC Function: _ZN7mozilla3dom26BindingJSObjectMallocBytesEPNS0_24CanvasRenderingContext2DE$uint64 mozilla::dom::BindingJSObjectMallocBytes(mozilla::dom::CanvasRenderingContext2D*)
    int32 gfxPrefs::MaxCanvasSize()
    gfxPrefs* gfxPrefs::GetSingleton()
    gfxPrefs* gfxPrefs::CreateAndInitializeSingleton()
    void gfxPrefs::Init()
    void gfxPrefs::SetGfxLoggingLevelChangeCallback((void)(mozilla::gfx::GfxPrefValue*)*)
    void gfxPrefs::Pref::SetChangeCallback((void)(mozilla::gfx::GfxPrefValue*)*)
    void gfxPrefs::Pref::FireChangeCallback()
    gfxPrefs::Pref.mChangeCallback
    unresolved gfxPrefs::Pref.mChangeCallback


Function '_ZN7mozilla3dom24CanvasRenderingContext2D11ClearTargetEii$void mozilla::dom::CanvasRenderingContext2D::ClearTarget(int32, int32)' has unrooted 'wrapper' of type 'JSObject*' live across GC call '_ZN7mozilla3dom26BindingJSObjectMallocBytesEPNS0_24CanvasRenderingContext2DE$uint64 mozilla::dom::BindingJSObjectMallocBytes(mozilla::dom::CanvasRenderingContext2D*)' at dom/canvas/CanvasRenderingContext2D.cpp:1494
    CanvasRenderingContext2D.cpp:1492: Call(6,7, wrapper := this*.field:1.GetWrapperMaybeDead())
    CanvasRenderingContext2D.cpp:1493: Assume(7,8, !null(wrapper*), true)
    CanvasRenderingContext2D.cpp:1494: Call(8,9, __temp_1 := BindingJSObjectMallocBytes(this*)) [[GC call]]
    CanvasRenderingContext2D.cpp:1494: Call(9,10, RemoveAssociatedMemory(wrapper*,__temp_1*,1))
GC Function: _ZN7mozilla3dom26BindingJSObjectMallocBytesEPNS0_24CanvasRenderingContext2DE$uint64 mozilla::dom::BindingJSObjectMallocBytes(mozilla::dom::CanvasRenderingContext2D*)
    int32 gfxPrefs::MaxCanvasSize()
    gfxPrefs* gfxPrefs::GetSingleton()
    gfxPrefs* gfxPrefs::CreateAndInitializeSingleton()
    void gfxPrefs::Init()
    void gfxPrefs::SetGfxLoggingLevelChangeCallback((void)(mozilla::gfx::GfxPrefValue*)*)
    void gfxPrefs::Pref::SetChangeCallback((void)(mozilla::gfx::GfxPrefValue*)*)
    void gfxPrefs::Pref::FireChangeCallback()
    gfxPrefs::Pref.mChangeCallback
    unresolved gfxPrefs::Pref.mChangeCallback
Keywords: leave-open
Pushed by jcoppeard@mozilla.com:
https://hg.mozilla.org/integration/mozilla-inbound/rev/1be11bf256ee
Remove false positive rooting hazard calculating allocation size until there's a fix r=me
Keywords: leave-open
See Also: → 1552137
Status: NEW → RESOLVED
Closed: 1 year ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla68
Flags: in-testsuite? → in-testsuite+
You need to log in before you can comment on or make changes to this bug.