1586056 - Assertion failure: [GFX1]: Attempt to render into a Canvas2d after shutdown., at /builds/worker/workspace/build/src/gfx/2d/Logging.h:740

Status: NEW

(Core :: Graphics: Canvas2D, defect, P3)

Description

[Jason Kratzer [:jkratzer]]

Attachment: testcase.html

Testcase found while fuzzing mozilla-central rev 4a20e73bd624.

Assertion failure: [GFX1]: Attempt to render into a Canvas2d after shutdown., at /builds/worker/workspace/build/src/gfx/2d/Logging.h:740

rax = 0x0000561219dbc340   rdx = 0x0000000000000000
rcx = 0x00007f9aabb5341a   rbx = 0x00007ffda14fa3f8
rsi = 0x00007f9ab77be8b0   rdi = 0x00007f9ab77bd680
rbp = 0x00007ffda14fa330   rsp = 0x00007ffda14fa330
r8 = 0x00007f9ab77be8b0    r9 = 0x00007f9ab8927780
r10 = 0x0000000000000000   r11 = 0x0000000000000000
r12 = 0x00007ffda14fa348   r13 = 0x00000000a14fa800
r14 = 0x00007ffda14fa410   r15 = 0x00000000a14fa801
rip = 0x00007f9aa5e8b20d
OS|Linux|0.0.0 Linux 5.0.0-29-generic #31~18.04.1-Ubuntu SMP Thu Sep 12 18:29:21 UTC 2019 x86_64
CPU|amd64|family 6 model 94 stepping 3|1
GPU|||
Crash|SIGSEGV|0x0|0
0|0|libxul.so|mozilla::gfx::Log<3, mozilla::gfx::BasicLogger>::WriteLog(std::string const&)|hg:hg.mozilla.org/mozilla-central:gfx/2d/Logging.h:4a20e73bd6243d88d056cb41c0d6a0d4a2bd11e5|741|0x29
0|1|libxul.so|mozilla::gfx::Log<1, mozilla::gfx::CriticalLogger>::~Log()|hg:hg.mozilla.org/mozilla-central:gfx/2d/Logging.h:4a20e73bd6243d88d056cb41c0d6a0d4a2bd11e5|272|0x7d
0|2|libxul.so|mozilla::dom::CanvasRenderingContext2D::EnsureTarget(mozilla::gfx::RectTyped<mozilla::gfx::UnknownUnits, float> const*, bool)|hg:hg.mozilla.org/mozilla-central:dom/canvas/CanvasRenderingContext2D.cpp:4a20e73bd6243d88d056cb41c0d6a0d4a2bd11e5|1240|0x2e
0|3|libxul.so|mozilla::dom::CanvasRenderingContext2D::TransformWillUpdate()|hg:hg.mozilla.org/mozilla-central:dom/canvas/CanvasRenderingContext2D.cpp:4a20e73bd6243d88d056cb41c0d6a0d4a2bd11e5|3154|0x5
0|4|libxul.so|mozilla::dom::CanvasRenderingContext2D::SetTransform(double, double, double, double, double, double, mozilla::ErrorResult&)|hg:hg.mozilla.org/mozilla-central:dom/canvas/CanvasRenderingContext2D.cpp:4a20e73bd6243d88d056cb41c0d6a0d4a2bd11e5|1829|0x5
0|5|libxul.so|mozilla::dom::CanvasRenderingContext2D_Binding::setTransform|s3:gecko-generated-sources:cfe69bace6997cefe588998a513d533722d9aada20a5336fbb38770aea8db2d274879aa8c16028d92a2b9cee2f775d1aa479332e9f9795bf2f62e6ff79bcc69c/dom/bindings/CanvasRenderingContext2DBinding.cpp:|7085|0x3f
0|6|libxul.so|bool mozilla::dom::binding_detail::GenericMethod<mozilla::dom::binding_detail::NormalThisPolicy, mozilla::dom::binding_detail::ThrowExceptions>(JSContext*, unsigned int, JS::Value*)|hg:hg.mozilla.org/mozilla-central:dom/bindings/BindingUtils.cpp:4a20e73bd6243d88d056cb41c0d6a0d4a2bd11e5|3250|0x24
0|7|libxul.so|CallJSNative(JSContext*, bool (*)(JSContext*, unsigned int, JS::Value*), js::CallReason, JS::CallArgs const&)|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:4a20e73bd6243d88d056cb41c0d6a0d4a2bd11e5|458|0x18
0|8|libxul.so|js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason)|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:4a20e73bd6243d88d056cb41c0d6a0d4a2bd11e5|551|0x15
0|9|libxul.so|InternalCall|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:4a20e73bd6243d88d056cb41c0d6a0d4a2bd11e5|620|0x10
0|10|libxul.so|Interpret|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:4a20e73bd6243d88d056cb41c0d6a0d4a2bd11e5|3113|0x13
0|11|libxul.so|js::RunScript(JSContext*, js::RunState&)|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:4a20e73bd6243d88d056cb41c0d6a0d4a2bd11e5|424|0xb
0|12|libxul.so|js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason)|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:4a20e73bd6243d88d056cb41c0d6a0d4a2bd11e5|592|0x13
0|13|libxul.so|InternalCall|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:4a20e73bd6243d88d056cb41c0d6a0d4a2bd11e5|620|0x10
0|14|libxul.so|js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>, js::CallReason)|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:4a20e73bd6243d88d056cb41c0d6a0d4a2bd11e5|637|0x8
0|15|libxul.so|JS::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::HandleValueArray const&, JS::MutableHandle<JS::Value>)|hg:hg.mozilla.org/mozilla-central:js/src/jsapi.cpp:4a20e73bd6243d88d056cb41c0d6a0d4a2bd11e5|2728|0x1f
0|16|libxul.so|mozilla::dom::BlobCallback::Call(JSContext*, JS::Handle<JS::Value>, mozilla::dom::Blob*, mozilla::ErrorResult&)|s3:gecko-generated-sources:4a811cb46391e8333f34a0230ae31ffe521e629ffae2af872f611cbf3a1035ecd6d02b3e32b587da4697e936c6487b097e680c07cfa6f54da89a7af45af4e6b6/dom/bindings/HTMLCanvasElementBinding.cpp:|88|0x5
0|17|libxul.so|mozilla::dom::CanvasRenderingContextHelper::ToBlob(JSContext*, nsIGlobalObject*, mozilla::dom::BlobCallback&, nsTSubstring<char16_t> const&, JS::Handle<JS::Value>, bool, mozilla::ErrorResult&)::EncodeCallback::ReceiveBlob(already_AddRefed<mozilla::dom::Blob>)|||0x1a9
0|18|libxul.so|mozilla::dom::EncodingCompleteEvent::Run()|hg:hg.mozilla.org/mozilla-central:dom/base/ImageEncoder.cpp:4a20e73bd6243d88d056cb41c0d6a0d4a2bd11e5|110|0x1e
0|19|libxul.so|nsThread::ProcessNextEvent(bool, bool*)|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThread.cpp:4a20e73bd6243d88d056cb41c0d6a0d4a2bd11e5|1225|0x15
0|20|libxul.so|NS_ProcessNextEvent(nsIThread*, bool)|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThreadUtils.cpp:4a20e73bd6243d88d056cb41c0d6a0d4a2bd11e5|486|0x11
0|21|libxul.so|nsThread::Shutdown()|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThread.cpp:4a20e73bd6243d88d056cb41c0d6a0d4a2bd11e5|901|0xd
0|22|libxul.so|nsThreadPool::Shutdown()|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThreadPool.cpp:4a20e73bd6243d88d056cb41c0d6a0d4a2bd11e5|353|0x17
0|23|libxul.so|nsThreadManager::Shutdown()|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThreadManager.cpp:4a20e73bd6243d88d056cb41c0d6a0d4a2bd11e5|353|0x9
0|24|libxul.so|mozilla::ShutdownXPCOM(nsIServiceManager*)|hg:hg.mozilla.org/mozilla-central:xpcom/build/XPCOMInit.cpp:4a20e73bd6243d88d056cb41c0d6a0d4a2bd11e5|647|0xd
0|25|libxul.so|XRE_TermEmbedding()|hg:hg.mozilla.org/mozilla-central:toolkit/xre/nsEmbedFunctions.cpp:4a20e73bd6243d88d056cb41c0d6a0d4a2bd11e5|223|0x7
0|26|libxul.so|mozilla::ipc::ScopedXREEmbed::Stop()|hg:hg.mozilla.org/mozilla-central:ipc/glue/ScopedXREEmbed.cpp:4a20e73bd6243d88d056cb41c0d6a0d4a2bd11e5|90|0x5
0|27|libxul.so|XRE_InitChildProcess(int, char**, XREChildData const*)|hg:hg.mozilla.org/mozilla-central:toolkit/xre/nsEmbedFunctions.cpp:4a20e73bd6243d88d056cb41c0d6a0d4a2bd11e5|773|0x11
0|28|firefox-bin|content_process_main(mozilla::Bootstrap*, int, char**)|hg:hg.mozilla.org/mozilla-central:ipc/contentproc/plugin-container.cpp:4a20e73bd6243d88d056cb41c0d6a0d4a2bd11e5|56|0x14
0|29|firefox-bin|main|hg:hg.mozilla.org/mozilla-central:browser/app/nsBrowserApp.cpp:4a20e73bd6243d88d056cb41c0d6a0d4a2bd11e5|272|0x12
0|30|libc-2.27.so||||0x21b97
0|31|firefox-bin|MOZ_ReportCrash|hg:hg.mozilla.org/mozilla-central:mfbt/Assertions.h:4a20e73bd6243d88d056cb41c0d6a0d4a2bd11e5|203|0x5

Comment 1

[Jason Kratzer [:jkratzer]]

Testcase bisects back further than a year.

Comment 2

[Intermittent Failures Robot]

1 failures in 5444 pushes (0.0 failures/push) were associated with this bug in the last 7 days.

Repository breakdown:

• autoland: 1

Platform breakdown:

• macosx1014-64-qr: 1

For more details, see:
https://treeherder.mozilla.org/intermittent-failures.html#/bugdetails?bug=1586056&startday=2019-11-18&endday=2019-11-24&tree=all

Comment 3

[Intermittent Failures Robot]

1 failures in 3217 pushes (0.0 failures/push) were associated with this bug in the last 7 days.

Repository breakdown:

• mozilla-central: 1

Platform and build breakdown:

• windows11-64-2009-mingwclang-qr: 1
  • debug: 1

For more details, see:
https://treeherder.mozilla.org/intermittent-failures/bugdetails?bug=1586056&startday=2024-01-08&endday=2024-01-14&tree=all

Comment 4

[Intermittent Failures Robot]

3 failures in 3599 pushes (0.001 failures/push) were associated with this bug in the last 7 days.

Repository breakdown:

• autoland: 2
• try: 1

Platform and build breakdown:

• windows11-64-2009-mingwclang-qr: 1
  • debug: 1
• windows11-32-2009-qr: 2
  • debug: 2

For more details, see:
https://treeherder.mozilla.org/intermittent-failures/bugdetails?bug=1586056&startday=2024-01-15&endday=2024-01-21&tree=all

Comment 5

[Intermittent Failures Robot]

4 failures in 4034 pushes (0.001 failures/push) were associated with this bug in the last 7 days.

Repository breakdown:

• autoland: 2
• mozilla-beta: 2

Platform and build breakdown:

• windows11-32-2009-qr: 4
  • debug: 4

For more details, see:
https://treeherder.mozilla.org/intermittent-failures/bugdetails?bug=1586056&startday=2024-01-22&endday=2024-01-28&tree=all