Open Bug 1586056 Opened 6 months ago Updated 4 months ago

Assertion failure: [GFX1]: Attempt to render into a Canvas2d after shutdown., at /builds/worker/workspace/build/src/gfx/2d/Logging.h:740

Categories

(Core :: Canvas: 2D, defect, P3)

defect

Tracking

()

Tracking Status
firefox71 --- affected

People

(Reporter: jkratzer, Unassigned)

References

(Blocks 1 open bug)

Details

(Keywords: assertion, testcase)

Attachments

(1 file)

Attached file testcase.html

Testcase found while fuzzing mozilla-central rev 4a20e73bd624.

Assertion failure: [GFX1]: Attempt to render into a Canvas2d after shutdown., at /builds/worker/workspace/build/src/gfx/2d/Logging.h:740

rax = 0x0000561219dbc340   rdx = 0x0000000000000000
rcx = 0x00007f9aabb5341a   rbx = 0x00007ffda14fa3f8
rsi = 0x00007f9ab77be8b0   rdi = 0x00007f9ab77bd680
rbp = 0x00007ffda14fa330   rsp = 0x00007ffda14fa330
r8 = 0x00007f9ab77be8b0    r9 = 0x00007f9ab8927780
r10 = 0x0000000000000000   r11 = 0x0000000000000000
r12 = 0x00007ffda14fa348   r13 = 0x00000000a14fa800
r14 = 0x00007ffda14fa410   r15 = 0x00000000a14fa801
rip = 0x00007f9aa5e8b20d
OS|Linux|0.0.0 Linux 5.0.0-29-generic #31~18.04.1-Ubuntu SMP Thu Sep 12 18:29:21 UTC 2019 x86_64
CPU|amd64|family 6 model 94 stepping 3|1
GPU|||
Crash|SIGSEGV|0x0|0
0|0|libxul.so|mozilla::gfx::Log<3, mozilla::gfx::BasicLogger>::WriteLog(std::string const&)|hg:hg.mozilla.org/mozilla-central:gfx/2d/Logging.h:4a20e73bd6243d88d056cb41c0d6a0d4a2bd11e5|741|0x29
0|1|libxul.so|mozilla::gfx::Log<1, mozilla::gfx::CriticalLogger>::~Log()|hg:hg.mozilla.org/mozilla-central:gfx/2d/Logging.h:4a20e73bd6243d88d056cb41c0d6a0d4a2bd11e5|272|0x7d
0|2|libxul.so|mozilla::dom::CanvasRenderingContext2D::EnsureTarget(mozilla::gfx::RectTyped<mozilla::gfx::UnknownUnits, float> const*, bool)|hg:hg.mozilla.org/mozilla-central:dom/canvas/CanvasRenderingContext2D.cpp:4a20e73bd6243d88d056cb41c0d6a0d4a2bd11e5|1240|0x2e
0|3|libxul.so|mozilla::dom::CanvasRenderingContext2D::TransformWillUpdate()|hg:hg.mozilla.org/mozilla-central:dom/canvas/CanvasRenderingContext2D.cpp:4a20e73bd6243d88d056cb41c0d6a0d4a2bd11e5|3154|0x5
0|4|libxul.so|mozilla::dom::CanvasRenderingContext2D::SetTransform(double, double, double, double, double, double, mozilla::ErrorResult&)|hg:hg.mozilla.org/mozilla-central:dom/canvas/CanvasRenderingContext2D.cpp:4a20e73bd6243d88d056cb41c0d6a0d4a2bd11e5|1829|0x5
0|5|libxul.so|mozilla::dom::CanvasRenderingContext2D_Binding::setTransform|s3:gecko-generated-sources:cfe69bace6997cefe588998a513d533722d9aada20a5336fbb38770aea8db2d274879aa8c16028d92a2b9cee2f775d1aa479332e9f9795bf2f62e6ff79bcc69c/dom/bindings/CanvasRenderingContext2DBinding.cpp:|7085|0x3f
0|6|libxul.so|bool mozilla::dom::binding_detail::GenericMethod<mozilla::dom::binding_detail::NormalThisPolicy, mozilla::dom::binding_detail::ThrowExceptions>(JSContext*, unsigned int, JS::Value*)|hg:hg.mozilla.org/mozilla-central:dom/bindings/BindingUtils.cpp:4a20e73bd6243d88d056cb41c0d6a0d4a2bd11e5|3250|0x24
0|7|libxul.so|CallJSNative(JSContext*, bool (*)(JSContext*, unsigned int, JS::Value*), js::CallReason, JS::CallArgs const&)|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:4a20e73bd6243d88d056cb41c0d6a0d4a2bd11e5|458|0x18
0|8|libxul.so|js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason)|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:4a20e73bd6243d88d056cb41c0d6a0d4a2bd11e5|551|0x15
0|9|libxul.so|InternalCall|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:4a20e73bd6243d88d056cb41c0d6a0d4a2bd11e5|620|0x10
0|10|libxul.so|Interpret|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:4a20e73bd6243d88d056cb41c0d6a0d4a2bd11e5|3113|0x13
0|11|libxul.so|js::RunScript(JSContext*, js::RunState&)|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:4a20e73bd6243d88d056cb41c0d6a0d4a2bd11e5|424|0xb
0|12|libxul.so|js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason)|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:4a20e73bd6243d88d056cb41c0d6a0d4a2bd11e5|592|0x13
0|13|libxul.so|InternalCall|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:4a20e73bd6243d88d056cb41c0d6a0d4a2bd11e5|620|0x10
0|14|libxul.so|js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>, js::CallReason)|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:4a20e73bd6243d88d056cb41c0d6a0d4a2bd11e5|637|0x8
0|15|libxul.so|JS::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::HandleValueArray const&, JS::MutableHandle<JS::Value>)|hg:hg.mozilla.org/mozilla-central:js/src/jsapi.cpp:4a20e73bd6243d88d056cb41c0d6a0d4a2bd11e5|2728|0x1f
0|16|libxul.so|mozilla::dom::BlobCallback::Call(JSContext*, JS::Handle<JS::Value>, mozilla::dom::Blob*, mozilla::ErrorResult&)|s3:gecko-generated-sources:4a811cb46391e8333f34a0230ae31ffe521e629ffae2af872f611cbf3a1035ecd6d02b3e32b587da4697e936c6487b097e680c07cfa6f54da89a7af45af4e6b6/dom/bindings/HTMLCanvasElementBinding.cpp:|88|0x5
0|17|libxul.so|mozilla::dom::CanvasRenderingContextHelper::ToBlob(JSContext*, nsIGlobalObject*, mozilla::dom::BlobCallback&, nsTSubstring<char16_t> const&, JS::Handle<JS::Value>, bool, mozilla::ErrorResult&)::EncodeCallback::ReceiveBlob(already_AddRefed<mozilla::dom::Blob>)|||0x1a9
0|18|libxul.so|mozilla::dom::EncodingCompleteEvent::Run()|hg:hg.mozilla.org/mozilla-central:dom/base/ImageEncoder.cpp:4a20e73bd6243d88d056cb41c0d6a0d4a2bd11e5|110|0x1e
0|19|libxul.so|nsThread::ProcessNextEvent(bool, bool*)|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThread.cpp:4a20e73bd6243d88d056cb41c0d6a0d4a2bd11e5|1225|0x15
0|20|libxul.so|NS_ProcessNextEvent(nsIThread*, bool)|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThreadUtils.cpp:4a20e73bd6243d88d056cb41c0d6a0d4a2bd11e5|486|0x11
0|21|libxul.so|nsThread::Shutdown()|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThread.cpp:4a20e73bd6243d88d056cb41c0d6a0d4a2bd11e5|901|0xd
0|22|libxul.so|nsThreadPool::Shutdown()|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThreadPool.cpp:4a20e73bd6243d88d056cb41c0d6a0d4a2bd11e5|353|0x17
0|23|libxul.so|nsThreadManager::Shutdown()|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThreadManager.cpp:4a20e73bd6243d88d056cb41c0d6a0d4a2bd11e5|353|0x9
0|24|libxul.so|mozilla::ShutdownXPCOM(nsIServiceManager*)|hg:hg.mozilla.org/mozilla-central:xpcom/build/XPCOMInit.cpp:4a20e73bd6243d88d056cb41c0d6a0d4a2bd11e5|647|0xd
0|25|libxul.so|XRE_TermEmbedding()|hg:hg.mozilla.org/mozilla-central:toolkit/xre/nsEmbedFunctions.cpp:4a20e73bd6243d88d056cb41c0d6a0d4a2bd11e5|223|0x7
0|26|libxul.so|mozilla::ipc::ScopedXREEmbed::Stop()|hg:hg.mozilla.org/mozilla-central:ipc/glue/ScopedXREEmbed.cpp:4a20e73bd6243d88d056cb41c0d6a0d4a2bd11e5|90|0x5
0|27|libxul.so|XRE_InitChildProcess(int, char**, XREChildData const*)|hg:hg.mozilla.org/mozilla-central:toolkit/xre/nsEmbedFunctions.cpp:4a20e73bd6243d88d056cb41c0d6a0d4a2bd11e5|773|0x11
0|28|firefox-bin|content_process_main(mozilla::Bootstrap*, int, char**)|hg:hg.mozilla.org/mozilla-central:ipc/contentproc/plugin-container.cpp:4a20e73bd6243d88d056cb41c0d6a0d4a2bd11e5|56|0x14
0|29|firefox-bin|main|hg:hg.mozilla.org/mozilla-central:browser/app/nsBrowserApp.cpp:4a20e73bd6243d88d056cb41c0d6a0d4a2bd11e5|272|0x12
0|30|libc-2.27.so||||0x21b97
0|31|firefox-bin|MOZ_ReportCrash|hg:hg.mozilla.org/mozilla-central:mfbt/Assertions.h:4a20e73bd6243d88d056cb41c0d6a0d4a2bd11e5|203|0x5
Flags: in-testsuite?

Testcase bisects back further than a year.

Component: Graphics → Canvas: 2D
Priority: -- → P3
You need to log in before you can comment on or make changes to this bug.