Open Bug 1596487 Opened 5 months ago Updated 5 months ago

Assertion failure: [GFX1]: RGBX pixel at (0,0) in 1200x150 surface is not opaque: 0,0,0,0, at /builds/worker/workspace/build/src/gfx/2d/Logging.h:740

Categories

(Core :: Canvas: 2D, defect, P3)

defect

Tracking

()

Tracking Status
firefox72 --- affected

People

(Reporter: jkratzer, Unassigned)

References

(Blocks 1 open bug)

Details

(Keywords: assertion, testcase)

Attachments

(1 file)

Attached file testcase.html

Testcase found while fuzzing mozilla-central rev caf55914ccdd.

Assertion failure: [GFX1]: RGBX pixel at (0,0) in 1200x150 surface is not opaque: 0,0,0,0, at /builds/worker/workspace/build/src/gfx/2d/Logging.h:740

rax = 0x000056014e77b340   rdx = 0x0000000000000000
rcx = 0x00007fd8936c99b0   rbx = 0x00007fff5538cfc8
rsi = 0x00007fd89f3898b0   rdi = 0x00007fd89f388680
rbp = 0x00007fff5538cf40   rsp = 0x00007fff5538cf40
r8 = 0x00007fd89f3898b0    r9 = 0x00007fd8a04f2780
r10 = 0x0000000000000000   r11 = 0x0000000000000000
r12 = 0x00007fff5538cf58   r13 = 0x00007fff5538cfe0
r14 = 0x00007fd884cb4000   r15 = 0x0000000000000000
rip = 0x00007fd88d8881bd
OS|Linux|0.0.0 Linux 5.0.0-31-generic #33~18.04.1-Ubuntu SMP Tue Oct 1 10:20:39 UTC 2019 x86_64
CPU|amd64|family 6 model 94 stepping 3|1
GPU|||
Crash|SIGSEGV|0x0|0
0|0|libxul.so|mozilla::gfx::Log<3, mozilla::gfx::BasicLogger>::WriteLog(std::string const&)|hg:hg.mozilla.org/mozilla-central:gfx/2d/Logging.h:caf55914ccddba34d462a1206530d7868b6c4992|741|0x29
0|1|libxul.so|mozilla::gfx::Log<1, mozilla::gfx::CriticalLogger>::Flush()|hg:hg.mozilla.org/mozilla-central:gfx/2d/Logging.h:caf55914ccddba34d462a1206530d7868b6c4992|739|0x12
0|2|libxul.so|mozilla::gfx::VerifyRGBXFormat|hg:hg.mozilla.org/mozilla-central:gfx/2d/Logging.h:caf55914ccddba34d462a1206530d7868b6c4992|272|0x8
0|3|libxul.so|mozilla::gfx::DrawTargetSkia::OptimizeSourceSurface(mozilla::gfx::SourceSurface*) const|hg:hg.mozilla.org/mozilla-central:gfx/2d/DrawTargetSkia.cpp:caf55914ccddba34d462a1206530d7868b6c4992|1590|0x19
0|4|libxul.so|nsLayoutUtils::SurfaceFromElement(mozilla::dom::HTMLVideoElement*, unsigned int, RefPtr<mozilla::gfx::DrawTarget>&)|hg:hg.mozilla.org/mozilla-central:layout/base/nsLayoutUtils.cpp:caf55914ccddba34d462a1206530d7868b6c4992|7690|0x1f
0|5|libxul.so|nsLayoutUtils::SurfaceFromElement(mozilla::dom::Element*, unsigned int, RefPtr<mozilla::gfx::DrawTarget>&)|hg:hg.mozilla.org/mozilla-central:layout/base/nsLayoutUtils.cpp:caf55914ccddba34d462a1206530d7868b6c4992|7719|0xb
0|6|libxul.so|mozilla::dom::CanvasRenderingContext2D::CreatePattern(mozilla::dom::HTMLImageElementOrSVGImageElementOrHTMLCanvasElementOrHTMLVideoElementOrImageBitmap const&, nsTSubstring<char16_t> const&, mozilla::ErrorResult&)|hg:hg.mozilla.org/mozilla-central:dom/canvas/CanvasRenderingContext2D.cpp:caf55914ccddba34d462a1206530d7868b6c4992|2168|0x1c
0|7|libxul.so|mozilla::dom::CanvasRenderingContext2D_Binding::createPattern|s3:gecko-generated-sources:26d2883906c71650a479569d8c5e8563ce2829976138a9116e8176d225c7fd262fa8f8e62bd5716a2a71d720c1523c40b43d8a640aa250e1b2a2b99b41406da2/dom/bindings/CanvasRenderingContext2DBinding.cpp:|3826|0x2a
0|8|libxul.so|bool mozilla::dom::binding_detail::GenericMethod<mozilla::dom::binding_detail::NormalThisPolicy, mozilla::dom::binding_detail::ThrowExceptions>(JSContext*, unsigned int, JS::Value*)|hg:hg.mozilla.org/mozilla-central:dom/bindings/BindingUtils.cpp:caf55914ccddba34d462a1206530d7868b6c4992|3218|0x24
0|9|libxul.so|CallJSNative(JSContext*, bool (*)(JSContext*, unsigned int, JS::Value*), js::CallReason, JS::CallArgs const&)|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:caf55914ccddba34d462a1206530d7868b6c4992|456|0x15
0|10|libxul.so|js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason)|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:caf55914ccddba34d462a1206530d7868b6c4992|548|0x15
0|11|libxul.so|InternalCall|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:caf55914ccddba34d462a1206530d7868b6c4992|617|0x10
0|12|libxul.so|Interpret|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:caf55914ccddba34d462a1206530d7868b6c4992|621|0x15
0|13|libxul.so|js::RunScript(JSContext*, js::RunState&)|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:caf55914ccddba34d462a1206530d7868b6c4992|423|0xb
0|14|libxul.so|js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason)|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:caf55914ccddba34d462a1206530d7868b6c4992|589|0x13
0|15|libxul.so|InternalCall|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:caf55914ccddba34d462a1206530d7868b6c4992|617|0x10
0|16|libxul.so|js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>, js::CallReason)|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:caf55914ccddba34d462a1206530d7868b6c4992|634|0x8
0|17|libxul.so|JS::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::HandleValueArray const&, JS::MutableHandle<JS::Value>)|hg:hg.mozilla.org/mozilla-central:js/src/jsapi.cpp:caf55914ccddba34d462a1206530d7868b6c4992|2718|0x1f
0|18|libxul.so|mozilla::dom::EventListener::HandleEvent(JSContext*, JS::Handle<JS::Value>, mozilla::dom::Event&, mozilla::ErrorResult&)|s3:gecko-generated-sources:9ca8646d8042e9b4b76d2e1b358b984be17743b71b832c0897d61bb500e0fecbe38fa54273dc522878c87fcb2c9bfd274a8190c7bc56fbbb58cb3ca68462e527/dom/bindings/EventListenerBinding.cpp:|52|0x5
0|19|libxul.so|mozilla::EventListenerManager::HandleEventSubType(mozilla::EventListenerManager::Listener*, mozilla::dom::Event*, mozilla::dom::EventTarget*)|s3:gecko-generated-sources:f3d9c01258576daaac3afc4fb3b283652e7f1168abb5287eff6775451ebd0ab6a0e4c8d88d3a67f7147042501bc091c6dfed25b4b8ccf4e4f420897b8d0ba906/dist/include/mozilla/dom/EventListenerBinding.h:|66|0x1c
0|20|libxul.so|mozilla::EventListenerManager::HandleEventInternal(nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event**, mozilla::dom::EventTarget*, nsEventStatus*, bool)|hg:hg.mozilla.org/mozilla-central:dom/events/EventListenerManager.cpp:caf55914ccddba34d462a1206530d7868b6c4992|1231|0x19
0|21|libxul.so|mozilla::EventTargetChainItem::HandleEvent(mozilla::EventChainPostVisitor&, mozilla::ELMCreationDetector&)|hg:hg.mozilla.org/mozilla-central:dom/events/EventDispatcher.cpp:caf55914ccddba34d462a1206530d7868b6c4992|351|0x6
0|22|libxul.so|mozilla::EventTargetChainItem::HandleEventTargetChain(nsTArray<mozilla::EventTargetChainItem>&, mozilla::EventChainPostVisitor&, mozilla::EventDispatchingCallback*, mozilla::ELMCreationDetector&)|hg:hg.mozilla.org/mozilla-central:dom/events/EventDispatcher.cpp:caf55914ccddba34d462a1206530d7868b6c4992|551|0x12
0|23|libxul.so|mozilla::EventDispatcher::Dispatch(nsISupports*, nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event*, nsEventStatus*, mozilla::EventDispatchingCallback*, nsTArray<mozilla::dom::EventTarget*>*)|hg:hg.mozilla.org/mozilla-central:dom/events/EventDispatcher.cpp:caf55914ccddba34d462a1206530d7868b6c4992|1050|0x1a
0|24|libxul.so|mozilla::EventDispatcher::DispatchDOMEvent(nsISupports*, mozilla::WidgetEvent*, mozilla::dom::Event*, nsPresContext*, nsEventStatus*)|hg:hg.mozilla.org/mozilla-central:dom/events/EventDispatcher.cpp:caf55914ccddba34d462a1206530d7868b6c4992|1150|0x19
0|25|libxul.so|nsINode::DispatchEvent(mozilla::dom::Event&, mozilla::dom::CallerType, mozilla::ErrorResult&)|hg:hg.mozilla.org/mozilla-central:dom/base/nsINode.cpp:caf55914ccddba34d462a1206530d7868b6c4992|1139|0x5
0|26|libxul.so|nsContentUtils::DispatchEvent(mozilla::dom::Document*, nsISupports*, nsTSubstring<char16_t> const&, mozilla::CanBubble, mozilla::Cancelable, mozilla::Composed, mozilla::Trusted, bool*, mozilla::ChromeOnlyDispatch)|hg:hg.mozilla.org/mozilla-central:dom/base/nsContentUtils.cpp:caf55914ccddba34d462a1206530d7868b6c4992|4013|0x30
0|27|libxul.so|nsContentUtils::DispatchTrustedEvent(mozilla::dom::Document*, nsISupports*, nsTSubstring<char16_t> const&, mozilla::CanBubble, mozilla::Cancelable, mozilla::Composed, bool*)|hg:hg.mozilla.org/mozilla-central:dom/base/nsContentUtils.cpp:caf55914ccddba34d462a1206530d7868b6c4992|3984|0x19
0|28|libxul.so|mozilla::dom::Document::DispatchContentLoadedEvents()|hg:hg.mozilla.org/mozilla-central:dom/base/Document.cpp:caf55914ccddba34d462a1206530d7868b6c4992|7009|0x40
0|29|libxul.so|mozilla::detail::RunnableMethodImpl<mozilla::dom::Document*, void (mozilla::dom::Document::*)(), true, (mozilla::RunnableKind)0>::Run()|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThreadUtils.h:caf55914ccddba34d462a1206530d7868b6c4992|1176|0x13
0|30|libxul.so|mozilla::SchedulerGroup::Runnable::Run()|hg:hg.mozilla.org/mozilla-central:xpcom/threads/SchedulerGroup.cpp:caf55914ccddba34d462a1206530d7868b6c4992|295|0x15
0|31|libxul.so|nsThread::ProcessNextEvent(bool, bool*)|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThread.cpp:caf55914ccddba34d462a1206530d7868b6c4992|1225|0x15
0|32|libxul.so|NS_ProcessNextEvent(nsIThread*, bool)|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThreadUtils.cpp:caf55914ccddba34d462a1206530d7868b6c4992|486|0x11
0|33|libxul.so|mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*)|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessagePump.cpp:caf55914ccddba34d462a1206530d7868b6c4992|88|0xa
0|34|libxul.so|MessageLoop::RunInternal()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:caf55914ccddba34d462a1206530d7868b6c4992|315|0x17
0|35|libxul.so|MessageLoop::Run()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:caf55914ccddba34d462a1206530d7868b6c4992|290|0x8
0|36|libxul.so|nsBaseAppShell::Run()|hg:hg.mozilla.org/mozilla-central:widget/nsBaseAppShell.cpp:caf55914ccddba34d462a1206530d7868b6c4992|137|0xd
0|37|libxul.so|XRE_RunAppShell()|hg:hg.mozilla.org/mozilla-central:toolkit/xre/nsEmbedFunctions.cpp:caf55914ccddba34d462a1206530d7868b6c4992|934|0x11
0|38|libxul.so|mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*)|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessagePump.cpp:caf55914ccddba34d462a1206530d7868b6c4992|238|0x5
0|39|libxul.so|MessageLoop::RunInternal()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:caf55914ccddba34d462a1206530d7868b6c4992|315|0x17
0|40|libxul.so|MessageLoop::Run()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:caf55914ccddba34d462a1206530d7868b6c4992|290|0x8
0|41|libxul.so|XRE_InitChildProcess(int, char**, XREChildData const*)|hg:hg.mozilla.org/mozilla-central:toolkit/xre/nsEmbedFunctions.cpp:caf55914ccddba34d462a1206530d7868b6c4992|769|0xc
0|42|firefox-bin|content_process_main(mozilla::Bootstrap*, int, char**)|hg:hg.mozilla.org/mozilla-central:ipc/contentproc/plugin-container.cpp:caf55914ccddba34d462a1206530d7868b6c4992|56|0x14
0|43|firefox-bin|main|hg:hg.mozilla.org/mozilla-central:browser/app/nsBrowserApp.cpp:caf55914ccddba34d462a1206530d7868b6c4992|272|0x12
0|44|libc-2.27.so||||0x21b97
0|45|firefox-bin|MOZ_ReportCrash|hg:hg.mozilla.org/mozilla-central:mfbt/Assertions.h:caf55914ccddba34d462a1206530d7868b6c4992|203|0x5
Flags: in-testsuite?
Priority: -- → P3

Looks like the html video element is handing us a surface that claims to be opaque, yet has alpha transparency inside it... Media probably should look at this.

You need to log in before you can comment on or make changes to this bug.