1597503 - /builds/worker/workspace/build/src/gfx/skia/skia/include/core/SkPaint.h:603: fatal error: "assert(orig.isSorted())"

Status: NEW

(Core :: Graphics, defect, P3)

Description

[Jason Kratzer [:jkratzer]]

Attachment: testcase.html

Testcase found while fuzzing mozilla-central rev caf55914ccdd.

/builds/worker/workspace/build/src/gfx/skia/skia/src/core/SkCanvas.cpp:2182: fatal error: "assert(r.isSorted())"
/builds/worker/workspace/build/src/gfx/skia/skia/include/core/SkPaint.h:603: fatal error: "assert(orig.isSorted())"

rax = 0x00007f66b04b3760   rdx = 0x00007f669717c2e8
rcx = 0x00007f669717c2e8   rbx = 0x00007f66b04b8680
rsi = 0x00007f66a47c9642   rdi = 0x00007f6697179c08
rbp = 0x00007f669717c2b8   rsp = 0x00007f6697179bd8
r8 = 0x00007f66b04b98b0    r9 = 0x00007f66a47c9642
r10 = 0x0000000000000001   r11 = 0x0000000000000000
r12 = 0x00000000ffffffff   r13 = 0x00007f6695ea9000
r14 = 0x00007f66b04b8680   r15 = 0x00000000fbad2887
rip = 0x00007f66b012a66e
OS|Linux|0.0.0 Linux 5.0.0-35-generic #38~18.04.1-Ubuntu SMP Mon Nov 11 09:16:10 UTC 2019 x86_64
CPU|amd64|family 6 model 94 stepping 3|1
GPU|||
Crash|SIGSEGV|0x0|14
14|0|libc-2.27.so||||0x5e66e
14|1|libc-2.27.so||||0x132768
14|2|libxul.so|SkDebugf(char const*, ...)|hg:hg.mozilla.org/mozilla-central:gfx/skia/skia/src/ports/SkDebug_stdio.cpp:caf55914ccddba34d462a1206530d7868b6c4992|17|0xf
14|3|||||0x7f66afe68470