1603880 - crash near null [@ CreateDirect3D11SurfaceFromDXGISurface]

Status: NEW

(Core :: Graphics: CanvasWebGL, defect, P3)

Description

[Tyson Smith [:tsmith] (PTO)]

Attachment: testcase.html

Reproduced with m-c 20191211-7635669b8d72

==1228==ERROR: AddressSanitizer: access-violation on unknown address 0x0000000000d1 (pc 0x7ffa0169e5e0 bp 0x00ce479f7040 sp 0x00ce479f6ed0 T0)
==1228==The signal is caused by a READ memory access.
==1228==Hint: address points to the zero page.
    #0 0x7ffa0169e5df in CreateDirect3D11SurfaceFromDXGISurface+0xc61f (C:\Windows\SYSTEM32\d3d11.dll+0x18011e5df)
    #1 0x7ff9d0bb15c1 in rx::Renderer11::mapResource \src\gfx\angle\checkout\src\libANGLE\renderer\d3d\d3d11\Renderer11.cpp:3922
    #2 0x7ff9d0b31f80 in rx::Buffer11::NativeStorage::map \src\gfx\angle\checkout\src\libANGLE\renderer\d3d\d3d11\Buffer11.cpp:1249
    #3 0x7ff9d0b3394a in rx::Buffer11::SystemMemoryStorage::copyFromStorage \src\gfx\angle\checkout\src\libANGLE\renderer\d3d\d3d11\Buffer11.cpp:1640
    #4 0x7ff9d0b2fd2c in rx::Buffer11::updateBufferStorage \src\gfx\angle\checkout\src\libANGLE\renderer\d3d\d3d11\Buffer11.cpp:910
    #5 0x7ff9d0b267e7 in rx::Buffer11::setSubData \src\gfx\angle\checkout\src\libANGLE\renderer\d3d\d3d11\Buffer11.cpp:409
    #6 0x7ff9d0b2581e in rx::Buffer11::setData \src\gfx\angle\checkout\src\libANGLE\renderer\d3d\d3d11\Buffer11.cpp:350
    #7 0x7ff9d073efec in gl::Buffer::bufferData \src\gfx\angle\checkout\src\libANGLE\Buffer.cpp:90
    #8 0x7ff9d07b61bc in gl::Context::bufferData \src\gfx\angle\checkout\src\libANGLE\Context.cpp:5158
    #9 0x7ff9d0e6ce2b in gl::BufferData \src\gfx\angle\checkout\src\libGLESv2\entry_points_gles_2_0_autogen.cpp:229
    #10 0x7ff9a640b7b1 in mozilla::gl::GLContext::fBufferData \src\gfx\gl\GLContext.h:865
    #11 0x7ff9aa274f2d in mozilla::WebGLBuffer::BufferData \src\dom\canvas\WebGLBuffer.cpp:124
    #12 0x7ff9aa2a3e70 in mozilla::WebGLContext::BufferData \src\dom\canvas\WebGLContextBuffers.cpp:280
    #13 0x7ff9a93b0780 in mozilla::dom::WebGLRenderingContext_Binding::bufferData \src\obj-firefox\dom\bindings\WebGLRenderingContextBinding.cpp:13299
    #14 0x7ff9aa0e3dc2 in mozilla::dom::binding_detail::GenericMethod<mozilla::dom::binding_detail::NormalThisPolicy,mozilla::dom::binding_detail::ThrowExceptions> \src\dom\bindings\BindingUtils.cpp:3151
    #15 0x7ff9b153f18e in js::InternalCallOrConstruct \src\js\src\vm\Interpreter.cpp:549
    #16 0x7ff9b15423ca in InternalCall \src\js\src\vm\Interpreter.cpp:618
    #17 0x7ff9b15235d2 in Interpret \src\js\src\vm\Interpreter.cpp:3116
    #18 0x7ff9b1505e9a in js::RunScript \src\js\src\vm\Interpreter.cpp:424
    #19 0x7ff9b153faa5 in js::InternalCallOrConstruct \src\js\src\vm\Interpreter.cpp:590
    #20 0x7ff9b15423ca in InternalCall \src\js\src\vm\Interpreter.cpp:618
    #21 0x7ff9b1542602 in js::Call \src\js\src\vm\Interpreter.cpp:635
    #22 0x7ff9b1720012 in JS::Call \src\js\src\jsapi.cpp:2752
    #23 0x7ff9a988e59c in mozilla::dom::EventHandlerNonNull::Call \src\obj-firefox\dom\bindings\EventHandlerBinding.cpp:267
    #24 0x7ff9aaa3c603 in mozilla::JSEventHandler::HandleEvent \src\dom\events\JSEventHandler.cpp:201
    #25 0x7ff9aa9eb222 in mozilla::EventListenerManager::HandleEventSubType \src\dom\events\EventListenerManager.cpp:1074
    #26 0x7ff9aa9ed1e0 in mozilla::EventListenerManager::HandleEventInternal \src\dom\events\EventListenerManager.cpp:1266
    #27 0x7ff9aa9cec91 in mozilla::EventTargetChainItem::HandleEvent \src\dom\events\EventDispatcher.cpp:356
    #28 0x7ff9aa9ccc52 in mozilla::EventTargetChainItem::HandleEventTargetChain \src\dom\events\EventDispatcher.cpp:558
    #29 0x7ff9aa9d34a1 in mozilla::EventDispatcher::Dispatch \src\dom\events\EventDispatcher.cpp:1056
    #30 0x7ff9aa9dcbdd in mozilla::EventDispatcher::DispatchDOMEvent \src\dom\events\EventDispatcher.cpp
    #31 0x7ff9a7a0d80e in nsINode::DispatchEvent \src\dom\base\nsINode.cpp:1119
    #32 0x7ff9aa9fc000 in mozilla::dom::EventTarget::DispatchEvent \src\dom\events\EventTarget.cpp:178
    #33 0x7ff9aa94a372 in mozilla::AsyncEventDispatcher::Run \src\dom\events\AsyncEventDispatcher.cpp:69
    #34 0x7ff9a357b2d5 in mozilla::SchedulerGroup::Runnable::Run \src\xpcom\threads\SchedulerGroup.cpp:295
    #35 0x7ff9a35a7217 in nsThread::ProcessNextEvent \src\xpcom\threads\nsThread.cpp:1256
    #36 0x7ff9a35b1178 in NS_ProcessNextEvent \src\xpcom\threads\nsThreadUtils.cpp:486
    #37 0x7ff9a483783f in mozilla::ipc::MessagePump::Run \src\ipc\glue\MessagePump.cpp:87
    #38 0x7ff9a477918e in MessageLoop::RunHandler \src\ipc\chromium\src\base\message_loop.cc:308
    #39 0x7ff9a4778f25 in MessageLoop::Run \src\ipc\chromium\src\base\message_loop.cc:290
    #40 0x7ff9acec5aea in nsBaseAppShell::Run \src\widget\nsBaseAppShell.cpp:137
    #41 0x7ff9ad0621c8 in nsAppShell::Run \src\widget\windows\nsAppShell.cpp:406
    #42 0x7ff9b12249f8 in XRE_RunAppShell \src\toolkit\xre\nsEmbedFunctions.cpp:946
    #43 0x7ff9a477918e in MessageLoop::RunHandler \src\ipc\chromium\src\base\message_loop.cc:308
    #44 0x7ff9a4778f25 in MessageLoop::Run \src\ipc\chromium\src\base\message_loop.cc:290
    #45 0x7ff9b1223ac6 in XRE_InitChildProcess \src\toolkit\xre\nsEmbedFunctions.cpp:781
    #46 0x7ff690f12142 in NS_internal_main \src\browser\app\nsBrowserApp.cpp:303
    #47 0x7ff690f11501 in wmain \src\toolkit\xre\nsWindowsWMain.cpp:131