1671953 - Assertion failure: aDest.width >= 0 || ceil(aDest.width) <= (2147483647) || aDest.height >= 0 || ceil(aDest.height) <= (2147483647) (Unexpected destination size), at /builds/worker/checkouts/gecko/image/RasterImage.cpp:1833

Status: NEW

(Core :: Graphics: ImageLib, defect)

Description

[Jason Kratzer [:jkratzer]]

Attachment: testcase.zip

Testcase found while fuzzing mozilla-central rev cb4114308a0e (built with --enable-debug).

Assertion failure: aDest.width >= 0 || ceil(aDest.width) <= (2147483647) || aDest.height >= 0 || ceil(aDest.height) <= (2147483647) (Unexpected destination size), at /builds/worker/checkouts/gecko/image/RasterImage.cpp:1833

    #0 0x7fcad3275da9 in mozilla::image::RasterImage::OptimalImageSizeForDest(mozilla::gfx::SizeTyped<mozilla::gfx::UnknownUnits, double> const&, unsigned int, mozilla::gfx::SamplingFilter, unsigned int) /builds/worker/checkouts/gecko/image/RasterImage.cpp:1831:3
    #1 0x7fcad621a47e in ComputeSnappedImageDrawingParameters /builds/worker/checkouts/gecko/layout/base/nsLayoutUtils.cpp:6066:36
    #2 0x7fcad621a47e in DrawImageInternal(gfxContext&, nsPresContext*, imgIContainer*, mozilla::gfx::SamplingFilter, nsRect const&, nsRect const&, nsPoint const&, nsRect const&, mozilla::Maybe<mozilla::SVGImageContext> const&, unsigned int, mozilla::gfx::ExtendMode, float) /builds/worker/checkouts/gecko/layout/base/nsLayoutUtils.cpp:6225:42
    #3 0x7fcad621b7df in nsLayoutUtils::DrawSingleImage(gfxContext&, nsPresContext*, imgIContainer*, mozilla::gfx::SamplingFilter, nsRect const&, nsRect const&, mozilla::Maybe<mozilla::SVGImageContext> const&, unsigned int, nsPoint const*, nsRect const*) /builds/worker/checkouts/gecko/layout/base/nsLayoutUtils.cpp:6329:10
    #4 0x7fcad63578bb in nsImageFrame::PaintImage(gfxContext&, nsPoint, nsRect const&, imgIContainer*, unsigned int) /builds/worker/checkouts/gecko/layout/generic/nsImageFrame.cpp:2081:26
    #5 0x7fcad63570d3 in nsDisplayImage::Paint(nsDisplayListBuilder*, gfxContext*) /builds/worker/checkouts/gecko/layout/generic/nsImageFrame.cpp:1822:33
    #6 0x7fcad6572707 in mozilla::FrameLayerBuilder::PaintItems(std::vector<mozilla::AssignedDisplayItem, std::allocator<mozilla::AssignedDisplayItem> >&, mozilla::gfx::IntRectTyped<mozilla::gfx::UnknownUnits> const&, gfxContext*, nsDisplayListBuilder*, nsPresContext*, mozilla::gfx::IntPointTyped<mozilla::gfx::UnknownUnits> const&, float, float) /builds/worker/checkouts/gecko/layout/painting/FrameLayerBuilder.cpp:7098:20
    #7 0x7fcad6574181 in mozilla::FrameLayerBuilder::DrawPaintedLayer(mozilla::layers::PaintedLayer*, gfxContext*, mozilla::gfx::IntRegionTyped<mozilla::gfx::UnknownUnits> const&, mozilla::gfx::IntRegionTyped<mozilla::gfx::UnknownUnits> const&, mozilla::layers::DrawRegionClip, mozilla::gfx::IntRegionTyped<mozilla::gfx::UnknownUnits> const&, void*) /builds/worker/checkouts/gecko/layout/painting/FrameLayerBuilder.cpp:7256:19
    #8 0x7fcad300de17 in mozilla::layers::ClientPaintedLayer::RenderLayerWithReadback(mozilla::layers::ReadbackProcessor*) /builds/worker/checkouts/gecko/gfx/layers/client/ClientPaintedLayer.cpp
    #9 0x7fcad302dbd0 in mozilla::layers::ClientContainerLayer::RenderLayer() /builds/worker/checkouts/gecko/gfx/layers/client/ClientContainerLayer.h:53:29
    #10 0x7fcad302dbd0 in mozilla::layers::ClientContainerLayer::RenderLayer() /builds/worker/checkouts/gecko/gfx/layers/client/ClientContainerLayer.h:53:29
    #11 0x7fcad30095d0 in mozilla::layers::ClientLayerManager::EndTransactionInternal(void (*)(mozilla::layers::PaintedLayer*, gfxContext*, mozilla::gfx::IntRegionTyped<mozilla::gfx::UnknownUnits> const&, mozilla::gfx::IntRegionTyped<mozilla::gfx::UnknownUnits> const&, mozilla::layers::DrawRegionClip, mozilla::gfx::IntRegionTyped<mozilla::gfx::UnknownUnits> const&, void*), void*, mozilla::layers::LayerManager::EndTransactionFlags) /builds/worker/checkouts/gecko/gfx/layers/client/ClientLayerManager.cpp:343:13
    #12 0x7fcad3009cee in mozilla::layers::ClientLayerManager::EndTransaction(void (*)(mozilla::layers::PaintedLayer*, gfxContext*, mozilla::gfx::IntRegionTyped<mozilla::gfx::UnknownUnits> const&, mozilla::gfx::IntRegionTyped<mozilla::gfx::UnknownUnits> const&, mozilla::layers::DrawRegionClip, mozilla::gfx::IntRegionTyped<mozilla::gfx::UnknownUnits> const&, void*), void*, mozilla::layers::LayerManager::EndTransactionFlags) /builds/worker/checkouts/gecko/gfx/layers/client/ClientLayerManager.cpp:406:3
    #13 0x7fcad65a543d in nsDisplayList::PaintRoot(nsDisplayListBuilder*, gfxContext*, unsigned int) /builds/worker/checkouts/gecko/layout/painting/nsDisplayList.cpp:2556:19
    #14 0x7fcad62101b5 in nsLayoutUtils::PaintFrame(gfxContext*, nsIFrame*, nsRegion const&, unsigned int, nsDisplayListBuilderMode, nsLayoutUtils::PaintFrameFlags) /builds/worker/checkouts/gecko/layout/base/nsLayoutUtils.cpp:3465:13
    #15 0x7fcad618d8cc in mozilla::PresShell::Paint(nsView*, nsRegion const&, mozilla::PaintFlags) /builds/worker/checkouts/gecko/layout/base/PresShell.cpp:6361:5
    #16 0x7fcad5e5fe7f in nsViewManager::ProcessPendingUpdatesPaint(nsIWidget*) /builds/worker/checkouts/gecko/view/nsViewManager.cpp:460:18
    #17 0x7fcad5e5f973 in nsViewManager::ProcessPendingUpdatesForView(nsView*, bool) /builds/worker/checkouts/gecko/view/nsViewManager.cpp:395:22
    #18 0x7fcad5e612df in nsViewManager::ProcessPendingUpdates() /builds/worker/checkouts/gecko/view/nsViewManager.cpp:1018:5
    #19 0x7fcad614d671 in nsRefreshDriver::Tick(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:2369:11
    #20 0x7fcad6154a21 in TickDriver /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:374:13
    #21 0x7fcad6154a21 in mozilla::RefreshDriverTimer::TickRefreshDrivers(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp, nsTArray<RefPtr<nsRefreshDriver> >&) /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:353:7
    #22 0x7fcad615490c in mozilla::RefreshDriverTimer::Tick(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:368:5
    #23 0x7fcad6153eb8 in RunRefreshDrivers /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:829:5
    #24 0x7fcad6153eb8 in mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::TickRefreshDriver(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:747:16
    #25 0x7fcad6153ada in mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::NormalPriorityNotify() /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:663:9
    #26 0x7fcad61542f6 in applyImpl<mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver, void (mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::*)()> /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1188:12
    #27 0x7fcad61542f6 in apply<mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver, void (mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::*)()> /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1194:12
    #28 0x7fcad61542f6 in mozilla::detail::RunnableMethodImpl<mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver*, void (mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::*)(), true, (mozilla::RunnableKind)0>::Run() /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1240:13
    #29 0x7fcad194e7ef in mozilla::RunnableTask::Run() /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:245:16
    #30 0x7fcad194ce6a in mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:515:26
    #31 0x7fcad194bf14 in mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:374:15
    #32 0x7fcad194c0c7 in mozilla::TaskController::ProcessPendingMTTask(bool) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:171:36
    #33 0x7fcad1951d16 in operator() /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:85:37
    #34 0x7fcad1951d16 in mozilla::detail::RunnableFunction<mozilla::TaskController::InitializeInternal()::$_3>::Run() /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:577:5
    #35 0x7fcad1962f67 in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/checkouts/gecko/xpcom/threads/nsThread.cpp:1197:14
    #36 0x7fcad1968b0a in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.cpp:513:10
    #37 0x7fcad2258aa6 in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) /builds/worker/checkouts/gecko/ipc/glue/MessagePump.cpp:87:21
    #38 0x7fcad21cb233 in MessageLoop::RunInternal() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:334:10
    #39 0x7fcad21cb14d in RunHandler /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:327:3
    #40 0x7fcad21cb14d in MessageLoop::Run() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:309:3
    #41 0x7fcad5ea5df8 in nsBaseAppShell::Run() /builds/worker/checkouts/gecko/widget/nsBaseAppShell.cpp:137:27
    #42 0x7fcad769edd3 in XRE_RunAppShell() /builds/worker/checkouts/gecko/toolkit/xre/nsEmbedFunctions.cpp:913:20
    #43 0x7fcad2259869 in mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*) /builds/worker/checkouts/gecko/ipc/glue/MessagePump.cpp:237:9
    #44 0x7fcad21cb233 in MessageLoop::RunInternal() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:334:10
    #45 0x7fcad21cb14d in RunHandler /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:327:3
    #46 0x7fcad21cb14d in MessageLoop::Run() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:309:3
    #47 0x7fcad769e9b8 in XRE_InitChildProcess(int, char**, XREChildData const*) /builds/worker/checkouts/gecko/toolkit/xre/nsEmbedFunctions.cpp:744:34
    #48 0x55d7a81ab657 in content_process_main /builds/worker/checkouts/gecko/browser/app/../../ipc/contentproc/plugin-container.cpp:56:28
    #49 0x55d7a81ab657 in main /builds/worker/checkouts/gecko/browser/app/nsBrowserApp.cpp:304:18
    #50 0x7fcae62620b2 in __libc_start_main /build/glibc-ZN95T4/glibc-2.31/csu/../csu/libc-start.c:308:16

Comment 1

[Jason Kratzer [:jkratzer]]

Bugmon Analysis:
Verified bug as reproducible on mozilla-central 20201018211631-cb4114308a0e.
Failed to bisect testcase (Start build crashes!):

Start: e8b7c48d4e7ed1b63aeedff379b51e566ea499d9 (20191107015224)
End: 195dfba58e2215d8f57f414d1b306e5240cb1b75 (20201018094558)
BuildFlags: BuildFlags(asan=False, tsan=False, debug=True, fuzzing=False, coverage=False, valgrind=False)

Comment 2

[Bugmon [:jkratzer for issues]]

Bugmon Analysis
Unable to reproduce bug 1671953 using build mozilla-central 20201018211631-cb4114308a0e. Without a baseline, bugmon is unable to analyze this bug.
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.

Comment 3

[Jason Kratzer [:jkratzer]]

(In reply to Bugmon [:jkratzer for issues] from comment #2)

Bugmon Analysis
Unable to reproduce bug 1671953 using build mozilla-central 20201018211631-cb4114308a0e. Without a baseline, bugmon is unable to analyze this bug.
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.

Bugmon is confused here. I can still reproduce this issue using the latest build from mozilla-central (72ef88010a59). I'll leave the bugmon keyword off.