Assertion failure: aImage->GetType() == imgIContainer::TYPE_VECTOR, at /builds/worker/checkouts/gecko/image/ClippedImage.cpp:127
Categories
(Core :: Graphics: ImageLib, defect)
Tracking
()
Tracking | Status | |
---|---|---|
firefox84 | --- | affected |
People
(Reporter: jkratzer, Unassigned)
References
(Blocks 1 open bug)
Details
(Keywords: assertion, testcase, Whiteboard: [bugmon:bisected,confirmed])
Attachments
(1 file)
170 bytes,
text/html
|
Details |
Testcase found while fuzzing mozilla-central rev cb4114308a0e (built with --enable-debug).
Assertion failure: aImage->GetType() == imgIContainer::TYPE_VECTOR, at /builds/worker/checkouts/gecko/image/ClippedImage.cpp:127
#0 0x7f28d3a2a9c2 in mozilla::image::ClippedImage::ClippedImage(mozilla::image::Image*, mozilla::gfx::IntRectTyped<mozilla::gfx::UnknownUnits>, mozilla::Maybe<nsSize> const&) /builds/worker/checkouts/gecko/image/ClippedImage.cpp:126:3
#1 0x7f28d3a4da36 in mozilla::image::ImageOps::Clip(imgIContainer*, mozilla::gfx::IntRectTyped<mozilla::gfx::UnknownUnits>, mozilla::Maybe<nsSize> const&) /builds/worker/checkouts/gecko/image/ImageOps.cpp:55:11
#2 0x7f28d6ddde61 in mozilla::nsImageRenderer::DrawBorderImageComponent(nsPresContext*, gfxContext&, nsRect const&, nsRect const&, mozilla::gfx::IntRectTyped<mozilla::CSSPixel> const&, mozilla::StyleBorderImageRepeat, mozilla::StyleBorderImageRepeat, nsSize const&, unsigned char, mozilla::Maybe<nsSize> const&, bool) /builds/worker/checkouts/gecko/layout/painting/nsImageRenderer.cpp:939:18
#3 0x7f28d6d71067 in nsCSSBorderImageRenderer::DrawBorderImage(nsPresContext*, gfxContext&, nsIFrame*, nsRect const&) /builds/worker/checkouts/gecko/layout/painting/nsCSSRenderingBorders.cpp:3559:32
#4 0x7f28d6d6ecd1 in nsCSSRendering::PaintBorderWithStyleBorder(nsPresContext*, gfxContext&, nsIFrame*, nsRect const&, nsRect const&, nsStyleBorder const&, mozilla::ComputedStyle*, mozilla::PaintBorderFlags, mozilla::Sides) /builds/worker/checkouts/gecko/layout/painting/nsCSSRendering.cpp:863:24
#5 0x7f28d6d6e994 in nsCSSRendering::PaintBorder(nsPresContext*, gfxContext&, nsIFrame*, nsRect const&, nsRect const&, mozilla::ComputedStyle*, mozilla::PaintBorderFlags, mozilla::Sides) /builds/worker/checkouts/gecko/layout/painting/nsCSSRendering.cpp:648:10
#6 0x7f28d6da71cb in nsDisplayBorder::Paint(nsDisplayListBuilder*, gfxContext*) /builds/worker/checkouts/gecko/layout/painting/nsDisplayList.cpp:5056:26
#7 0x7f28d6d66707 in mozilla::FrameLayerBuilder::PaintItems(std::vector<mozilla::AssignedDisplayItem, std::allocator<mozilla::AssignedDisplayItem> >&, mozilla::gfx::IntRectTyped<mozilla::gfx::UnknownUnits> const&, gfxContext*, nsDisplayListBuilder*, nsPresContext*, mozilla::gfx::IntPointTyped<mozilla::gfx::UnknownUnits> const&, float, float) /builds/worker/checkouts/gecko/layout/painting/FrameLayerBuilder.cpp:7098:20
#8 0x7f28d6d68181 in mozilla::FrameLayerBuilder::DrawPaintedLayer(mozilla::layers::PaintedLayer*, gfxContext*, mozilla::gfx::IntRegionTyped<mozilla::gfx::UnknownUnits> const&, mozilla::gfx::IntRegionTyped<mozilla::gfx::UnknownUnits> const&, mozilla::layers::DrawRegionClip, mozilla::gfx::IntRegionTyped<mozilla::gfx::UnknownUnits> const&, void*) /builds/worker/checkouts/gecko/layout/painting/FrameLayerBuilder.cpp:7256:19
#9 0x7f28d3801e17 in mozilla::layers::ClientPaintedLayer::RenderLayerWithReadback(mozilla::layers::ReadbackProcessor*) /builds/worker/checkouts/gecko/gfx/layers/client/ClientPaintedLayer.cpp
#10 0x7f28d3821bd0 in mozilla::layers::ClientContainerLayer::RenderLayer() /builds/worker/checkouts/gecko/gfx/layers/client/ClientContainerLayer.h:53:29
#11 0x7f28d3821bd0 in mozilla::layers::ClientContainerLayer::RenderLayer() /builds/worker/checkouts/gecko/gfx/layers/client/ClientContainerLayer.h:53:29
#12 0x7f28d37fd5d0 in mozilla::layers::ClientLayerManager::EndTransactionInternal(void (*)(mozilla::layers::PaintedLayer*, gfxContext*, mozilla::gfx::IntRegionTyped<mozilla::gfx::UnknownUnits> const&, mozilla::gfx::IntRegionTyped<mozilla::gfx::UnknownUnits> const&, mozilla::layers::DrawRegionClip, mozilla::gfx::IntRegionTyped<mozilla::gfx::UnknownUnits> const&, void*), void*, mozilla::layers::LayerManager::EndTransactionFlags) /builds/worker/checkouts/gecko/gfx/layers/client/ClientLayerManager.cpp:343:13
#13 0x7f28d37fdcee in mozilla::layers::ClientLayerManager::EndTransaction(void (*)(mozilla::layers::PaintedLayer*, gfxContext*, mozilla::gfx::IntRegionTyped<mozilla::gfx::UnknownUnits> const&, mozilla::gfx::IntRegionTyped<mozilla::gfx::UnknownUnits> const&, mozilla::layers::DrawRegionClip, mozilla::gfx::IntRegionTyped<mozilla::gfx::UnknownUnits> const&, void*), void*, mozilla::layers::LayerManager::EndTransactionFlags) /builds/worker/checkouts/gecko/gfx/layers/client/ClientLayerManager.cpp:406:3
#14 0x7f28d6d9943d in nsDisplayList::PaintRoot(nsDisplayListBuilder*, gfxContext*, unsigned int) /builds/worker/checkouts/gecko/layout/painting/nsDisplayList.cpp:2556:19
#15 0x7f28d6a041b5 in nsLayoutUtils::PaintFrame(gfxContext*, nsIFrame*, nsRegion const&, unsigned int, nsDisplayListBuilderMode, nsLayoutUtils::PaintFrameFlags) /builds/worker/checkouts/gecko/layout/base/nsLayoutUtils.cpp:3465:13
#16 0x7f28d69818cc in mozilla::PresShell::Paint(nsView*, nsRegion const&, mozilla::PaintFlags) /builds/worker/checkouts/gecko/layout/base/PresShell.cpp:6361:5
#17 0x7f28d6653e7f in nsViewManager::ProcessPendingUpdatesPaint(nsIWidget*) /builds/worker/checkouts/gecko/view/nsViewManager.cpp:460:18
#18 0x7f28d6653973 in nsViewManager::ProcessPendingUpdatesForView(nsView*, bool) /builds/worker/checkouts/gecko/view/nsViewManager.cpp:395:22
#19 0x7f28d66552df in nsViewManager::ProcessPendingUpdates() /builds/worker/checkouts/gecko/view/nsViewManager.cpp:1018:5
#20 0x7f28d6941671 in nsRefreshDriver::Tick(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:2369:11
#21 0x7f28d6948a21 in TickDriver /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:374:13
#22 0x7f28d6948a21 in mozilla::RefreshDriverTimer::TickRefreshDrivers(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp, nsTArray<RefPtr<nsRefreshDriver> >&) /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:353:7
#23 0x7f28d694890c in mozilla::RefreshDriverTimer::Tick(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:368:5
#24 0x7f28d6947eb8 in RunRefreshDrivers /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:829:5
#25 0x7f28d6947eb8 in mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::TickRefreshDriver(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:747:16
#26 0x7f28d69477c0 in mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::NotifyParentProcessVsync() /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:649:7
#27 0x7f28d6947239 in mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::NotifyVsync(mozilla::VsyncEvent const&) /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:570:9
#28 0x7f28d6d061a7 in mozilla::layout::VsyncChild::RecvNotify(mozilla::VsyncEvent const&) /builds/worker/checkouts/gecko/layout/ipc/VsyncChild.cpp:55:16
#29 0x7f28d2fd7735 in mozilla::layout::PVsyncChild::OnMessageReceived(IPC::Message const&) /builds/worker/workspace/obj-build/ipc/ipdl/PVsyncChild.cpp:187:54
#30 0x7f28d2d89dad in mozilla::ipc::PBackgroundChild::OnMessageReceived(IPC::Message const&) /builds/worker/workspace/obj-build/ipc/ipdl/PBackgroundChild.cpp:6231:32
#31 0x7f28d2a471be in mozilla::ipc::MessageChannel::DispatchAsyncMessage(mozilla::ipc::ActorLifecycleProxy*, IPC::Message const&) /builds/worker/checkouts/gecko/ipc/glue/MessageChannel.cpp:2150:25
#32 0x7f28d2a4397f in mozilla::ipc::MessageChannel::DispatchMessage(IPC::Message&&) /builds/worker/checkouts/gecko/ipc/glue/MessageChannel.cpp:2074:9
#33 0x7f28d2a44d86 in mozilla::ipc::MessageChannel::RunMessage(mozilla::ipc::MessageChannel::MessageTask&) /builds/worker/checkouts/gecko/ipc/glue/MessageChannel.cpp:1922:3
#34 0x7f28d2a459ab in mozilla::ipc::MessageChannel::MessageTask::Run() /builds/worker/checkouts/gecko/ipc/glue/MessageChannel.cpp:1953:13
#35 0x7f28d21427ef in mozilla::RunnableTask::Run() /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:245:16
#36 0x7f28d2140e6a in mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:515:26
#37 0x7f28d213ff14 in mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:374:15
#38 0x7f28d21400c7 in mozilla::TaskController::ProcessPendingMTTask(bool) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:171:36
#39 0x7f28d2145d16 in operator() /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:85:37
#40 0x7f28d2145d16 in mozilla::detail::RunnableFunction<mozilla::TaskController::InitializeInternal()::$_3>::Run() /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:577:5
#41 0x7f28d2156f67 in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/checkouts/gecko/xpcom/threads/nsThread.cpp:1197:14
#42 0x7f28d215cb0a in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.cpp:513:10
#43 0x7f28d2a4caa6 in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) /builds/worker/checkouts/gecko/ipc/glue/MessagePump.cpp:87:21
#44 0x7f28d29bf233 in MessageLoop::RunInternal() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:334:10
#45 0x7f28d29bf14d in RunHandler /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:327:3
#46 0x7f28d29bf14d in MessageLoop::Run() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:309:3
#47 0x7f28d6699df8 in nsBaseAppShell::Run() /builds/worker/checkouts/gecko/widget/nsBaseAppShell.cpp:137:27
#48 0x7f28d7e92dd3 in XRE_RunAppShell() /builds/worker/checkouts/gecko/toolkit/xre/nsEmbedFunctions.cpp:913:20
#49 0x7f28d2a4d869 in mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*) /builds/worker/checkouts/gecko/ipc/glue/MessagePump.cpp:237:9
#50 0x7f28d29bf233 in MessageLoop::RunInternal() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:334:10
#51 0x7f28d29bf14d in RunHandler /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:327:3
#52 0x7f28d29bf14d in MessageLoop::Run() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:309:3
#53 0x7f28d7e929b8 in XRE_InitChildProcess(int, char**, XREChildData const*) /builds/worker/checkouts/gecko/toolkit/xre/nsEmbedFunctions.cpp:744:34
#54 0x561a993fc657 in content_process_main /builds/worker/checkouts/gecko/browser/app/../../ipc/contentproc/plugin-container.cpp:56:28
#55 0x561a993fc657 in main /builds/worker/checkouts/gecko/browser/app/nsBrowserApp.cpp:304:18
#56 0x7f28e7e1e0b2 in __libc_start_main /build/glibc-ZN95T4/glibc-2.31/csu/../csu/libc-start.c:308:16
Reporter | ||
Comment 1•4 years ago
|
||
Bugmon Analysis:
Verified bug as reproducible on mozilla-central 20201018211631-cb4114308a0e.
Failed to bisect testcase (Start build crashes!):
Start: e8b7c48d4e7ed1b63aeedff379b51e566ea499d9 (20191107015224)
End: 195dfba58e2215d8f57f414d1b306e5240cb1b75 (20201018094558)
BuildFlags: BuildFlags(asan=False, tsan=False, debug=True, fuzzing=False, coverage=False, valgrind=False)
Updated•2 years ago
|
Comment 2•11 months ago
|
||
Bugmon was unable reproduce this issue.
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.
Reporter | ||
Comment 3•11 months ago
|
||
A change to the Taskcluster build definitions over the weekend caused Bugmon to fail when reproducing issues. This issue has been corrected. Re-enabling bugmon.
Comment 4•9 months ago
|
||
Unable to reproduce bug 1671955 using build mozilla-central 20220730092553-656a6bc2f82d. Without a baseline, bugmon is unable to analyze this bug.
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.
Description
•