1677739 - HTMLVideoElement provides faulty frames to createImageBitmap on Android

Status: UNCONFIRMED

(Core :: Graphics: Canvas2D, defect)

Description

[Angus Sawyer]

Attachment: crash.txt

User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.198 Safari/537.36

Steps to reproduce:

Modified test
dom/media/test/test_background_video_tainted_by_createimagebitmap.html
to use imageBitmap produced by the createImageBitmap promise and paint to a bitmaprenderer context. (drawing to a 2dcanvas with the faulty imageBitmap silently fails)

(the test as it currently stands does not test the usability of the imageBitmap)

• test code fragment as modified -

  waitUntilPlaying(v)
  .then(() => createImageBitmap(v))
  .then(ImageBitmap => {
  let c = document.createElement("canvas");
  c.width = 100;
  c.height = 100;
  let ctx = c.getContext("bitmaprenderer");
  document.body.appendChild(c);
  ctx.transferFromImageBitmap(ImageBitmap); # <crash here
  ok(v.hasSuspendTaint(), "Video is tainted after drawing to canvas");
  return checkVideoDoesntSuspend(v);
  })

• end -

Actual results:

Browser crashed with the following (full dump also attached)

[task 2020-11-17T11:56:19.520Z] 11:56:19 WARNING - PROCESS-CRASH | dom/media/test/test_background_video_tainted_by_createimagebitmap.html | application crashed [@ RefPtr<mozilla::gfx::SourceSurface>::operator->() const]
[task 2020-11-17T11:56:19.521Z] 11:56:19 INFO - Mozilla crash reason: MOZ_ASSERT(mRawPtr != nullptr) (You can't dereference a NULL RefPtr with operator->().)

Expected results:

Video frame should have been painted to canvas.

Comment 1

[BugBot [:suhaib / :marco/ :calixte]]

Bugbug thinks this bug should belong to this component, but please revert this change in case of error.

Comment 2

[Angus Sawyer]

This fault is probably in the video code not canvas 2d. Canvas 2D just surfaces the problem.

Comment 3

[Sotaro Ikeda [:sotaro]]

It looks similar to Bug 1526207.