1677854 - macOS arm64 Assertion failure: endX <= bitmapBounds.size.width

Status: RESOLVED FIXED

(Core :: Graphics, defect, P2)

Description

[Haik Aftandilian [:haik]]

On a debug arm64 native local build on the DTK, I'm running into the following assertion failure. It reproduces sporadically.

I first hit the problem on https://edition.cnn.com/videos when quitting the browser. After that, I hit the problem on every startup.

On changeset 8b19c30190d5 with some unrelated changes.

8b19c30190d5
Tue Nov 17 16:40:05 2020 +0200
Mihai Alexandru Michis <[e-mail]>
Backed out changeset dbcc7614b8f0 (bug 1640960) for causing rendering issues on Linux (Bug 1677728) a=backout

Assertion failure: endX <= bitmapBounds.size.width, at /Users/haftandilian/r/mc/gfx/2d/CGTextDrawing.h:86
#01: mozilla::gfx::EnsureValidPremultipliedData(CGContext*, CGRect) (.cold.1)[/Users/haftandilian/r/mc/obj-db.noindex/toolkit/library/build/XUL +0x83e97d8]
#02: mozilla::gfx::EnsureValidPremultipliedData(CGContext*, CGRect)[/Users/haftandilian/r/mc/obj-db.noindex/toolkit/library/build/XUL +0x12553d8]
#03: mozilla::gfx::DrawTargetSkia::FillGlyphsWithCG(mozilla::gfx::ScaledFont*, mozilla::gfx::GlyphBuffer const&, mozilla::gfx::Pattern const&, mozilla::gfx::DrawOptions const&)[/Users/haftandilian/r/mc/obj-db.noindex/toolkit/library/build/XUL +0x1254ca0]
#04: mozilla::gfx::DrawTargetSkia::DrawGlyphs(mozilla::gfx::ScaledFont*, mozilla::gfx::GlyphBuffer const&, mozilla::gfx::Pattern const&, mozilla::gfx::StrokeOptions const*, mozilla::gfx::DrawOptions const&)[/Users/haftandilian/r/mc/obj-db.noindex/toolkit/library/build/XUL +0x1255490]
#05: mozilla::gfx::DrawTargetSkia::FillGlyphs(mozilla::gfx::ScaledFont*, mozilla::gfx::GlyphBuffer const&, mozilla::gfx::Pattern const&, mozilla::gfx::DrawOptions const&)[/Users/haftandilian/r/mc/obj-db.noindex/toolkit/library/build/XUL +0x12558ec]
#06: GlyphBufferAzure::FlushGlyphs()[/Users/haftandilian/r/mc/obj-db.noindex/toolkit/library/build/XUL +0x16abf58]
#07: GlyphBufferAzure::~GlyphBufferAzure()[/Users/haftandilian/r/mc/obj-db.noindex/toolkit/library/build/XUL +0x16abbc0]
#08: GlyphBufferAzure::~GlyphBufferAzure()[/Users/haftandilian/r/mc/obj-db.noindex/toolkit/library/build/XUL +0x1694740]
#09: gfxFont::Draw(gfxTextRun const*, unsigned int, unsigned int, mozilla::gfx::PointTyped<mozilla::gfx::UnknownUnits, float>*, TextRunDrawParams const&, mozilla::gfx::ShapedTextFlags)[/Users/haftandilian/r/mc/obj-db.noindex/toolkit/library/build/XUL +0x16936dc]
#10: gfxTextRun::DrawGlyphs(gfxFont*, gfxTextRun::Range, mozilla::gfx::PointTyped<mozilla::gfx::UnknownUnits, float>*, gfxTextRun::PropertyProvider*, gfxTextRun::Range, TextRunDrawParams&, mozilla::gfx::ShapedTextFlags) const[/Users/haftandilian/r/mc/obj-db.noindex/toolkit/library/build/XUL +0x16df4c8]
#11: gfxTextRun::Draw(gfxTextRun::Range, mozilla::gfx::PointTyped<mozilla::gfx::UnknownUnits, float>, gfxTextRun::DrawParams const&) const[/Users/haftandilian/r/mc/obj-db.noindex/toolkit/library/build/XUL +0x16dfedc]
#12: DrawTextRun(gfxTextRun const*, mozilla::gfx::PointTyped<mozilla::gfx::UnknownUnits, float> const&, gfxTextRun::Range, nsTextFrame::DrawTextRunParams const&, nsTextFrame*)[/Users/haftandilian/r/mc/obj-db.noindex/toolkit/library/build/XUL +0x40ae79c]
#13: nsTextFrame::DrawTextRun(gfxTextRun::Range, mozilla::gfx::PointTyped<mozilla::gfx::UnknownUnits, float> const&, nsTextFrame::DrawTextRunParams const&)[/Users/haftandilian/r/mc/obj-db.noindex/toolkit/library/build/XUL +0x40ae44c]
#14: nsTextFrame::DrawText(gfxTextRun::Range, mozilla::gfx::PointTyped<mozilla::gfx::UnknownUnits, float> const&, nsTextFrame::DrawTextParams const&)[/Users/haftandilian/r/mc/obj-db.noindex/toolkit/library/build/XUL +0x40abb38]
#15: nsTextFrame::PaintText(nsTextFrame::PaintTextParams const&, int, int, nsPoint const&, bool, float)[/Users/haftandilian/r/mc/obj-db.noindex/toolkit/library/build/XUL +0x40ae358]
#16: nsDisplayText::RenderToContext(gfxContext*, nsDisplayListBuilder*, bool)[/Users/haftandilian/r/mc/obj-db.noindex/toolkit/library/build/XUL +0x4233cb4]
#17: nsDisplayText::Paint(nsDisplayListBuilder*, gfxContext*)[/Users/haftandilian/r/mc/obj-db.noindex/toolkit/library/build/XUL +0x4233978]
#18: mozilla::FrameLayerBuilder::PaintItems(std::__1::vector<mozilla::AssignedDisplayItem, std::__1::allocator<mozilla::AssignedDisplayItem> >&, mozilla::gfx::IntRectTyped<mozilla::gfx::UnknownUnits> const&, gfxContext*, nsDisplayListBuilder*, nsPresContext*, [/Users/haftandilian/r/mc/obj-db.noindex/toolkit/library/build/XUL +0x41f947c]
#19: mozilla::FrameLayerBuilder::DrawPaintedLayer(mozilla::layers::PaintedLayer*, gfxContext*, mozilla::gfx::IntRegionTyped<mozilla::gfx::UnknownUnits> const&, mozilla::gfx::IntRegionTyped<mozilla::gfx::UnknownUnits> const&, mozilla::layers::DrawRegionClip, mo[/Users/haftandilian/r/mc/obj-db.noindex/toolkit/library/build/XUL +0x41fa750]
#20: mozilla::layers::ClientSingleTiledLayerBuffer::PaintThebes(mozilla::gfx::IntRegionTyped<mozilla::gfx::UnknownUnits> const&, mozilla::gfx::IntRegionTyped<mozilla::gfx::UnknownUnits> const&, mozilla::gfx::IntRegionTyped<mozilla::gfx::UnknownUnits> const&, v[/Users/haftandilian/r/mc/obj-db.noindex/toolkit/library/build/XUL +0x158cf3c]
#21: mozilla::layers::ClientTiledPaintedLayer::RenderHighPrecision(mozilla::gfx::IntRegionTyped<mozilla::gfx::UnknownUnits> const&, mozilla::gfx::IntRegionTyped<mozilla::gfx::UnknownUnits> const&, void (*)(mozilla::layers::PaintedLayer*, gfxContext*, mozilla::[/Users/haftandilian/r/mc/obj-db.noindex/toolkit/library/build/XUL +0x158490c]
#22: mozilla::layers::ClientTiledPaintedLayer::RenderLayer()[/Users/haftandilian/r/mc/obj-db.noindex/toolkit/library/build/XUL +0x15851f8]
#23: mozilla::layers::ClientLayer::RenderLayerWithReadback(mozilla::layers::ReadbackProcessor*)[/Users/haftandilian/r/mc/obj-db.noindex/toolkit/library/build/XUL +0x157bc24]
#24: mozilla::layers::ClientContainerLayer::RenderLayer()[/Users/haftandilian/r/mc/obj-db.noindex/toolkit/library/build/XUL +0x1590e24]
#25: mozilla::layers::ClientLayerManager::EndTransactionInternal(void (*)(mozilla::layers::PaintedLayer*, gfxContext*, mozilla::gfx::IntRegionTyped<mozilla::gfx::UnknownUnits> const&, mozilla::gfx::IntRegionTyped<mozilla::gfx::UnknownUnits> const&, mozilla::la[/Users/haftandilian/r/mc/obj-db.noindex/toolkit/library/build/XUL +0x1580db4]
#26: mozilla::layers::ClientLayerManager::EndTransaction(void (*)(mozilla::layers::PaintedLayer*, gfxContext*, mozilla::gfx::IntRegionTyped<mozilla::gfx::UnknownUnits> const&, mozilla::gfx::IntRegionTyped<mozilla::gfx::UnknownUnits> const&, mozilla::layers::Dr[/Users/haftandilian/r/mc/obj-db.noindex/toolkit/library/build/XUL +0x1581240]
#27: nsDisplayList::PaintRoot(nsDisplayListBuilder*, gfxContext*, unsigned int)[/Users/haftandilian/r/mc/obj-db.noindex/toolkit/library/build/XUL +0x421e6cc]
#28: nsLayoutUtils::PaintFrame(gfxContext*, nsIFrame*, nsRegion const&, unsigned int, nsDisplayListBuilderMode, nsLayoutUtils::PaintFrameFlags)[/Users/haftandilian/r/mc/obj-db.noindex/toolkit/library/build/XUL +0x3f3b62c]
#29: mozilla::PresShell::Paint(nsView*, nsRegion const&, mozilla::PaintFlags)[/Users/haftandilian/r/mc/obj-db.noindex/toolkit/library/build/XUL +0x3ec250c]
#30: nsViewManager::ProcessPendingUpdatesPaint(nsIWidget*)[/Users/haftandilian/r/mc/obj-db.noindex/toolkit/library/build/XUL +0x3beef24]
#31: nsViewManager::ProcessPendingUpdatesForView(nsView*, bool)[/Users/haftandilian/r/mc/obj-db.noindex/toolkit/library/build/XUL +0x3beecac]
#32: nsViewManager::ProcessPendingUpdates()[/Users/haftandilian/r/mc/obj-db.noindex/toolkit/library/build/XUL +0x3befadc]
#33: nsRefreshDriver::Tick(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp)[/Users/haftandilian/r/mc/obj-db.noindex/toolkit/library/build/XUL +0x3e8c6b0]
#34: mozilla::RefreshDriverTimer::TickDriver(nsRefreshDriver*, mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp)[/Users/haftandilian/r/mc/obj-db.noindex/toolkit/library/build/XUL +0x3e918bc]
#35: mozilla::RefreshDriverTimer::TickRefreshDrivers(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp, nsTArray<RefPtr<nsRefreshDriver> >&)[/Users/haftandilian/r/mc/obj-db.noindex/toolkit/library/build/XUL +0x3e917ec]
#36: mozilla::RefreshDriverTimer::Tick(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp)[/Users/haftandilian/r/mc/obj-db.noindex/toolkit/library/build/XUL +0x3e91694]
#37: mozilla::VsyncRefreshDriverTimer::RunRefreshDrivers(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp)[/Users/haftandilian/r/mc/obj-db.noindex/toolkit/library/build/XUL +0x3e91458]
#38: mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::TickRefreshDriver(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp)[/Users/haftandilian/r/mc/obj-db.noindex/toolkit/library/build/XUL +0x3e90b48]
#39: mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::NotifyParentProcessVsync()[/Users/haftandilian/r/mc/obj-db.noindex/toolkit/library/build/XUL +0x3e90778]
#40: mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::ParentProcessVsyncNotifier::Run()[/Users/haftandilian/r/mc/obj-db.noindex/toolkit/library/build/XUL +0x3e8fc20]
#41: mozilla::RunnableTask::Run()[/Users/haftandilian/r/mc/obj-db.noindex/toolkit/library/build/XUL +0x1a9830]
#42: mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&)[/Users/haftandilian/r/mc/obj-db.noindex/toolkit/library/build/XUL +0x1a6fc0]
#43: mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&)[/Users/haftandilian/r/mc/obj-db.noindex/toolkit/library/build/XUL +0x1a626c]
#44: mozilla::TaskController::ProcessPendingMTTask(bool)[/Users/haftandilian/r/mc/obj-db.noindex/toolkit/library/build/XUL +0x1a63e4]
#45: mozilla::TaskController::InitializeInternal()::$_4::operator()() const[/Users/haftandilian/r/mc/obj-db.noindex/toolkit/library/build/XUL +0x1b4bd8]
#46: mozilla::detail::RunnableFunction<mozilla::TaskController::InitializeInternal()::$_4>::Run()[/Users/haftandilian/r/mc/obj-db.noindex/toolkit/library/build/XUL +0x1b4b8c]
#47: nsThread::ProcessNextEvent(bool, bool*)[/Users/haftandilian/r/mc/obj-db.noindex/toolkit/library/build/XUL +0x1c5a84]
#48: NS_ProcessPendingEvents(nsIThread*, unsigned int)[/Users/haftandilian/r/mc/obj-db.noindex/toolkit/library/build/XUL +0x1c3750]
#49: nsBaseAppShell::NativeEventCallback()[/Users/haftandilian/r/mc/obj-db.noindex/toolkit/library/build/XUL +0x3c342b8]
#50: nsAppShell::ProcessGeckoEvents(void*)[/Users/haftandilian/r/mc/obj-db.noindex/toolkit/library/build/XUL +0x3ca54f4]
#51: __CFRUNLOOP_IS_CALLING_OUT_TO_A_SOURCE0_PERFORM_FUNCTION__[/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation +0x83c04]
#52: __CFRunLoopDoSource0[/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation +0x83b50]
#53: __CFRunLoopDoSources0[/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation +0x8383c]
#54: __CFRunLoopRun[/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation +0x821d4]
#55: CFRunLoopRunSpecific[/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation +0x81730]
#56: RunCurrentEventLoopInMode[/System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/HIToolbox.framework/Versions/A/HIToolbox +0x31f0c]
#57: ReceiveNextEventCommon[/System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/HIToolbox.framework/Versions/A/HIToolbox +0x31d3c]
#58: _BlockUntilNextEventMatchingListInModeWithFilter[/System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/HIToolbox.framework/Versions/A/HIToolbox +0x31a6c]
#59: _DPSNextEvent[/System/Library/Frameworks/AppKit.framework/Versions/C/AppKit +0x41db0]
#60: -[NSApplication(NSEvent) _nextEventMatchingEventMask:untilDate:inMode:dequeue:][/System/Library/Frameworks/AppKit.framework/Versions/C/AppKit +0x40730]
#61: -[GeckoNSApplication nextEventMatchingMask:untilDate:inMode:dequeue:][/Users/haftandilian/r/mc/obj-db.noindex/toolkit/library/build/XUL +0x3ca4ba8]
#62: -[NSApplication run][/System/Library/Frameworks/AppKit.framework/Versions/C/AppKit +0x3258c]
#63: nsAppShell::Run()[/Users/haftandilian/r/mc/obj-db.noindex/toolkit/library/build/XUL +0x3ca5c90]
#64: nsAppStartup::Run()[/Users/haftandilian/r/mc/obj-db.noindex/toolkit/library/build/XUL +0x4fabc8c]
#65: XREMain::XRE_mainRun()[/Users/haftandilian/r/mc/obj-db.noindex/toolkit/library/build/XUL +0x50bc93c]
#66: XREMain::XRE_main(int, char**, mozilla::BootstrapConfig const&)[/Users/haftandilian/r/mc/obj-db.noindex/toolkit/library/build/XUL +0x50bd464]
#67: XRE_main(int, char**, mozilla::BootstrapConfig const&)[/Users/haftandilian/r/mc/obj-db.noindex/toolkit/library/build/XUL +0x50bdab8]
#68: mozilla::BootstrapImpl::XRE_main(int, char**, mozilla::BootstrapConfig const&)[/Users/haftandilian/r/mc/obj-db.noindex/toolkit/library/build/XUL +0x50cde64]
#69: do_main(int, char**, char**)[/Users/haftandilian/r/mc/obj-db.noindex/dist/NightlyDebug.app/Contents/MacOS/firefox +0x46b4]
#70: main[/Users/haftandilian/r/mc/obj-db.noindex/dist/NightlyDebug.app/Contents/MacOS/firefox +0x42c8]
Exiting due to channel error.
[Socket 33980, Main Thread] WARNING: Shutting down Socket process early due to a crash!: file /Users/haftandilian/r/mc/netwerk/ipc/SocketProcessChild.cpp:158
Tue Nov 17 13:13:13 PST 2020

Comment 1

[Markus Stange [:mstange]]

Can you check if this change helps?

diff --git a/gfx/2d/CGTextDrawing.h b/gfx/2d/CGTextDrawing.h
--- a/gfx/2d/CGTextDrawing.h
+++ b/gfx/2d/CGTextDrawing.h
@@ -76,16 +76,20 @@ static void EnsureValidPremultipliedData
   }

   uint8_t* bitmapData = (uint8_t*)CGBitmapContextGetData(aContext);
   CGRect bitmapBounds =
       CGRectMake(0, 0, CGBitmapContextGetWidth(aContext), CGBitmapContextGetHeight(aContext));
   int stride = CGBitmapContextGetBytesPerRow(aContext);

   CGRect bounds = CGRectIntersection(bitmapBounds, aTextBounds);
+  if (CGRectIsEmpty(bounds)) {
+    return;
+  }
+
   int startX = bounds.origin.x;
   int endX = startX + bounds.size.width;
   MOZ_ASSERT(endX <= bitmapBounds.size.width);

   // CGRect assume that our origin is the bottom left.
   // The data assumes that the origin is the top left.
   // Have to switch the Y axis so that our coordinates are correct
   int startY = bitmapBounds.size.height - (bounds.origin.y + bounds.size.height);

If not, I'd be interested in the values for bounds.origin.x, bounds.size.width, endX and bitmapBounds.size.width in the case where the assertion fails.

Comment 2

[Haik Aftandilian [:haik]]

(In reply to Markus Stange [:mstange] from comment #1)

Can you check if this change helps?

Yes, it appears to help. I can't reproduce the problem with the CGRectIsEmpty() check.

Comment 3

[Markus Stange [:mstange]]

Attachment: Bug 1677854 - Bail out early in EnsureValidPremultipliedData if the text is offscreen. r=lsalzman

Comment 4

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/d0b6f4f1a669
Bail out early in EnsureValidPremultipliedData if the text is offscreen. r=lsalzman

Comment 5

[Andreea Pavel [:apavel]]

https://hg.mozilla.org/mozilla-central/rev/d0b6f4f1a669