1708540 - sw-wr: linear gradients with NaN stretch_size cause LinearGradientTemplate creation to crash

Status: VERIFIED FIXED

(Core :: Graphics: WebRender, defect)

Description

[Brad Werth [:bradwerth]]

Steps to Reproduce:

1. Set pref gfx.software.webrender to true.
2. Navigate to https://multcolib.bibliocommons.com/v2/search?query=McGuire%2C%20Seanan&searchType=author&pagination_page=3
3. Click one of the "Check out" buttons.

Debugging shows that at the point of failure, task_size.height is NaN, which causes the to_i32() cast to crash.

Tried this again with patches for Bug 1706678 applied and the crash still occurs.

Comment 1

[BugBot [:suhaib / :marco/ :calixte]]

Set release status flags based on info from the regressing bug 1702228

Comment 2

[Dzmitry Malyshau [:kvark]]

Somewhat similar to bug 1707744, in a way that type casting failed implicitly.
It's suspicious that the bug title has "sw-wr" in it. The failing code should be ran regardless of SW-WR.
Nicola - sorry to ping you on this one, just wanted to bring your attention here.

Comment 3

[Nicolas Silva [:nical]]

Attachment: Bug 1708540 - Handle and test various NaN situations with gradients. r=#gfx-reviewers

Comment 4

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/ebb995da11f9
Handle and test various NaN situations with gradients. r=gfx-reviewers,bradwerth

Comment 5

[Natalia Csoregi [:nataliaCs]]

https://hg.mozilla.org/mozilla-central/rev/ebb995da11f9

Comment 6

[Catalin Sasca, Desktop Test Engineering [:csasca]]

Reproduced the issue on Firefox 90.0a1 (2021-04-29) under macOS 10.15.7 by following the info from Comment 0.

The issue is fixed on Firefox 90.0b5 and Firefox 91.0a1 (2021-06-08). Tests were performed on macOS 10.15.7, Windows 10 and Ubuntu 20.04.