Closed Bug 1713769 Opened 4 months ago Closed 3 days ago

Crash in [@ SkImage::makeShader]

Categories

(Core :: Graphics, defect)

defect

Tracking

()

RESOLVED FIXED
94 Branch
Tracking Status
firefox-esr78 --- wontfix
firefox-esr91 --- affected
firefox92 --- wontfix
firefox93 --- affected
firefox94 --- fixed

People

(Reporter: gsvelto, Assigned: lsalzman, NeedInfo)

Details

(Keywords: crash)

Crash Data

Attachments

(1 file)

Crash report: https://crash-stats.mozilla.org/report/index/7d7c8f9e-6c22-4cd6-8af1-d205a0210527

Reason: SIGSEGV /SEGV_MAPERR

Top 10 frames of crashing thread:

0 libxul.so SkImage::makeShader const /build/firefox-BXnEmc/firefox-88.0.1+build1/gfx/skia/skia/src/image/SkImage.cpp:88
1 libxul.so mozilla::gfx::SetPaintPattern /build/firefox-BXnEmc/firefox-88.0.1+build1/gfx/2d/DrawTargetSkia.cpp:569
2 libxul.so mozilla::gfx::DrawTargetSkia::FillRect /build/firefox-BXnEmc/firefox-88.0.1+build1/gfx/2d/DrawTargetSkia.cpp:811
3 libxul.so mozilla::gfx::RecordedFillRect::PlayEvent const /build/firefox-BXnEmc/firefox-88.0.1+build1/gfx/2d/RecordedEventImpl.h:2200
4 libxul.so std::_Function_handler<bool  /usr/include/c++/10/bits/std_function.h:291
5 libxul.so bool mozilla::gfx::RecordedEvent::DoWithEvent<mozilla::gfx::InlineTranslator::TranslateRecording /build/firefox-BXnEmc/firefox-88.0.1+build1/gfx/2d/RecordedEventImpl.h:3912
6 libxul.so mozilla::gfx::InlineTranslator::TranslateRecording /build/firefox-BXnEmc/firefox-88.0.1+build1/gfx/2d/InlineTranslator.cpp:72
7 libxul.so mozilla::gfx::CrossProcessPaint::Start const /build/firefox-BXnEmc/firefox-88.0.1+build1/gfx/ipc/CrossProcessPaint.cpp:252
8 libxul.so mozilla::MozPromise<nsRefCountedHashtable<nsUint64HashKey, RefPtr<mozilla::gfx::RecordedDependentSurface> >, nsresult, true>::ThenValue<mozilla::gfx::CrossProcessPaint::Start /build/firefox-BXnEmc/firefox-88.0.1+build1/obj-x86_64-linux-gnu/dist/include/mozilla/MozPromise.h:846
9 libxul.so mozilla::MozPromise<nsRefCountedHashtable<nsUint64HashKey, RefPtr<mozilla::gfx::RecordedDependentSurface> >, nsresult, true>::ThenValueBase::ResolveOrRejectRunnable::Run /build/firefox-BXnEmc/firefox-88.0.1+build1/obj-x86_64-linux-gnu/dist/include/mozilla/MozPromise.h:487

This is a crash caused by a NULL pointer access with consistent frames across all platforms but very low volume. The crash URLs indicate this is happening on these three pages:

Many comments specifically point to the first page

Severity: -- → S2

Hi Lee, this is showing up pretty high on the Nightly topcrash list. Any thoughts on what might be going wrong?

Flags: needinfo?(lsalzman)

If makeShader() gets passed a non-invertible matrix, it can fail and return null.
This can then subsequently cause problems when this is passed to SkPaint which
blindly tries to use it. For other pattern types, we gracefully handle this by
just making the SkPaint transparent, so let's do likewise for surface patterns.

Assignee: nobody → lsalzman
Status: NEW → ASSIGNED
Pushed by lsalzman@mozilla.com:
https://hg.mozilla.org/integration/autoland/rev/f8b350f26920
Avoid null Skia image shader. r=gfx-reviewers,jgilbert
Status: ASSIGNED → RESOLVED
Closed: 3 days ago
Resolution: --- → FIXED
Target Milestone: --- → 94 Branch
You need to log in before you can comment on or make changes to this bug.