1763941 - `canvas.getContext("2d")` crashes firefox 99 when gfx.canvas.accelerated=true and webgl.disabled=true

Status: RESOLVED WORKSFORME

(Core :: Graphics: Canvas2D, defect)

Description

[BZZZZ]

User Agent: Mozilla/5.0 (X11; Linux x86_64; rv:99.0) Gecko/20100101 Firefox/99.0

Steps to reproduce:

this is bug report because firefox 98 doesn't crash

my about:config stuff (both have to be true to crash):
gfx.canvas.accelerated = true
webgl.disabled = true

1. go to website that does canvas.getContext("2d") (doesn't have to draw anything)

Actual results:

tab crashed

Expected results:

canvas.getContext("2d") returned a CanvasRenderingContext2D

Comment 1

[BugBot [:suhaib / :marco/ :calixte]]

The Bugbug bot thinks this bug should belong to the 'Core::Canvas: WebGL' component, and is moving the bug to that component. Please correct in case you think the bot is wrong.

Comment 2

[BugBot [:suhaib / :marco/ :calixte]]

The severity field is not set for this bug.
:jgilbert, could you have a look please?

For more information, please visit auto_nag documentation.

Comment 3

[Lee Salzman [:lsalzman]]

I was not able to reproduce this at all. If possible, can you please submit the crash report (and link it here), and also possibly give a testcase that you believe reproduces the crash for you? Your "about:support" information would also be helpful.

Comment 4

[BZZZZ]

Attachment: aboutsupport

(In reply to Lee Salzman [:lsalzman] from comment #3)
> I was not able to reproduce this at all. If possible, can you please submit the crash report (and link it here), and also possibly give a testcase that you believe reproduces the crash for you? Your "about:support" information would also be helpful.

Comment 5

[BZZZZ]

(In reply to Lee Salzman [:lsalzman] from comment #3)

I was not able to reproduce this at all. If possible, can you please submit the crash report (and link it here), and also possibly give a testcase that you believe reproduces the crash for you? Your "about:support" information would also be helpful.

about:support: https://dl.dropboxusercontent.com/s/8cs6mlo8clnc3zf/about_support_crash_firefox.txt
crash report: https://dl.dropboxusercontent.com/s/b8byn360932li5c/report_crash_firefox.txt

Firefox was crashing when I mouse over buttons for too long this time. about:config modifications are same.

Comment 6

[Lee Salzman [:lsalzman]]

That crash report doesn't have the stack trace in it. That's what I was trying to see from the crash report, as that would pinpoint where the crash is. Can you please get the full crash report?

Comment 7

[BZZZZ]

(In reply to Lee Salzman [:lsalzman] from comment #6)

That crash report doesn't have the stack trace in it. That's what I was trying to see from the crash report, as that would pinpoint where the crash is. Can you please get the full crash report?

here is my $HOME/.mozilla folder after I:

1. delete $HOME/.mozilla/firefox
2. open firefox
3. go to about:config
4. set gfx.canvas.accelerated = true, webgl.disabled = true
5. close firefox
6. open firefox
7. press F12 and select Console tab in devtools
8. run document.createElement('canvas').getContext('2d') (tab crashed after that)
9. close firefox

I don't know what else to send.

Comment 8

[Lee Salzman [:lsalzman]]

(In reply to BZZZZ from comment #7)

(In reply to Lee Salzman [:lsalzman] from comment #6)

That crash report doesn't have the stack trace in it. That's what I was trying to see from the crash report, as that would pinpoint where the crash is. Can you please get the full crash report?

here is my $HOME/.mozilla folder after I:

1. delete $HOME/.mozilla/firefox
2. open firefox
3. go to about:config
4. set gfx.canvas.accelerated = true, webgl.disabled = true
5. close firefox
6. open firefox
7. press F12 and select Console tab in devtools
8. run document.createElement('canvas').getContext('2d') (tab crashed after that)
9. close firefox

I don't know what else to send.

Okay, I found the crash report in your folder. I know where the crash is now. Please remove that from dropbox as that may contain personal information of yours we don't want anyone else to see.

Comment 9

[Lee Salzman [:lsalzman]]

I believe this should already be fixed in Nightly. Can you test the Nightly release to see?

Comment 10

[BZZZZ]

(In reply to Lee Salzman [:lsalzman] from comment #9)

I believe this should already be fixed in Nightly. Can you test the Nightly release to see?

https://ftp.mozilla.org/pub/firefox/nightly/2022/04/2022-04-28-07-01-26-mozilla-central/firefox-101.0a1.en-US.linux-x86_64.tar.bz2 build doesn't crash

Comment 11

[Lee Salzman [:lsalzman]]

For posterity, the crash was in ~DrawTargetWebgl trying to access mSharedContext without checking if it was non-null: https://hg.mozilla.org/releases/mozilla-release/file/0f814a8ab240bb6df6bbc5a88865f979e03f0f68/dom/canvas/DrawTargetWebgl.cpp#l218

That code was removed in bug 1755458