1779771 - Assertion failure: NS_IsMainThread(), at /gfx/thebes/gfxPlatform.cpp:2266

Status: VERIFIED FIXED

(Core :: Graphics: Canvas2D, defect, P3)

Description

[Jason Kratzer [:jkratzer]]

Testcase found while fuzzing mozilla-central rev 59134b451eec (built with: --enable-debug --enable-fuzzing).

Testcase can be reproduced using the following commands:

$ pip install fuzzfetch grizzly-framework
$ python -m fuzzfetch --build 59134b451eec --debug --fuzzing -n firefox
$ python -m grizzly.replay ./firefox/firefox testcase.zip

Assertion failure: NS_IsMainThread(), at /gfx/thebes/gfxPlatform.cpp:2266

    ==2683044==ERROR: UndefinedBehaviorSanitizer: SEGV on unknown address 0x000000000000 (pc 0x7f7b145ca527 bp 0x7f7b0a37b2d0 sp 0x7f7b0a37b270 T2683057)
    ==2683044==The signal is caused by a WRITE memory access.
    ==2683044==Hint: address points to the zero page.
        #0 0x7f7b145ca527 in gfxPlatform::ScreenReferenceDrawTarget() /gfx/thebes/gfxPlatform.cpp:2266:3
        #1 0x7f7b1748b352 in mozilla::SVGContentUtils::GetPath(nsTSubstring<char16_t> const&) /dom/svg/SVGContentUtils.cpp:835:35
        #2 0x7f7b1620ac77 in mozilla::dom::CanvasPath::Constructor(mozilla::dom::GlobalObject const&, nsTSubstring<char16_t> const&) /dom/canvas/CanvasRenderingContext2D.cpp:6025:32
        #3 0x7f7b1567a892 in mozilla::dom::Path2D_Binding::_constructor(JSContext*, unsigned int, JS::Value*) /builds/worker/workspace/obj-build/dom/bindings/CanvasRenderingContext2DBinding.cpp:8884:60
        #4 0x7f7b1b61a040 in CallJSNative(JSContext*, bool (*)(JSContext*, unsigned int, JS::Value*), js::CallReason, JS::CallArgs const&) /js/src/vm/Interpreter.cpp:417:13
        #5 0x7f7b1b626969 in CallJSNativeConstructor(JSContext*, bool (*)(JSContext*, unsigned int, JS::Value*), JS::CallArgs const&) /js/src/vm/Interpreter.cpp:433:8
        #6 0x7f7b1b61b403 in InternalConstruct(JSContext*, js::AnyConstructArgs const&) /js/src/vm/Interpreter.cpp:649:10
        #7 0x7f7b1b610d3a in ConstructFromStack /js/src/vm/Interpreter.cpp:676:10
        #8 0x7f7b1b610d3a in Interpret(JSContext*, js::RunState&) /js/src/vm/Interpreter.cpp:3303:16
        #9 0x7f7b1b608112 in js::RunScript(JSContext*, js::RunState&) /js/src/vm/Interpreter.cpp:389:13
        #10 0x7f7b1b61c366 in js::ExecuteKernel(JSContext*, JS::Handle<JSScript*>, JS::Handle<JSObject*>, js::AbstractFramePtr, JS::MutableHandle<JS::Value>) /js/src/vm/Interpreter.cpp:778:13
        #11 0x7f7b1b61c77b in js::Execute(JSContext*, JS::Handle<JSScript*>, JS::Handle<JSObject*>, JS::MutableHandle<JS::Value>) /js/src/vm/Interpreter.cpp:810:10
        #12 0x7f7b1a2efbfa in EvaluateSourceBuffer<mozilla::Utf8Unit> /js/src/vm/CompilationAndEvaluation.cpp:571:10
        #13 0x7f7b1a2efbfa in JS::Evaluate(JSContext*, JS::ReadOnlyCompileOptions const&, JS::SourceText<mozilla::Utf8Unit>&, JS::MutableHandle<JS::Value>) /js/src/vm/CompilationAndEvaluation.cpp:579:10
        #14 0x7f7b179cd8a1 in EvaluateSourceBuffer<mozilla::Utf8Unit> /dom/workers/ScriptLoader.cpp:438:10
        #15 0x7f7b179cd8a1 in mozilla::dom::workerinternals::loader::WorkerScriptLoader::EvaluateScript(JSContext*, JS::loader::ScriptLoadRequest*) /dom/workers/ScriptLoader.cpp:945:13
        #16 0x7f7b179cd404 in mozilla::dom::workerinternals::loader::WorkerScriptLoader::ProcessPendingRequests(JSContext*) /dom/workers/ScriptLoader.cpp:616:10
        #17 0x7f7b179d0877 in mozilla::dom::workerinternals::loader::ScriptExecutorRunnable::WorkerRun(JSContext*, mozilla::dom::WorkerPrivate*) /dom/workers/ScriptLoader.cpp:1063:24
        #18 0x7f7b17a06733 in mozilla::dom::WorkerRunnable::Run() /dom/workers/WorkerRunnable.cpp:377:12
        #19 0x7f7b1314ca47 in nsThread::ProcessNextEvent(bool, bool*) /xpcom/threads/nsThread.cpp:1199:16
        #20 0x7f7b13152f8d in NS_ProcessNextEvent(nsIThread*, bool) /xpcom/threads/nsThreadUtils.cpp:465:10
        #21 0x7f7b179faf38 in mozilla::dom::WorkerPrivate::RunCurrentSyncLoop() /dom/workers/WorkerPrivate.cpp:4197:7
        #22 0x7f7b167213aa in mozilla::dom::AutoSyncLoopHolder::Run() /builds/worker/workspace/obj-build/dist/include/mozilla/dom/WorkerPrivate.h:1515:27
        #23 0x7f7b179d15b7 in mozilla::dom::workerinternals::(anonymous namespace)::LoadAllScripts(mozilla::dom::WorkerPrivate*, mozilla::UniquePtr<mozilla::dom::SerializedStackHolder, mozilla::DefaultDelete<mozilla::dom::SerializedStackHolder> >, nsTArray<nsTString<char16_t> > const&, bool, mozilla::dom::WorkerScriptType, mozilla::ErrorResult&, mozilla::Encoding const*) /dom/workers/ScriptLoader.cpp:281:14
        #24 0x7f7b179d1129 in mozilla::dom::workerinternals::LoadMainScript(mozilla::dom::WorkerPrivate*, mozilla::UniquePtr<mozilla::dom::SerializedStackHolder, mozilla::DefaultDelete<mozilla::dom::SerializedStackHolder> >, nsTSubstring<char16_t> const&, mozilla::dom::WorkerScriptType, mozilla::ErrorResult&, mozilla::Encoding const*) /dom/workers/ScriptLoader.cpp:1204:3
        #25 0x7f7b17a14e02 in mozilla::dom::(anonymous namespace)::CompileScriptRunnable::WorkerRun(JSContext*, mozilla::dom::WorkerPrivate*) /dom/workers/WorkerPrivate.cpp:380:5
        #26 0x7f7b17a06733 in mozilla::dom::WorkerRunnable::Run() /dom/workers/WorkerRunnable.cpp:377:12
        #27 0x7f7b1314ca47 in nsThread::ProcessNextEvent(bool, bool*) /xpcom/threads/nsThread.cpp:1199:16
        #28 0x7f7b13152f8d in NS_ProcessNextEvent(nsIThread*, bool) /xpcom/threads/nsThreadUtils.cpp:465:10
        #29 0x7f7b179f54d4 in mozilla::dom::WorkerPrivate::DoRunLoop(JSContext*) /dom/workers/WorkerPrivate.cpp:3201:7
        #30 0x7f7b179dee1b in mozilla::dom::workerinternals::(anonymous namespace)::WorkerThreadPrimaryRunnable::Run() /dom/workers/RuntimeService.cpp:2038:42
        #31 0x7f7b1314ca47 in nsThread::ProcessNextEvent(bool, bool*) /xpcom/threads/nsThread.cpp:1199:16
        #32 0x7f7b13152f8d in NS_ProcessNextEvent(nsIThread*, bool) /xpcom/threads/nsThreadUtils.cpp:465:10
        #33 0x7f7b13d2105b in mozilla::ipc::MessagePumpForNonMainThreads::Run(base::MessagePump::Delegate*) /ipc/glue/MessagePump.cpp:300:20
        #34 0x7f7b13c462e7 in MessageLoop::RunInternal() /ipc/chromium/src/base/message_loop.cc:380:10
        #35 0x7f7b13c461f2 in RunHandler /ipc/chromium/src/base/message_loop.cc:373:3
        #36 0x7f7b13c461f2 in MessageLoop::Run() /ipc/chromium/src/base/message_loop.cc:355:3
        #37 0x7f7b13147d76 in nsThread::ThreadFunc(void*) /xpcom/threads/nsThread.cpp:384:10
        #38 0x7f7b2904c557 in _pt_root /nsprpub/pr/src/pthreads/ptthread.c:201:5
        #39 0x7f7b29dbe608 in start_thread /build/glibc-SzIz7B/glibc-2.31/nptl/pthread_create.c:477:8
        #40 0x7f7b29985132 in __clone /build/glibc-SzIz7B/glibc-2.31/misc/../sysdeps/unix/sysv/linux/x86_64/clone.S:95
    
    UndefinedBehaviorSanitizer can not provide additional info.
    SUMMARY: UndefinedBehaviorSanitizer: SEGV /gfx/thebes/gfxPlatform.cpp:2266:3 in gfxPlatform::ScreenReferenceDrawTarget()
    ==2683044==ABORTING

Comment 1

[Jason Kratzer [:jkratzer]]

Attachment: Testcase

Comment 2

[Bugmon [:jkratzer for issues]]

Bugmon Analysis
Verified bug as reproducible on mozilla-central 20220715095545-59134b451eec.
The bug appears to have been introduced in the following build range:

Start: 65f72ec8bb2a638e417a294b41d30ea5d142385a (20220714185143)
End: cf4f10d1fae6460c7bf955f6cd266298281fc5a3 (20220714211027)
Pushlog: https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=65f72ec8bb2a638e417a294b41d30ea5d142385a&tochange=cf4f10d1fae6460c7bf955f6cd266298281fc5a3

Comment 3

[Andrew Osmond [:aosmond] (he/him)]

Attachment: Bug 1779771 - Use thread local ScreenReferenceDrawTarget for CanvasPath::Constructor.

Comment 5

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/634f1d7bc06a
Use thread local ScreenReferenceDrawTarget for CanvasPath::Constructor. r=gfx-reviewers,lsalzman

Comment 6

[Norisz Fay [:noriszfay]]

https://hg.mozilla.org/mozilla-central/rev/634f1d7bc06a

Comment 7

[Bugmon [:jkratzer for issues]]

Bugmon Analysis
Verified bug as fixed on rev mozilla-central 20220716092056-c682cdddfbf1.
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.