1794360 - Crash in [@ mozilla::dom::ImageBitmap::CreateFromCloneData]

Status: RESOLVED FIXED

(Core :: Graphics: Canvas2D, defect)

Description

[Gabriele Svelto [:gsvelto]]

Crash report: https://crash-stats.mozilla.org/report/index/c0579800-80b0-42d3-a020-e181d0221009

Reason: EXCEPTION_ACCESS_VIOLATION_READ

Top 10 frames of crashing thread:

0 xul.dll mozilla::dom::ImageBitmap::CreateFromCloneData dom/canvas/ImageBitmap.cpp:832
1 xul.dll mozilla::dom::StructuredCloneHolder::CustomReadTransferHandler dom/base/StructuredCloneHolder.cpp:1200
2 xul.dll mozilla::dom:: dom/base/StructuredCloneHolder.cpp:118
3 xul.dll ReadStructuredClone js/src/vm/StructuredClone.cpp:765
4 xul.dll JSAutoStructuredCloneBuffer::read js/src/vm/StructuredClone.cpp:3943
5 xul.dll mozilla::dom::StructuredCloneHolder::Read dom/base/StructuredCloneHolder.cpp:385
6 xul.dll mozilla::dom::MessageEventRunnable::DispatchDOMEvent dom/workers/MessageEventRunnable.cpp:74
7 xul.dll mozilla::dom::MessageEventRunnable::WorkerRun dom/workers/MessageEventRunnable.cpp:139
8 xul.dll mozilla::dom::WorkerRunnable::Run dom/workers/WorkerRunnable.cpp:377
9 xul.dll nsThread::ProcessNextEvent xpcom/threads/nsThread.cpp:1199

This looks like the effect of an out-of-memory situation that we didn't properly address earlier in the code flow:

• We're accessing a NULL pointer
• All crashes have very low amounts of commit space left

It's likely that the allocation of an object failed at some point and returned NULL and then we crashed trying to access it.

Comment 1

[BugBot [:suhaib / :marco/ :calixte]]

Since the crash volume is low (less than 15 per week), the severity is downgraded to S3. Feel free to change it back if you think the bug is still critical.

For more information, please visit auto_nag documentation.

Comment 2

[Andrew Osmond [:aosmond] (he/him)]

Attachment: Bug 1794360 - Fail to clone ImageBitmap if no data surface available.

Comment 3

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/d740edd3dc0d
Fail to clone ImageBitmap if no data surface available. r=gfx-reviewers,lsalzman

Comment 4

[Norisz Fay [:noriszfay]]

https://hg.mozilla.org/mozilla-central/rev/d740edd3dc0d

Comment 5

[Ryan VanderMeulen [:RyanVM]]

Did you want to nominate this for ESR128 approval?

Comment 6

[Andrew Osmond [:aosmond] (he/him)]

Comment on attachment 9439361 [details]
Bug 1794360 - Fail to clone ImageBitmap if no data surface available.

ESR Uplift Approval Request

• If this is not a sec:{high,crit} bug, please state case for ESR consideration: Low volume content process crash
• User impact if declined: Content process may continue to crash with sites that use canvas and DOM workers
• Fix Landed on Version: 134
• Risk to taking this patch: Low
• Why is the change risky/not risky? (and alternatives if risky): Change is trivial, just adding a new null pointer check.

Comment 7

[Ryan VanderMeulen [:RyanVM]]

Comment on attachment 9439361 [details]
Bug 1794360 - Fail to clone ImageBitmap if no data surface available.

Approved for 128.7esr.

Comment 8

[Pulsebot]

https://hg.mozilla.org/releases/mozilla-esr128/rev/bf21588fb444

Comment 9

[Andrew Osmond [:aosmond] (he/him)]

It seems like most of the remaining crash volume is in ESR115 FWIW?

Comment 10

[Ryan VanderMeulen [:RyanVM]]

ESR115 is only open for critical fixes at this point as part of the limited support extension beyond its originally-planned EOL date.