1817108 - Assertion failure: rgbSize == GetImageMetadata().GetOrientation().ToUnoriented(Size()).ToUnknownSize(), at /builds/worker/checkouts/gecko/image/decoders/nsAVIFDecoder.cpp:1569

Status: RESOLVED FIXED

(Core :: Graphics: ImageLib, defect, P3)

Description

[Tyson Smith [:tsmith]]

Attachment: testcase.avif

Found while fuzzing m-c 20230215-d07a18cd4ca2 (--enable-debug --enable-fuzzing)

To reproduce via Grizzly Replay:

$ pip install fuzzfetch grizzly-framework
$ python -m fuzzfetch -d --fuzzing -n firefox
$ python -m grizzly.replay ./firefox/firefox testcase.avif

Assertion failure: rgbSize == GetImageMetadata().GetOrientation().ToUnoriented(Size()).ToUnknownSize(), at /builds/worker/checkouts/gecko/image/decoders/nsAVIFDecoder.cpp:1569

#0 0x7f565c21a9c6 in mozilla::image::nsAVIFDecoder::Decode(mozilla::image::SourceBufferIterator&, mozilla::image::IResumable*) /builds/worker/checkouts/gecko/image/decoders/nsAVIFDecoder.cpp:1567:3
#1 0x7f565c217cf1 in mozilla::image::nsAVIFDecoder::DoDecode(mozilla::image::SourceBufferIterator&, mozilla::image::IResumable*) /builds/worker/checkouts/gecko/image/decoders/nsAVIFDecoder.cpp:1195:25
#2 0x7f565c159fe7 in mozilla::image::Decoder::Decode(mozilla::image::IResumable*) /builds/worker/checkouts/gecko/image/Decoder.cpp:177:19
#3 0x7f565c15998b in mozilla::image::AnimationSurfaceProvider::Run() /builds/worker/checkouts/gecko/image/AnimationSurfaceProvider.cpp:232:36
#4 0x7f565c17c391 in mozilla::image::DecodingTask::Run() /builds/worker/checkouts/gecko/image/DecodePool.cpp:146:12
#5 0x7f565aa2fb53 in mozilla::TaskController::RunPoolThread() /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:328:33
#6 0x7f566dbbec86 in _pt_root /builds/worker/checkouts/gecko/nsprpub/pr/src/pthreads/ptthread.c:201:5
#7 0x7f566e467b42 in start_thread nptl/pthread_create.c:442:8
#8 0x7f566e4f99ff  misc/../sysdeps/unix/sysv/linux/x86_64/clone3.S:81

Comment 1

[Bugmon [:jkratzer for issues]]

Unable to reproduce bug 1817108 using build mozilla-central 20230215145624-d07a18cd4ca2. Without a baseline, bugmon is unable to analyze this bug.
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.

Comment 2

[Timothy Nikkel (:tnikkel)]

I am able to reproduce but only with the pref image.avif.sequence.enabled=true

Comment 3

[Teodor Tanasoaia [:teoxoy]]

Timothy, could you take this bug? It looks like the image size doesn't match the metadata size even though the decoded size seems to be correct.

Comment 4

[Timothy Nikkel (:tnikkel)]

Yeah, either myself or Zaggy will get to this before turned on the animated avif pref

Comment 5

[Zaggy1024]

It looks like this was caused by changing frame size in the animated bitstream, just something I overlooked. I've got a fix coming soon.

Comment 6

[Zaggy1024]

Attachment: Bug 1817108 - Check that AVIF frame sizes remain unchanged during animation. r=tnikkel

Comment 7

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/2351f87a1d9c
Check that AVIF frame sizes remain unchanged during animation. r=tnikkel

Comment 8

[Cristian Tuns]

https://hg.mozilla.org/mozilla-central/rev/2351f87a1d9c