1864988 - Crash in [@ mozilla::gfx::CreateDataSourceSurfaceByCloning]

Status: RESOLVED FIXED

(Core :: Graphics: Canvas2D, defect)

Description

[BugBot [:suhaib / :marco]]

Crash report: https://crash-stats.mozilla.org/report/index/496a721e-50e1-47c0-acd8-325710231021

Reason: EXCEPTION_ACCESS_VIOLATION_READ

Top 10 frames of crashing thread:

0  xul.dll  mozilla::gfx::CreateDataSourceSurfaceByCloning  gfx/2d/DataSurfaceHelpers.cpp:333
1  xul.dll  mozilla::dom::CanvasRenderingContext2D::GetImageDataArray  dom/canvas/CanvasRenderingContext2D.cpp:5978
1  xul.dll  mozilla::dom::CanvasRenderingContext2D::GetImageData  dom/canvas/CanvasRenderingContext2D.cpp:5874
2  xul.dll  mozilla::dom::CanvasRenderingContext2D_Binding::getImageData  dom/bindings/CanvasRenderingContext2DBinding.cpp:5416
3  xul.dll  mozilla::dom::binding_detail::GenericMethod<mozilla::dom::binding_detail::NormalThisPolicy, mozilla::dom::binding_detail::ThrowExceptions>  dom/bindings/BindingUtils.cpp:3327
4  xul.dll  CallJSNative  js/src/vm/Interpreter.cpp:472
4  xul.dll  js::InternalCallOrConstruct  js/src/vm/Interpreter.cpp:566
4  xul.dll  InternalCall  js/src/vm/Interpreter.cpp:633
4  xul.dll  js::CallFromStack  js/src/vm/Interpreter.cpp:638
4  xul.dll  js::Interpret  js/src/vm/Interpreter.cpp:3053

By querying Nightly crashes reported within the last 2 months, here are some insights about the signature:

• First crash report: 2023-09-08
• Process type: Content
• Is startup crash: No
• Has user comments: No
• Is null crash: Yes - all crashes happened on null or near null memory address

Comment 1

[Gabriele Svelto [:gsvelto]]

I've dug through the crashes and this looks valid. What I find peculiar is that this seems Windows-specific, but I would expect this signature to affect all platforms. Maybe the graphics code is going down a Windows-specific code path that I'm not aware of.

Comment 2

[Kelsey Gilbert [:jgilbert]]

Attachment: Bug 1864988 - Don't call CreateDataSourceSurfaceByCloning on null.

Comment 3

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/79236d4a1ba0
Don't call CreateDataSourceSurfaceByCloning on null. r=gfx-reviewers,aosmond

Comment 4

[Natalia Csoregi [:nataliaCs]]

https://hg.mozilla.org/mozilla-central/rev/79236d4a1ba0

Comment 5

[BugBot [:suhaib / :marco]]

The patch landed in nightly and beta is affected.
:jgilbert, is this bug important enough to require an uplift?

• If yes, please nominate the patch for beta approval.
• If no, please set status-firefox121 to wontfix.

For more information, please visit BugBot documentation.

Comment 6

[Kelsey Gilbert [:jgilbert]]

Comment on attachment 9365971 [details]
Bug 1864988 - Don't call CreateDataSourceSurfaceByCloning on null.

Beta/Release Uplift Approval Request

• User impact if declined: Occasional crash.
• Is this code covered by automated tests?: No
• Has the fix been verified in Nightly?: No
• Needs manual test from QE?: No
• If yes, steps to reproduce:
• List of other uplifts needed: None
• Risk to taking this patch: Low
• Why is the change risky/not risky? (and alternatives if risky): Not risky, because it's just a null check before calling something that expects non-null, from a code branch that has subsequent handling of nulls. (so the code already expects to handle nulls, and just isn't in this one case)
• String changes made/needed: none
• Is Android affected?: No

Comment 7

[Kelsey Gilbert [:jgilbert]]

[Tracking Requested - why for this release]:

Comment 8

[Ryan VanderMeulen [:RyanVM]]

Comment on attachment 9365971 [details]
Bug 1864988 - Don't call CreateDataSourceSurfaceByCloning on null.

Approved for 121.0b6.

Comment 9

[Pulsebot]

https://hg.mozilla.org/releases/mozilla-beta/rev/994359e7d8fd