1869658 - Crash in [@ OOM | unknown | base::SharedMemory::memory]

Status: RESOLVED FIXED

(Core :: Graphics: Canvas2D, defect, P3)

Description

[Andrew Osmond [:aosmond] (he/him)]

Crash report: https://crash-stats.mozilla.org/report/index/dfc666c7-b621-4b1d-b2dd-79cb90231212

Reason: EXCEPTION_ACCESS_VIOLATION_READ

Top 10 frames of crashing thread:

0  xul.dll  mozilla::UniquePtr<void, base::SharedMemory::MappingDeleter>::get const  mfbt/UniquePtr.h:286
0  xul.dll  base::SharedMemory::memory const  ipc/chromium/src/base/shared_memory.h:92
0  xul.dll  mozilla::ipc::SharedMemoryBasic::memory const  ipc/glue/SharedMemoryBasic_chromium.h:60
0  xul.dll  mozilla::detail::AtomicBase<mozilla::layers::CanvasDrawEventRecorder::State, 2>::operator=  gfx/layers/CanvasDrawEventRecorder.h:150
0  xul.dll  mozilla::layers::CanvasDrawEventRecorder::GetContiguousBuffer  gfx/layers/CanvasDrawEventRecorder.cpp
1  xul.dll  mozilla::gfx::ContiguousBufferStream::RecordEvent<mozilla::gfx::RecordedSourceSurfaceCreation>  gfx/2d/RecordedEvent.h:279
2  xul.dll  mozilla::gfx::DrawEventRecorderPrivate::StoreSourceSurfaceRecording  gfx/2d/DrawEventRecorder.cpp:61
3  xul.dll  mozilla::gfx::EnsureSurfaceStoredRecording  gfx/2d/DrawTargetRecording.cpp:60
4  xul.dll  mozilla::gfx::DrawTargetRecording::DrawSurface  gfx/2d/DrawTargetRecording.cpp:432
5  xul.dll  mozilla::dom::CanvasRenderingContext2D::DrawWindow  dom/canvas/CanvasRenderingContext2D.cpp:5850

Comment 1

[Andrew Osmond [:aosmond] (he/him)]

The crash report doesn't specific the lines, but I think these are clearly wrong and would cause it:
https://searchfox.org/mozilla-central/rev/da48f565f70a57ac28862090828fbaa7fd8556f6/gfx/layers/CanvasDrawEventRecorder.cpp#211
https://searchfox.org/mozilla-central/rev/da48f565f70a57ac28862090828fbaa7fd8556f6/gfx/layers/CanvasDrawEventRecorder.cpp#217

Comment 2

[Andrew Osmond [:aosmond] (he/him)]

Attachment: Bug 1869658 - Fix usage of CanvasBuffer on failure paths.

Comment 3

[BugBot [:suhaib / :marco/ :calixte]]

Set release status flags based on info from the regressing bug 1863914

Comment 4

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/b74ed8e9d95a
Fix usage of CanvasBuffer on failure paths. r=gfx-reviewers,lsalzman

Comment 5

[Narcis Beleuzu [:NarcisB]]

https://hg.mozilla.org/mozilla-central/rev/b74ed8e9d95a