1966676 - Crash [@ mozilla::gfx::SetPaintPattern]

Reporter

Description

•

3 months ago

Testcase found while fuzzing mozilla-central rev 39ecf83472f8 (built with: --enable-address-sanitizer --enable-fuzzing).

Testcase can be reproduced using the following commands:

$ pip install fuzzfetch grizzly-framework --upgrade
$ python -m fuzzfetch --build 39ecf83472f8 --asan --fuzzing  -n firefox
$ python -m grizzly.replay.bugzilla ./firefox/firefox <bugid>

[@ mozilla::gfx::SetPaintPattern]

    =================================================================
    ==31797==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x7d04cfea4a55 bp 0x7d04905a45f0 sp 0x7d04905a4500 T51)
    ==31797==The signal is caused by a READ memory access.
    ==31797==Hint: address points to the zero page.
        #0 0x7d04cfea4a55 in mozilla::gfx::SetPaintPattern(SkPaint&, mozilla::gfx::Pattern const&, mozilla::Maybe<mozilla::detail::BaseAutoLock<mozilla::Mutex&>>&, float, SkMatrix const*, mozilla::gfx::RectTyped<mozilla::gfx::UnknownUnits, float> const*) /gecko/gfx/2d/DrawTargetSkia.cpp:592:47
        #1 0x7d04cfea0381 in AutoPaintSetup /gecko/gfx/2d/DrawTargetSkia.cpp:661:5
        #2 0x7d04cfea0381 in mozilla::gfx::DrawTargetSkia::Stroke(mozilla::gfx::Path const*, mozilla::gfx::Pattern const&, mozilla::gfx::StrokeOptions const&, mozilla::gfx::DrawOptions const&) /gecko/gfx/2d/DrawTargetSkia.cpp:899:18
        #3 0x7d04d3a23509 in mozilla::gfx::DrawTargetWebgl::StrokeRect(mozilla::gfx::RectTyped<mozilla::gfx::UnknownUnits, float> const&, mozilla::gfx::Pattern const&, mozilla::gfx::StrokeOptions const&, mozilla::gfx::DrawOptions const&) /gecko/dom/canvas/DrawTargetWebgl.cpp:4103:5
        #4 0x7d04cfdf3f04 in mozilla::gfx::RecordedStrokeRect::PlayEvent(mozilla::gfx::Translator*) const /gecko/gfx/2d/RecordedEventImpl.h:2546:7
        #5 0x7d04d04706ea in operator() /gecko/gfx/layers/ipc/CanvasTranslator.cpp:677:33
        #6 0x7d04d04706ea in std::_Function_handler<bool (mozilla::gfx::RecordedEvent*), mozilla::layers::CanvasTranslator::TranslateRecording()::$_1>::_M_invoke(std::_Any_data const&, mozilla::gfx::RecordedEvent*&&) /builds/worker/fetches/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/8/../../../../include/c++/8/bits/std_function.h:282:9
        #7 0x7d04cfe288b7 in std::function<bool (mozilla::gfx::RecordedEvent*)>::operator()(mozilla::gfx::RecordedEvent*) const /builds/worker/fetches/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/8/../../../../include/c++/8/bits/std_function.h:687:14
        #8 0x7d04cfdfdb7f in bool mozilla::gfx::RecordedEvent::DoWithEvent<mozilla::gfx::MemReader>(mozilla::gfx::MemReader&, mozilla::gfx::RecordedEvent::EventType, std::function<bool (mozilla::gfx::RecordedEvent*)> const&) /gecko/gfx/2d/RecordedEventImpl.h:4577:5
        #9 0x7d04d03f5753 in mozilla::layers::CanvasTranslator::TranslateRecording() /gecko/gfx/layers/ipc/CanvasTranslator.cpp:661:20
        #10 0x7d04d03f7f34 in mozilla::layers::CanvasTranslator::SetDataSurfaceBuffer(mozilla::ipc::shared_memory::Handle<(mozilla::ipc::shared_memory::Type)0>&&) /gecko/gfx/layers/ipc/CanvasTranslator.cpp:343:10
        #11 0x7d04d03f9410 in mozilla::layers::CanvasTranslator::HandleCanvasTranslatorEvents() /gecko/gfx/layers/ipc/CanvasTranslator.cpp:788:13
        #12 0x7d04d046edbf in operator()<> /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1085:18
        #13 0x7d04d046edbf in __invoke_impl<void, (lambda at /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1084:9)> /builds/worker/fetches/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/8/../../../../include/c++/8/bits/invoke.h:60:14
        #14 0x7d04d046edbf in __invoke<(lambda at /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1084:9)> /builds/worker/fetches/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/8/../../../../include/c++/8/bits/invoke.h:95:14
        #15 0x7d04d046edbf in __apply_impl<(lambda at /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1084:9), std::tuple<> &> /builds/worker/fetches/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/8/../../../../include/c++/8/tuple:1678:14
        #16 0x7d04d046edbf in apply<(lambda at /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1084:9), std::tuple<> &> /builds/worker/fetches/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/8/../../../../include/c++/8/tuple:1687:14
        #17 0x7d04d046edbf in apply<mozilla::layers::CanvasTranslator, void (mozilla::layers::CanvasTranslator::*)()> /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1083:12
        #18 0x7d04d046edbf in mozilla::detail::RunnableMethodImpl<mozilla::layers::CanvasTranslator*, void (mozilla::layers::CanvasTranslator::*)(), true, (mozilla::RunnableKind)0>::Run() /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1134:13
        #19 0x7d04cdc559cc in nsThread::ProcessNextEvent(bool, bool*) /gecko/xpcom/threads/nsThread.cpp:1153:16
        #20 0x7d04cdc5ffa8 in NS_ProcessNextEvent(nsIThread*, bool) /gecko/xpcom/threads/nsThreadUtils.cpp:480:10
        #21 0x7d04cf2caa0a in mozilla::ipc::MessagePumpForNonMainThreads::Run(base::MessagePump::Delegate*) /gecko/ipc/glue/MessagePump.cpp:299:20
        #22 0x7d04cf1af914 in RunInternal /gecko/ipc/chromium/src/base/message_loop.cc:369:10
        #23 0x7d04cf1af914 in RunHandler /gecko/ipc/chromium/src/base/message_loop.cc:362:3
        #24 0x7d04cf1af914 in MessageLoop::Run() /gecko/ipc/chromium/src/base/message_loop.cc:344:3
        #25 0x7d04cdc4e810 in nsThread::ThreadFunc(void*) /gecko/xpcom/threads/nsThread.cpp:366:10
        #26 0x7d04f0e4174b in _pt_root /gecko/nsprpub/pr/src/pthreads/ptthread.c:191:3
        #27 0x5d76e1bdd106 in asan_thread_start(void*) /builds/worker/fetches/llvm-project/compiler-rt/lib/asan/asan_interceptors.cpp:239:28
        #28 0x7d04f13d1ac2 in start_thread nptl/pthread_create.c:442:8
        #29 0x7d04f1462a03 in __clone misc/../sysdeps/unix/sysv/linux/x86_64/clone.S:100
    
    ==31797==Register values:
    rax = 0x0000000000000000  rbx = 0x00007d04905a4500  rcx = 0x00007d04c9a44534  rdx = 0x00007d048ea73f20  
    rdi = 0x0000000000000000  rsi = 0xf2f2f2f2f2f8f8f8  rbp = 0x00007d04905a45f0  rsp = 0x00007d04905a4500  
     r8 = 0x00007d048ea73f20   r9 = 0x0000000000000301  r10 = 0x00000fa091d4e901  r11 = 0x0000000000000000  
    r12 = 0x00007d048ea73f28  r13 = 0x00007d048ec63c00  r14 = 0x00000fa091d4e7e5  r15 = 0x00000fa111d84780  
    AddressSanitizer can not provide additional info.
    SUMMARY: AddressSanitizer: SEGV /gecko/gfx/2d/DrawTargetSkia.cpp:592:47 in mozilla::gfx::SetPaintPattern(SkPaint&, mozilla::gfx::Pattern const&, mozilla::Maybe<mozilla::detail::BaseAutoLock<mozilla::Mutex&>>&, float, SkMatrix const*, mozilla::gfx::RectTyped<mozilla::gfx::UnknownUnits, float> const*)
    Thread T51 created by T0 here:
        #0 0x5d76e1bc66e1 in pthread_create /builds/worker/fetches/llvm-project/compiler-rt/lib/asan/asan_interceptors.cpp:250:3
        #1 0x7d04f0e322b9 in _PR_CreateThread /gecko/nsprpub/pr/src/pthreads/ptthread.c:429:10
        #2 0x7d04f0e204fe in PR_CreateThread /gecko/nsprpub/pr/src/pthreads/ptthread.c:496:10
        #3 0x7d04cdc51211 in nsThread::Init(nsTSubstring<char> const&) /gecko/xpcom/threads/nsThread.cpp:615:20
        #4 0x7d04cdc5e876 in nsThreadManager::NewNamedThread(nsTSubstring<char> const&, nsIThreadManager::ThreadCreationOptions, nsIThread**) /gecko/xpcom/threads/nsThreadManager.cpp:619:22
        #5 0x7d04cdc69199 in NS_NewNamedThread(nsTSubstring<char> const&, nsIThread**, already_AddRefed<nsIRunnable>, nsIThreadManager::ThreadCreationOptions) /gecko/xpcom/threads/nsThreadUtils.cpp:176:57
        #6 0x7d04d0c6bbb0 in NS_NewNamedThread<15UL> /gecko/xpcom/threads/nsThreadUtils.h:76:10
        #7 0x7d04d0c6bbb0 in mozilla::gfx::CanvasRenderThread::Start() /gecko/gfx/ipc/CanvasRenderThread.cpp:115:17
        #8 0x7d04d0a61f82 in gfxPlatform::Init() /gecko/gfx/thebes/gfxPlatform.cpp:973:3
        #9 0x7d04d8218774 in GetPlatform /builds/worker/workspace/obj-build/dist/include/gfxPlatform.h:184:7
        #10 0x7d04d8218774 in mozilla::widget::GfxInfoBase::GetContentBackend(nsTSubstring<char16_t>&) /gecko/widget/GfxInfoBase.cpp:1809:25
        #11 0x7d04cdc9e6ad in NS_InvokeByIndex /gecko/xpcom/reflect/xptcall/md/unix/xptcinvoke_asm_x86_64_unix.S:101
        #12 0x7d04cf588bb4 in Invoke /gecko/js/xpconnect/src/XPCWrappedNative.cpp:1620:10
        #13 0x7d04cf588bb4 in Call /gecko/js/xpconnect/src/XPCWrappedNative.cpp:1174:19
        #14 0x7d04cf588bb4 in XPCWrappedNative::CallMethod(XPCCallContext&, XPCWrappedNative::CallMode) /gecko/js/xpconnect/src/XPCWrappedNative.cpp:1120:23
        #15 0x7d04cf58d7fe in GetAttribute /gecko/js/xpconnect/src/xpcprivate.h:1451:12
        #16 0x7d04cf58d7fe in XPC_WN_GetterSetter(JSContext*, unsigned int, JS::Value*) /gecko/js/xpconnect/src/XPCWrappedNativeJSOps.cpp:1006:10
        #17 0x7d04da48adc7 in CallJSNative /gecko/js/src/vm/Interpreter.cpp:494:13
        #18 0x7d04da48adc7 in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) /gecko/js/src/vm/Interpreter.cpp:590:12
        #19 0x7d04da48cc41 in InternalCall /gecko/js/src/vm/Interpreter.cpp:657:10
        #20 0x7d04da48cc41 in js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>, js::CallReason) /gecko/js/src/vm/Interpreter.cpp:689:8
        #21 0x7d04da48e96a in js::CallGetter(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::MutableHandle<JS::Value>) /gecko/js/src/vm/Interpreter.cpp:811:10
        #22 0x7d04da7f679a in CallGetter(JSContext*, JS::Handle<js::NativeObject*>, JS::Handle<JS::Value>, JS::Handle<JS::PropertyKey>, js::PropertyInfoBase<unsigned int>, JS::MutableHandle<JS::Value>) /gecko/js/src/vm/NativeObject.cpp:2092:12
        #23 0x7d04da7cc59d in GetExistingProperty<(js::AllowGC)1> /gecko/js/src/vm/NativeObject.cpp:2120:12
        #24 0x7d04da7cc59d in NativeGetPropertyInline<(js::AllowGC)1> /gecko/js/src/vm/NativeObject.cpp:2273:14
        #25 0x7d04da7cc59d in js::NativeGetProperty(JSContext*, JS::Handle<js::NativeObject*>, JS::Handle<JS::Value>, JS::Handle<JS::PropertyKey>, JS::MutableHandle<JS::Value>) /gecko/js/src/vm/NativeObject.cpp:2303:10
        #26 0x7d04da4ad56e in GetProperty /gecko/js/src/vm/ObjectOperations-inl.h:113:10
        #27 0x7d04da4ad56e in GetObjectElementOperation /gecko/js/src/vm/Interpreter-inl.h:390:10
        #28 0x7d04da4ad56e in GetElementOperationWithStackIndex /gecko/js/src/vm/Interpreter-inl.h:473:10
        #29 0x7d04da4ad56e in js::Interpret(JSContext*, js::RunState&) /gecko/js/src/vm/Interpreter.cpp:3076:12
        #30 0x7d04da489b98 in MaybeEnterInterpreterTrampoline /gecko/js/src/vm/Interpreter.cpp:395:10
        #31 0x7d04da489b98 in js::RunScript(JSContext*, js::RunState&) /gecko/js/src/vm/Interpreter.cpp:464:13
        #32 0x7d04da48af3d in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) /gecko/js/src/vm/Interpreter.cpp:622:13
        #33 0x7d04da48cc41 in InternalCall /gecko/js/src/vm/Interpreter.cpp:657:10
        #34 0x7d04da48cc41 in js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>, js::CallReason) /gecko/js/src/vm/Interpreter.cpp:689:8
        #35 0x7d04da48e96a in js::CallGetter(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::MutableHandle<JS::Value>) /gecko/js/src/vm/Interpreter.cpp:811:10
        #36 0x7d04da7f679a in CallGetter(JSContext*, JS::Handle<js::NativeObject*>, JS::Handle<JS::Value>, JS::Handle<JS::PropertyKey>, js::PropertyInfoBase<unsigned int>, JS::MutableHandle<JS::Value>) /gecko/js/src/vm/NativeObject.cpp:2092:12
        #37 0x7d04da7cc59d in GetExistingProperty<(js::AllowGC)1> /gecko/js/src/vm/NativeObject.cpp:2120:12
        #38 0x7d04da7cc59d in NativeGetPropertyInline<(js::AllowGC)1> /gecko/js/src/vm/NativeObject.cpp:2273:14
        #39 0x7d04da7cc59d in js::NativeGetProperty(JSContext*, JS::Handle<js::NativeObject*>, JS::Handle<JS::Value>, JS::Handle<JS::PropertyKey>, JS::MutableHandle<JS::Value>) /gecko/js/src/vm/NativeObject.cpp:2303:10
        #40 0x7d04da4c27c1 in GetProperty /gecko/js/src/vm/ObjectOperations-inl.h:113:10
        #41 0x7d04da4c27c1 in GetProperty /gecko/js/src/vm/ObjectOperations-inl.h:120:10
        #42 0x7d04da4c27c1 in js::GetProperty(JSContext*, JS::Handle<JS::Value>, JS::Handle<js::PropertyName*>, JS::MutableHandle<JS::Value>) /gecko/js/src/vm/Interpreter.cpp:4630:10
        #43 0x7d04da4a112b in GetPropertyOperation /gecko/js/src/vm/Interpreter.cpp:280:10
        #44 0x7d04da4a112b in js::Interpret(JSContext*, js::RunState&) /gecko/js/src/vm/Interpreter.cpp:2941:12
        #45 0x7d04da489b98 in MaybeEnterInterpreterTrampoline /gecko/js/src/vm/Interpreter.cpp:395:10
        #46 0x7d04da489b98 in js::RunScript(JSContext*, js::RunState&) /gecko/js/src/vm/Interpreter.cpp:464:13
        #47 0x7d04da48af3d in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) /gecko/js/src/vm/Interpreter.cpp:622:13
        #48 0x7d04da48cc41 in InternalCall /gecko/js/src/vm/Interpreter.cpp:657:10
        #49 0x7d04da48cc41 in js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>, js::CallReason) /gecko/js/src/vm/Interpreter.cpp:689:8
        #50 0x7d04da5b8d46 in JS_CallFunctionValue(JSContext*, JS::Handle<JSObject*>, JS::Handle<JS::Value>, JS::HandleValueArray const&, JS::MutableHandle<JS::Value>) /gecko/js/src/vm/CallAndConstruct.cpp:55:10
        #51 0x7d04cf57c85e in nsXPCWrappedJS::CallMethod(unsigned short, nsXPTMethodInfo const*, nsXPTCMiniVariant*) /gecko/js/xpconnect/src/XPCWrappedJSClass.cpp:918:17
        #52 0x7d04cdc9ff29 in PrepareAndDispatch /gecko/xpcom/reflect/xptcall/md/unix/xptcstubs_x86_64_linux.cpp:115:37
        #53 0x7d04cdc9edde in SharedStub xptcstubs_x86_64_linux.cpp
        #54 0x7d04cdbf433e in NS_CreateServicesFromCategory(char const*, nsISupports*, char const*, char16_t const*) /gecko/xpcom/components/nsCategoryManager.cpp:680:19
        #55 0x7d04da1e40dc in nsXREDirProvider::DoStartup() /gecko/toolkit/xre/nsXREDirProvider.cpp:653:11
        #56 0x7d04da1c37bc in XREMain::XRE_mainRun() /gecko/toolkit/xre/nsAppRunner.cpp:5670:18
        #57 0x7d04da1c564b in XREMain::XRE_main(int, char**, mozilla::BootstrapConfig const&) /gecko/toolkit/xre/nsAppRunner.cpp:6138:8
        #58 0x7d04da1c66e3 in XRE_main(int, char**, mozilla::BootstrapConfig const&) /gecko/toolkit/xre/nsAppRunner.cpp:6211:21
        #59 0x5d76e1c23bd4 in do_main /gecko/browser/app/nsBrowserApp.cpp:232:22
        #60 0x5d76e1c23bd4 in main /gecko/browser/app/nsBrowserApp.cpp:464:16
        #61 0x7d04f1366d8f in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
    
    ==31797==ABORTING

Jason Kratzer [:jkratzer]

Reporter

Comment 1

•

3 months ago

Attached file Testcase — Details

Jason Kratzer [:jkratzer]

Reporter

Updated

•

3 months ago

Attachment #9488039 - Attachment filename: testcase.undefined → testcase.zip

Bugmon [:jkratzer for issues]

Comment 2

•

3 months ago

Verified bug as reproducible on mozilla-central 20250515084440-907a3d528f5e.
The bug appears to have been introduced in the following build range:

Start: 8a1f93a7dcb24a8ba7dea14f40f4b2f23b5f11d9 (20250228154350)
End: 5587ed6a3e35161635cecd4c6daf3a3ff8a279cb (20250228182258)
Pushlog: https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=8a1f93a7dcb24a8ba7dea14f40f4b2f23b5f11d9&tochange=5587ed6a3e35161635cecd4c6daf3a3ff8a279cb

Keywords: regression

Whiteboard: [bugmon:confirm] → [bugmon:bisected,confirmed]

Mayank Bansal

Comment 3

•

3 months ago

(In reply to Bugmon [:jkratzer for issues] from comment #2)

Verified bug as reproducible on mozilla-central 20250515084440-907a3d528f5e.
The bug appears to have been introduced in the following build range:

Start: 8a1f93a7dcb24a8ba7dea14f40f4b2f23b5f11d9 (20250228154350)
End: 5587ed6a3e35161635cecd4c6daf3a3ff8a279cb (20250228182258)
Pushlog: https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=8a1f93a7dcb24a8ba7dea14f40f4b2f23b5f11d9&tochange=5587ed6a3e35161635cecd4c6daf3a3ff8a279cb

Bug 1950085 seems the most likely in this range.

Regressed by: 1950085

BugBot [:suhaib / :marco/ :calixte]

Comment 4

•

3 months ago

Set release status flags based on info from the regressing bug 1950085

:lsalzman, since you are the author of the regressor, bug 1950085, could you take a look? Also, could you set the severity field?

For more information, please visit BugBot documentation.

status-firefox138: --- → affected

status-firefox139: --- → affected

status-firefox140: --- → affected

status-firefox-esr128: --- → unaffected

Flags: needinfo?(lsalzman)

Ryan VanderMeulen [:RyanVM]

Updated

•

3 months ago

status-firefox138: affected → wontfix

status-firefox139: affected → wontfix

status-firefox140: affected → fix-optional

status-firefox-esr115: --- → unaffected

Jim Mathies [:jimm]

Updated

•

3 months ago

Severity: -- → S3

Priority: -- → P3

Lee Salzman [:lsalzman]

Assignee

Comment 5

•

1 month ago

Attached file Bug 1966676 - Check for pattern surface before accessing offset. r?aosmond — Details

Phabricator Automation

Updated

•

1 month ago

Assignee: nobody → lsalzman

Status: NEW → ASSIGNED

Lee Salzman [:lsalzman]

Assignee

Updated

•

1 month ago

Flags: needinfo?(lsalzman)

Pulsebot

Comment 6

•

1 month ago

Pushed by lsalzman@mozilla.com: https://github.com/mozilla-firefox/firefox/commit/5a68f09b16f8 https://hg.mozilla.org/integration/autoland/rev/c3a89fd22e8c Check for pattern surface before accessing offset. r=aosmond

Cosmin Sabou [:CosminS]

Comment 7

•

1 month ago

bugherder

https://hg.mozilla.org/mozilla-central/rev/c3a89fd22e8c

Status: ASSIGNED → RESOLVED

Closed: 1 month ago

status-firefox143: --- → fixed

Resolution: --- → FIXED

Target Milestone: --- → 143 Branch

Bugmon [:jkratzer for issues]

Comment 8

•

1 month ago

Verified bug as fixed on rev mozilla-central 20250722093426-47d8d7840ccb.
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.

Status: RESOLVED → VERIFIED

status-firefox143: fixed → verified

Keywords: bugmon

Ryan VanderMeulen [:RyanVM]

Updated

•

1 month ago

status-firefox140: fix-optional → wontfix

status-firefox141: --- → wontfix

status-firefox142: --- → fix-optional

status-firefox-esr140: --- → fix-optional

BugBot [:suhaib / :marco/ :calixte]

Comment 9

•

1 month ago

The patch landed in nightly and beta is affected.
:lsalzman, is this bug important enough to require an uplift?

If yes, please nominate the patch for beta approval.
- See https://wiki.mozilla.org/Release_Management/Requesting_an_Uplift for documentation on how to request an uplift.
If no, please set status-firefox142 to wontfix.

For more information, please visit BugBot documentation.

Flags: needinfo?(lsalzman)

Lee Salzman [:lsalzman]

Assignee

Comment 10

•

1 month ago

Comment on attachment 9501867 [details]
Bug 1966676 - Check for pattern surface before accessing offset. r?aosmond

Beta/Release Uplift Approval Request

User impact if declined/Reason for urgency: Potential crash when drawing to canvas.
Is this code covered by automated tests?: Unknown
Has the fix been verified in Nightly?: Yes
Needs manual test from QE?: No
If yes, steps to reproduce:
List of other uplifts needed: None
Risk to taking this patch: Low
Why is the change risky/not risky? (and alternatives if risky): Just checks for null.
String changes made/needed:
Is Android affected?: Yes

Flags: needinfo?(lsalzman)

Attachment #9501867 - Flags: approval-mozilla-beta?

Lee Salzman [:lsalzman]

Assignee

Updated

•

1 month ago

Component: Graphics: CanvasWebGL → Graphics: Canvas2D

Dianna Smith [:diannaS]

Comment 11

•

1 month ago

Comment on attachment 9501867 [details]
Bug 1966676 - Check for pattern surface before accessing offset. r?aosmond

Approved for 142.0b3

Attachment #9501867 - Flags: approval-mozilla-beta? → approval-mozilla-beta+

Pulsebot

Comment 12

•

1 month ago

uplift

https://github.com/mozilla-firefox/firefox/commit/71435ea95c2e https://hg.mozilla.org/releases/mozilla-beta/rev/51ac451d440a

Dianna Smith [:diannaS]

Updated

•

1 month ago

status-firefox142: fix-optional → fixed

Mihai Boldan, Desktop QA [:mboldan]

Updated

•

27 days ago

QA Whiteboard: [qa-triage-done-c143/b142]

Ryan VanderMeulen [:RyanVM]

Updated

•

21 days ago

Attachment #9501867 - Flags: approval-mozilla-esr140?

Ryan VanderMeulen [:RyanVM]

Comment 13

•

21 days ago

Comment on attachment 9501867 [details]
Bug 1966676 - Check for pattern surface before accessing offset. r?aosmond

Approved for 140.2esr.

Attachment #9501867 - Flags: approval-mozilla-esr140? → approval-mozilla-esr140+

Pulsebot

Comment 14

•

21 days ago

uplift

https://hg.mozilla.org/releases/mozilla-esr140/rev/ecac9774c674

Ryan VanderMeulen [:RyanVM]

Updated

•

21 days ago

status-firefox-esr140: fix-optional → fixed

Testcase 3 months ago Jason Kratzer [:jkratzer] 13.60 KB, application/octet-stream		Details
Bug 1966676 - Check for pattern surface before accessing offset. r?aosmond 1 month ago Lee Salzman [:lsalzman] 48 bytes, text/x-phabricator-request	diannaS : approval-mozilla-beta+ RyanVM : approval-mozilla-esr140+	Details \| Review