1982056 - Hit MOZ_CRASH(Content-process DrawTargetRecording can't create requested similar drawtarget) at /gfx/2d/DrawTargetRecording.cpp:829

Status: RESOLVED FIXED

(Core :: Graphics, defect)

Description

[Jason Kratzer [:jkratzer]]

Testcase found while fuzzing mozilla-central rev d1eb95caca71 (built with: --enable-debug --enable-fuzzing).

Testcase can be reproduced using the following commands:

$ pip install fuzzfetch grizzly-framework --upgrade
$ python -m fuzzfetch --build d1eb95caca71 --debug --fuzzing  -n firefox
$ python -m grizzly.replay.bugzilla ./firefox/firefox <bugid>

Hit MOZ_CRASH(Content-process DrawTargetRecording can't create requested similar drawtarget) at /gfx/2d/DrawTargetRecording.cpp:829

    ==125661==ERROR: UndefinedBehaviorSanitizer: SEGV on unknown address 0x000000000000 (pc 0x742d5b33deef bp 0x7ffcf458ffa0 sp 0x7ffcf458ff20 T125661)
    ==125661==The signal is caused by a WRITE memory access.
    ==125661==Hint: address points to the zero page.
        #0 0x742d5b33deef in MOZ_CrashSequence /builds/worker/workspace/obj-build/dist/include/mozilla/Assertions.h:248:3
        #1 0x742d5b33deef in mozilla::gfx::DrawTargetRecording::CreateSimilarDrawTarget(mozilla::gfx::IntSizeTyped<mozilla::gfx::UnknownUnits> const&, mozilla::gfx::SurfaceFormat) const /gfx/2d/DrawTargetRecording.cpp:827:5
        #2 0x742d5d5f6222 in mozilla::dom::ImageBitmap::PrepareForDrawTarget(mozilla::gfx::DrawTarget*) /dom/canvas/ImageBitmap.cpp:858:26
        #3 0x742d5d5f4fa6 in mozilla::dom::CanvasRenderingContext2D::CreatePattern(mozilla::dom::HTMLImageElementOrSVGImageElementOrHTMLCanvasElementOrHTMLVideoElementOrOffscreenCanvasOrImageBitmapOrVideoFrame const&, nsTSubstring<char16_t> const&, mozilla::ErrorResult&) /dom/canvas/CanvasRenderingContext2D.cpp:2706:47
        #4 0x742d5d0dd42a in mozilla::dom::CanvasRenderingContext2D_Binding::createPattern(JSContext*, JS::Handle<JSObject*>, void*, JSJitMethodCallArgs const&) /builds/worker/workspace/obj-build/dom/bindings/./CanvasRenderingContext2DBinding.cpp:5484:80
        #5 0x742d5d4f071d in bool mozilla::dom::binding_detail::GenericMethod<mozilla::dom::binding_detail::NormalThisPolicy, mozilla::dom::binding_detail::ThrowExceptions>(JSContext*, unsigned int, JS::Value*) /dom/bindings/BindingUtils.cpp:3304:13
        #6 0x742d60d81124 in CallJSNative(JSContext*, bool (*)(JSContext*, unsigned int, JS::Value*), js::CallReason, JS::CallArgs const&) /js/src/vm/Interpreter.cpp:501:13
        #7 0x742d60d8097f in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) /js/src/vm/Interpreter.cpp:597:12
        #8 0x742d61905aa2 in js::jit::DoCallFallback(JSContext*, js::jit::BaselineFrame*, js::jit::ICFallbackStub*, unsigned int, JS::Value*, JS::MutableHandle<JS::Value>) /js/src/jit/BaselineIC.cpp:1705:10
        #9 0x34cac78920fe  ([anon:js-executable-memory]+0x1c0fe)
    
    ==125661==Register values:
    rax = 0x0000000000000000  rbx = 0x00007ffcf4590010  rcx = 0x000000000000033d  rdx = 0x0000742d6b01a563  
    rdi = 0x0000742d6b01b700  rsi = 0x0000000000000000  rbp = 0x00007ffcf458ffa0  rsp = 0x00007ffcf458ff20  
     r8 = 0x0000000000000000   r9 = 0x0000000000000003  r10 = 0x0000000000000000  r11 = 0x0000000000000293  
    r12 = 0x00007ffcf4590008  r13 = 0x0000000000000000  r14 = 0x0000566ac625d860  r15 = 0x0000000000000000  
    UndefinedBehaviorSanitizer can not provide additional info.
    SUMMARY: UndefinedBehaviorSanitizer: SEGV /builds/worker/workspace/obj-build/dist/include/mozilla/Assertions.h:248:3 in MOZ_CrashSequence
    ==125661==ABORTING

Comment 1

[Jason Kratzer [:jkratzer]]

Attachment: Testcase

Comment 2

[Bugmon [:jkratzer for issues]]

Testcase crashes using the initial build (mozilla-central 20250808040847-d1eb95caca71) but not with tip (mozilla-central 20250810210608-a8a8028addc8.)

Unable to bisect testcase (Start build didn't crash!):

Start: d1eb95caca71d91fab853631a3eb1cec2c1abdca (20250808040847)
End: a8a8028addc8ef776b6f2ce3ec7c88b1093ba706 (20250810210608)
BuildFlags: BuildFlags(asan=True, tsan=False, debug=False, fuzzing=True, coverage=False, valgrind=False, no_opt=False, fuzzilli=False, nyx=False, searchfox=False, afl=False)

Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.

Comment 3

[Timothy Nikkel (:tnikkel)]

Attachment: Bug 1982056. In ImageBitmap::PrepareForDrawTarget check if we can create a draw target of the specified size first. r?#gfx-reviewers

Comment 5

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/98bc841a4af8
https://hg.mozilla.org/integration/autoland/rev/1cbd03d77aa1
In ImageBitmap::PrepareForDrawTarget check if we can create a draw target of the specified size first. r=gfx-reviewers,nical

Comment 6

[Cristina Horotan [:chorotan]]

https://hg.mozilla.org/mozilla-central/rev/1cbd03d77aa1