355498 - Crash [@ kernel32.dll] on trunk windows builds with the testcase from bug 355216

Status: RESOLVED WORKSFORME

(Core :: Graphics: Canvas2D, defect)

Description

[Martijn Wargers (dead)]

With the testcase from bug 355216, I crash with current trunk builds on windows.
I would expect an out of memory error or illegal value error instead in the error console.

Talkback ID: TB24140179K
kernel32.dll + 0x12a5b (0x7c812a5b)
MSVCR80.dll + 0x28dd3 (0x60258dd3)
MSVCR80.dll + 0x30e59 (0x60260e59)
nsCanvasRenderingContext2D::GetImageData 
[mozilla\content\canvas\src\nscanvasrenderingcontext2d.cpp, line 2874]
XPTC_InvokeByIndex  [mozilla\xpcom\reflect\xptcall\src\md\win32\xptcinvoke.cpp,
line 102]
XPCWrappedNative::CallMethod 
[mozilla\js\src\xpconnect\src\xpcwrappednative.cpp, line 2197]

This is probably a windows only problem, G30rgi and bc couldn't reproduce this on linux or Mac.

Marking security sensitive, since bug 355216 is also security sensitive.

Comment 1

[Jesse Ruderman]

Vlad, can you look at this?

Comment 2

[:Gavin Sharp [email: [e-mail]]]

This looks like another instance of bug 353144.

Comment 3

[Window Snyder]

If you are not the right person to assign this to, please help us find someone that is.

Comment 4

[Martijn Wargers (dead)]

I don't crash anymore, using:
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9a5pre) Gecko/20070524 Minefield/3.0a5pre
I guess this could be fixed by bug bug 353144.

I'm opening this bug up, because bug 355216 is also not security sensitive anymore.

I'm still seeing an issue with the testcase with current trunk build, namely nothing gets repainted inside the canvas. I filed bug 381930 for that.