368788 - crash in xpcshell [@ _moz_cairo_get_operator - nsCanvasRenderingContext2D::GetGlobalCompositeOperation]

Status: RESOLVED WONTFIX

(Core :: Graphics, defect)

Description

[Ray Kiddy]

Sorry if this is the wrong component, but it is an odd situation. I did a local build of FireFox on my intel Mac and so I have all the tests built. I ran through some of the js files to determine which of them should be runnable by xpcshell.

It has been mentioned that these may be runnable with jssh. But jssh is not built by default. Right now, I am of the opinion that if it is just plain js, then xpcshell should be able to run it. If there is some reason that jssh is the best way to run these, then I would ask why we do not build jssh by default.

I get a reproducible crash when I run xpcshell in this way:

( cd dist/bin ; ./xpcshell ../../js/src/xpconnect/tests/js/old/xpctest_enum_create.js )

FYI, I also get the crash when I run it as this.

( cd dist/bin ; run-mozilla.sh ./xpcshell ../../js/src/xpconnect/tests/js/old/xpctest_enum_create.js )

I am not sure whether these last two should be different or not.

Also, I get the same results when I run these from the "MinefieldDebug.app/Contents/MacOS" directory also. Just FYI. It makes sense that this makes no difference. I just wanted to report it.

I will attach a full lof of the run and the crash log. At the bottom of the output, I see:

**
 * ContractID: '@mozilla.org/content/canvas-rendering-context;1?id=2d'
 * CLSID: {a35d1cd4-c505-4d2d-a0f9-aef00b7ce5a5}
WARNING: NS_ENSURE_TRUE(gNameSpaceManager) failed: file nsDOMClassInfo.cpp, line 1766
WARNING: NS_ENSURE_TRUE(NS_SUCCEEDED(rv)) failed: file nsDOMClassInfo.cpp, line 3707
WARNING: NS_ENSURE_TRUE(gNameSpaceManager) failed: file nsDOMClassInfo.cpp, line 1766
WARNING: NS_ENSURE_TRUE(NS_SUCCEEDED(rv)) failed: file nsDOMClassInfo.cpp, line 3707
 * Supports Interface: nsIDOMCanvasRenderingContext2D
###!!! ASSERTION: invalid array index: 'i < Length()', file ../../../dist/include/xpcom/nsTArray.h, line 318
###!!! ASSERTION: invalid array index: 'i < Length()', file ../../../dist/include/xpcom/nsTArray.h, line 318
Bus error

Comment 1

[Ray Kiddy]

Attachment: crash log from the xpcshell executable

Comment 2

[Ray Kiddy]

Attachment: output from running xpcshell

Comment 3

[timeless]

0   libthebes.dylib       	0x054b177e _moz_cairo_get_operator + 9 (cairo.c:2761)
1   libgklayout.dylib     	0x06639982 nsCanvasRenderingContext2D::GetGlobalCompositeOperation(nsAString_internal&) + 26 (nsCanvasRenderingContext2D.cpp:2038)
2   libxpcom_core.dylib   	0x010846a6 NS_InvokeByIndex + 84 (xptcinvoke_unixish_x86.cpp:179)
3   libxpconnect.dylib    	0x02845e07 XPCWrappedNative::CallMethod(XPCCallContext&, XPCWrappedNative::CallMode) + 5351 (xpcwrappednative.cpp:2209)
4   libxpconnect.dylib    	0x0284ed03 XPC_WN_GetterSetter(JSContext*, JSObject*, unsigned, long*, long*) + 507 (xpcprivate.h:1994)
5   libmozjs.dylib        	0x002438be js_Invoke + 2854 (jsinterp.c:1348)
6   libmozjs.dylib        	0x00243bf3 js_InternalInvoke + 241 (jsinterp.c:1442)
7   libmozjs.dylib        	0x00243dac js_InternalGetOrSet + 309 (jsinterp.c:1515)
8   libmozjs.dylib        	0x00263922 js_NativeGet + 515 (jsobj.c:3424)
9   libmozjs.dylib        	0x00264190 js_GetProperty + 658 (jsobj.c:3567)
10  libmozjs.dylib        	0x0024e192 js_Interpret + 38436 (jsinterp.c:3805)
11  libmozjs.dylib        	0x002440a4 js_Execute + 753 (jsinterp.c:1607)
12  libmozjs.dylib        	0x002132d9 JS_ExecuteScript + 56 (jsapi.c:4207)
13  xpcshell              	0x0000349c ProcessFile(JSContext*, JSObject*, char const*, __sFILE*, int) + 236 (xpcshell.cpp:596)
14  xpcshell              	0x0000386d Process(JSContext*, JSObject*, char const*, int) + 213 (xpcshell.cpp:675)
15  xpcshell              	0x00004b20 main + 3920 (xpcshell.cpp:830)
16  xpcshell              	0x0000244a _start + 228 (crt.c:272)
17  xpcshell              	0x00002365 start + 41

Comment 4

[Jesse Ruderman]

So, canvas is trying to use cairo in a command-line application?  That sounds like a recipe for failure.

Comment 5

[Vladimir Vukicevic [:vlad] [:vladv] (needinfo me, slow to respond)]

The rendering context expects to have SetSize or InitializeWithSurface called on it first before any of the other methods are called; it doesn't null check any of the calls to cairo in those since generally it's just unnecessary overhead.  If we want to avoid this type of crash, we could just initialize the context to a dummy 1x1 surface in the constructor which should make this go away.

Comment 7

[Sylvestre Ledru [:Sylvestre]]

Closing because no crash reported since 12 weeks.