Last Comment Bug 380100 - Save() crashes canvas
: Save() crashes canvas
Status: RESOLVED FIXED
[sg:critical?] 1.8-branch only
: crash, testcase, verified1.8.0.13, verified1.8.1.5
Product: Core
Classification: Components
Component: Canvas: 2D (show other bugs)
: 1.8 Branch
: All All
: -- critical (vote)
: ---
Assigned To: Mats Palmgren (:mats)
:
:
Mentors:
Depends on:
Blocks: 379903
  Show dependency treegraph
 
Reported: 2007-05-08 14:59 PDT by Paul Nickerson
Modified: 2007-08-24 17:51 PDT (History)
8 users (show)
dveditz: blocking1.8.1.5+
dveditz: blocking1.8.0.13+
dveditz: in‑testsuite?
See Also:
Crash Signature:
(edit)
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---


Attachments
This testcase crashes me all over the place, so it may have some scary potential. (192 bytes, text/html)
2007-05-08 14:59 PDT, Paul Nickerson
no flags Details
branch stack (4.92 KB, text/plain)
2007-05-08 15:14 PDT, :Gavin Sharp [email: gavin@gavinsharp.com]
no flags Details
Branch 1.8 patch, rev. 1 (3.10 KB, patch)
2007-05-10 13:49 PDT, Mats Palmgren (:mats)
vladimir: review+
vladimir: superreview+
dveditz: approval1.8.1.5+
Details | Diff | Splinter Review
Branch 1.8.0 patch, rev. 1 (2.86 KB, patch)
2007-05-10 13:50 PDT, Mats Palmgren (:mats)
vladimir: review+
vladimir: superreview+
dveditz: approval1.8.0.13+
Details | Diff | Splinter Review

Description Paul Nickerson 2007-05-08 14:59:35 PDT
Created attachment 264173 [details]
This testcase crashes me all over the place, so it may have some scary potential.
Comment 1 Martijn Wargers [:mwargers] (not working for Mozilla) 2007-05-08 15:04:59 PDT
Doesn't crash for me, using:
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9a5pre) Gecko/20070506 Minefield/3.0a5pre
Could you post a talkback ID or a stacktrace?
Comment 2 Olli Pettay [:smaug] 2007-05-08 15:10:10 PDT
WFM, Linux, trunk, but I see the crash on branch
0x000000321c2756a4 in memcpy () from /lib64/libc.so.6
(gdb) bt
#0  0x000000321c2756a4 in memcpy () from /lib64/libc.so.6
#1  0x00002aaab1246ea3 in _cairo_pen_init_copy (pen=0x175e518, other=0x198d158)
    at
/home/smaug/mozilla/mozilla_cvs/18_branch/mozilla/gfx/cairo/cairo/src/cairo-pen.c:143
#2  0x00002aaab1240240 in _cairo_gstate_clone (gstate=0x198cff0)
    at
/home/smaug/mozilla/mozilla_cvs/18_branch/mozilla/gfx/cairo/cairo/src/cairo-gstate.c:166
#3  0x00002aaab123c0e6 in *INT_cairo_save (cr=0x15ab8f0) at
/home/smaug/mozilla/mozilla_cvs/18_branch/mozilla/gfx/cairo/cairo/src/cairo.c:289
#4  0x00002aaab0f2c0fb in nsCanvasRenderingContext2D::Save (this=0x16a93f0)
    at
/home/smaug/mozilla/mozilla_cvs/18_branch/mozilla/content/canvas/src/nsCanvasRenderingContext2D.cpp:1147
#5  0x00002aaaaae99f97 in XPTC_InvokeByIndex (that=0x16a93f0, methodIndex=4,
paramCount=0, params=0x7fff94d16dd0)
    at
/home/smaug/mozilla/mozilla_cvs/18_branch/mozilla/xpcom/reflect/xptcall/src/md/unix/xptcinvoke_x86_64_linux.cpp:209
#6  0x00002aaaaecf5d4b in XPCWrappedNative::CallMethod (ccx=@0x7fff94d17150,
mode=Variable "mode" is not available.
Comment 3 :Gavin Sharp [email: gavin@gavinsharp.com] 2007-05-08 15:14:36 PDT
Created attachment 264176 [details]
branch stack

WFM on the trunk, but a branch build crashes with this stack.
Comment 4 Vladimir Vukicevic [:vlad] [:vladv] 2007-05-08 15:46:09 PDT
Oy.  I wonder what's going on here; I'll take a look if noone beats me to it.  I'm going to guess that cairo_pen_init_copy does something stupid with a really large pen due to the scale.
Comment 5 Mats Palmgren (:mats) 2007-05-10 13:49:27 PDT
Created attachment 264396 [details] [diff] [review]
Branch 1.8 patch, rev. 1

The attached testcase crashes because 
     if (pen->num_vertices > 0xffff) {
is not resetting num_vertices.  This can potentially happen in a couple of
more places, which I also fixed.  The 'clone->next' hunk is unrelated,
but since I stumbled upon it I might as well fix that too...
Comment 6 Mats Palmgren (:mats) 2007-05-10 13:50:36 PDT
Created attachment 264397 [details] [diff] [review]
Branch 1.8.0 patch, rev. 1
Comment 7 Daniel Veditz [:dveditz] 2007-06-15 11:10:13 PDT
Comment on attachment 264396 [details] [diff] [review]
Branch 1.8 patch, rev. 1

approved for 1.8.1.5 and 1.8.0.13, a=dveditz for release-drivers
Comment 8 Mats Palmgren (:mats) 2007-07-01 10:47:42 PDT
Comment on attachment 264396 [details] [diff] [review]
Branch 1.8 patch, rev. 1

Checked in to MOZILLA_1_8_BRANCH:
gfx/cairo/cairo/src/cairo-gstate.c  1.1.4.2
gfx/cairo/cairo/src/cairo-pen.c     1.1.4.5
Comment 9 Mats Palmgren (:mats) 2007-07-01 10:48:20 PDT
Comment on attachment 264397 [details] [diff] [review]
Branch 1.8.0 patch, rev. 1

Checked in to MOZILLA_1_8_0_BRANCH:
gfx/cairo/cairo/src/cairo-gstate.c  1.1.4.1.2.1
gfx/cairo/cairo/src/cairo-pen.c     1.1.4.1.2.1
Comment 10 Carsten Book [:Tomcat] 2007-07-10 17:07:25 PDT
verified fixed 1.8.1.5 using Mozilla/5.0 (Windows; U; Windows NT 5.2; en-US; rv:1.8.1.5pre) Gecko/2007071004 BonEcho/2.0.0.5pre on Windows x64 SP2 and Linux Fedora F7 with the testcase from this bug.

No crash on Testcase with 1.8.1.5 - adding verified keyword
Comment 11 Al Billings [:abillings] 2007-08-22 17:33:43 PDT
This doesn't crash Thunderbird 1.5.0.13 (2007080918) but I cannot get it to
crash 1.5.0.12 either.
Comment 12 Carsten Book [:Tomcat] 2007-08-23 08:00:16 PDT
verified fixed 1.8.0.13 using Mozilla/5.0 (Windows; U; Windows NT 5.2; en-US; rv:1.8.0.13pre) Gecko/20070822 Firefox/1.5.0.13pre

no crash on testcase - adding verified keyword

Note You need to log in before you can comment on or make changes to this bug.