380100 - Save() crashes canvas

Status: RESOLVED FIXED

(Core :: Graphics: Canvas2D, defect)

Description

[Paul Nickerson]

Attachment: This testcase crashes me all over the place, so it may have some scary potential.

Comment 1

[Martijn Wargers (dead)]

Doesn't crash for me, using:
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9a5pre) Gecko/20070506 Minefield/3.0a5pre
Could you post a talkback ID or a stacktrace?

Comment 2

[Olli Pettay [:smaug][[e-mail]]]

WFM, Linux, trunk, but I see the crash on branch
0x000000321c2756a4 in memcpy () from /lib64/libc.so.6
(gdb) bt
#0  0x000000321c2756a4 in memcpy () from /lib64/libc.so.6
#1  0x00002aaab1246ea3 in _cairo_pen_init_copy (pen=0x175e518, other=0x198d158)
    at
/home/smaug/mozilla/mozilla_cvs/18_branch/mozilla/gfx/cairo/cairo/src/cairo-pen.c:143
#2  0x00002aaab1240240 in _cairo_gstate_clone (gstate=0x198cff0)
    at
/home/smaug/mozilla/mozilla_cvs/18_branch/mozilla/gfx/cairo/cairo/src/cairo-gstate.c:166
#3  0x00002aaab123c0e6 in *INT_cairo_save (cr=0x15ab8f0) at
/home/smaug/mozilla/mozilla_cvs/18_branch/mozilla/gfx/cairo/cairo/src/cairo.c:289
#4  0x00002aaab0f2c0fb in nsCanvasRenderingContext2D::Save (this=0x16a93f0)
    at
/home/smaug/mozilla/mozilla_cvs/18_branch/mozilla/content/canvas/src/nsCanvasRenderingContext2D.cpp:1147
#5  0x00002aaaaae99f97 in XPTC_InvokeByIndex (that=0x16a93f0, methodIndex=4,
paramCount=0, params=0x7fff94d16dd0)
    at
/home/smaug/mozilla/mozilla_cvs/18_branch/mozilla/xpcom/reflect/xptcall/src/md/unix/xptcinvoke_x86_64_linux.cpp:209
#6  0x00002aaaaecf5d4b in XPCWrappedNative::CallMethod (ccx=@0x7fff94d17150,
mode=Variable "mode" is not available.

Comment 3

[:Gavin Sharp [email: [e-mail]]]

Attachment: branch stack

WFM on the trunk, but a branch build crashes with this stack.

Comment 4

[Vladimir Vukicevic [:vlad] [:vladv] (needinfo me, slow to respond)]

Oy.  I wonder what's going on here; I'll take a look if noone beats me to it.  I'm going to guess that cairo_pen_init_copy does something stupid with a really large pen due to the scale.

Comment 5

[Mats Palmgren (inactive)]

Attachment: Branch 1.8 patch, rev. 1

The attached testcase crashes because 
     if (pen->num_vertices > 0xffff) {
is not resetting num_vertices.  This can potentially happen in a couple of
more places, which I also fixed.  The 'clone->next' hunk is unrelated,
but since I stumbled upon it I might as well fix that too...

Comment 6

[Mats Palmgren (inactive)]

Attachment: Branch 1.8.0 patch, rev. 1

Comment 7

[Daniel Veditz [:dveditz]]

Comment on attachment 264396 [details] [diff] [review]
Branch 1.8 patch, rev. 1

approved for 1.8.1.5 and 1.8.0.13, a=dveditz for release-drivers

Comment 8

[Mats Palmgren (inactive)]

Comment on attachment 264396 [details] [diff] [review]
Branch 1.8 patch, rev. 1

Checked in to MOZILLA_1_8_BRANCH:
gfx/cairo/cairo/src/cairo-gstate.c  1.1.4.2
gfx/cairo/cairo/src/cairo-pen.c     1.1.4.5

Comment 9

[Mats Palmgren (inactive)]

Comment on attachment 264397 [details] [diff] [review]
Branch 1.8.0 patch, rev. 1

Checked in to MOZILLA_1_8_0_BRANCH:
gfx/cairo/cairo/src/cairo-gstate.c  1.1.4.1.2.1
gfx/cairo/cairo/src/cairo-pen.c     1.1.4.1.2.1

Comment 10

[Carsten Book [:Tomcat]]

verified fixed 1.8.1.5 using Mozilla/5.0 (Windows; U; Windows NT 5.2; en-US; rv:1.8.1.5pre) Gecko/2007071004 BonEcho/2.0.0.5pre on Windows x64 SP2 and Linux Fedora F7 with the testcase from this bug.

No crash on Testcase with 1.8.1.5 - adding verified keyword

Comment 11

[Al Billings [:abillings - ex-MoCo]]

This doesn't crash Thunderbird 1.5.0.13 (2007080918) but I cannot get it to
crash 1.5.0.12 either.

Comment 12

[Carsten Book [:Tomcat]]

verified fixed 1.8.0.13 using Mozilla/5.0 (Windows; U; Windows NT 5.2; en-US; rv:1.8.0.13pre) Gecko/20070822 Firefox/1.5.0.13pre

no crash on testcase - adding verified keyword